1. Honeypots and Automation
Adam Luck
Copyright 2015, all rights reserved

2. Who am I? Adam Luck Senior Engineer - MicroSolved, Inc.
Graduated from Ohio University

3. Why use Honeypots and Automation?
“Set it and forget it”
No reliance on signatures
Everything alert is actionable

4. What can I discover? Insider Threats Uncategorized Malware
0-Day Exploits
Phishing Campaigns

5. Prevention vs Detection
Traditional methods are failing
Redefined network perimeter
“Un-hackable” systems and networks
Often takes orgs months to discover attacks
Still easy to hack a human

6. Low Interaction vs. High Interaction
Do you just want to detect an attack?
Are you more interested in learning about the attacker’s methods?

7. Honeypot Placement and Design
Services
Applications
Critical network segments
Internet exposure?

8. Example: DNS Sinkhole

9. Example: Retail POS

10. Example: M&A

11. Example: Automated Egress Log Review

12. More Information & Questions
More information: stateofsecurity.com & microsolved.com
Copyright MicroSolved, Inc. 2015, all rights reserved