Who Goes There? Detecting Intruders With Honeytokens
summary
Claims that decoy credentials catch intruders early and cut dwell time, backed by finding 10 million hard-coded credentials on public GitHub last year. Demonstrates a working DIY pipeline using GG Canary built with Terraform on AWS: fake IAM keys, CloudTrail → S3 → Lambda alerts to Slack/SES. Live example shows a deployed token triggered by automated scanners (including truffleHog), recording 12 scans before revocation. Advises one-to-one tokens, keep them private (CI, vaults, private repos), automate rotation and revoke on trigger.
AI-written summary · about
chapters (22)
- 0:00intro
- 1:43preamble
- 2:00about dwayne
- 2:50let's deploy something real quick
- 3:12attackers want your credentials
- 3:54uber breach - september 2022
- 4:49astrazeneca - november 2022
- 5:34circleci - january 2023
- 6:44hardcoded credentials
- 7:11we know how attackers behave
- 7:29what attackers want
- 7:54in the 2023 of the state of secrets sprawl
- 9:00a brief history of cyber deception
- 17:05what is a honeytoken?
- 19:26honeytoken options
- 19:37open source - the diy route
- 21:11commercial options - off the shelf
- 23:37honeytoken best practices
- 29:01let's check on our honeytoken from earlier...
- 31:37in conclusion
- 32:42honeytoken options
- 33:24thanks, reach out!
related talks
25mBreach Detection At Scale With AWS Honey Tokens
46mRollout Your Hardcoded Secrets Detection With Min Effort & Max Impact!
39mSecurity in a DevOps World
30mBlank Space: Filling the Gaps in Atomic and...
30mYou See Honey, I See Beehive: Developing Honey Networks
22mThe Hidden Access Paths to Smaugs Cavern
39mManaging Trust Between Multiple Clouds and Non-human Identities Without Passwords
22mPostgreSQL Threats and Attacks in the Wild