You See Honey, I See Beehive: Developing Honey Networks
summary
Claims an end-to-end deception system that cuts breach-detection time from weeks or months down to hours by combining Phantom networks (fake subnets fed to a NetFlow v9 collector) with low/medium honeypots and a SIEM/SOAR. Deployments use Splunk or security NetFlow vendors (Cisco StealthWatch, Plixer), integrate with NAC (Forescout, FortiNAC, Cisco ISE) and packet-capture for quarantine. Example: a DISA environment’s X‑ray scanner port‑scanned and tripped a Phantom network, proving the reconnaissance tripwire approach works and scales.
AI-written summary · about
chapters (16)
- 0:00Intro
- 1:28Cat And Mouse Game
- 4:08Basic Attack Conept
- 7:57Endpoint and Branch Network
- 8:35Security Capabilities
- 10:10NetFlow = Visibility
- 11:23Why Unsampled NetFlow?
- 12:10Phantom Network Zones Concept
- 13:35Phantom Network Alarm Examples
- 14:23Subnets Designed for Threat Detectio
- 15:21Honeypot Personas
- 17:14Honeypot Usage
- 18:40Beware - Honeypot Recon
- 20:18Combine Phantom Networks, Honeypots +
- 24:20Tuning Your SIEM
- 26:35Keep it Simple
related talks
35mCyber Deception 2.0: Adaptive Honeynets and Canary Intelligence in Production
46mApplied Deception Beyond the Honeypot: Moving Past 101
15mOn Design and Enhancement of Smart Grid Honeypot System for Practical Collection...
23mHoneypots 2.0: A New ‘Twist’ on Defending Enterprise Networks
34mWho Goes There? Detecting Intruders With Honeytokens
32mFaking a Factory: Creating and Operating a Realistic Honeypot
46mDeception Is on the Rise, But Is It Time to Unleash Engagement Operations?
33mThe Black Hat Europe NOC Report