Hardening Honeypots for Industrial Control Systems

Simple item page
dc.contributor.authorMeier, Joseph
dc.contributor.authorNguyen, Thuy
dc.contributor.authorRowe, Neil
dc.date.accessioned2022-12-27T19:23:11Z
dc.date.available2022-12-27T19:23:11Z
dc.date.issued2023-01-03
dc.description.abstractHoneypots are computers that collect intelligence about new cyberattacks and malware behavior. To be successful, these decoys must allow attackers to probe a system without compromising data collection. Previously, we developed an industrial control system (ICS) honeypot simulating a small electric-distribution system, but this honeypot was attacked, and its log data was deleted. The current work analyzed the attacks and developed methods to harden the main weaknesses of the public user interface. The hardened honeypot included more robust data collection and logging capabilities, and was deployed in a commercial cloud environment. We observed significant scanning and new attacks, including the well-known BlueKeep exploit and activity related to Russian cyberattacks on Ukraine. Our results showed that the added security controls, monitoring, and logging were more effective in protecting the honeypot’s data and event logs.
dc.format.extent10
dc.identifier.doi10.24251/HICSS.2023.806
dc.identifier.isbn978-0-9981331-6-4
dc.identifier.urihttps://hdl.handle.net/10125/103440
dc.language.isoeng
dc.relation.ispartofProceedings of the 56th Hawaii International Conference on System Sciences
dc.rightsAttribution-NonCommercial-NoDerivatives 4.0 International
dc.rights.urihttps://creativecommons.org/licenses/by-nc-nd/4.0/
dc.subjectCybersecurity and Software Assurance
dc.subjectcybersecurity
dc.subjecthoneypot
dc.subjectindustrial control system
dc.subjectlogging
dc.subjectrdp attack
dc.titleHardening Honeypots for Industrial Control Systems
dc.type.dcmitext
prism.startingpage6665

Files

Collections

Cybersecurity and Software Assurance