2
votes
2answers
408 views

Suricata IPS rules for honeypot

I have a really simple high interaction honeypot and I have just installed a VM as an IPS (suricata) with a transparent bridge between my router and the honeypot. The setup looks something like this: ...
1
vote
1answer
752 views

Is a honeypot an IDS or an IPS or something else? Is it an offensive or a defensive technique? Is it still effective?

I'd like to know where a Honeypot falls into the scheme of security, and if it is still an effective tool?
9
votes
2answers
403 views

Using “canaries” to detect intrusion?

I haven't read much about such a technique, but I'm wondering if there's any sort of best practice around the use of "canaries" to detect certain types of intrusion: Create a bogus account that ...