MITRE D3FENDdefensive technique

D3-CHN Connected Honeynet

Official page ↗
Tactic
Deceive

Definition

A decoy service, system, or environment, that is connected to the enterprise network, and simulates or emulates certain functionality to the network, without exposing full access to a production system.

How it works

How it works Decoy honeypots are deployed within the enterprise environment that emulate certain services or portions of an OS to attract attackers. Considerations A connected honeynet provides a tradeoff between emulating certain functionality but not being as sophisticated as an integrated honeynet. The connected honeynet may not provide enough functionality to detect new attack patterns or zero day exploits but could provide enough functionality for specific known vulnerabilities.

Related

Child of · MITRE D3FEND (1)

  • D3-DE Decoy Environment defensive technique

References