MITRE D3FENDdefensive technique
D3-CHN Connected Honeynet
- Tactic
- Deceive
Definition
A decoy service, system, or environment, that is connected to the enterprise network, and simulates or emulates certain functionality to the network, without exposing full access to a production system.
How it works
How it works
Decoy honeypots are deployed within the enterprise environment that emulate certain services or portions of an OS to attract attackers.
Considerations
A connected honeynet provides a tradeoff between emulating certain functionality but not being as sophisticated as an integrated honeynet. The connected honeynet may not provide enough functionality to detect new attack patterns or zero day exploits but could provide enough functionality for specific known vulnerabilities.
Related
Child of · MITRE D3FEND (1)
- D3-DE Decoy Environment defensive technique
References
- https://patents.google.com/patent/US20170149825A1 Modification of a Server to Mimic a Deception Mechanism