This document discusses SCADA honeypots, which are devices or systems placed on a network with no operational purpose in order to detect attacks. Honeypots can detect attacks since anything accessing them is suspicious as they have no legitimate use. While some debate their effectiveness, honeypots can provide valuable information by allowing researchers to learn how attackers work when they interact with the honeypot. The level of interaction and visibility of the honeypot must be considered to balance obtaining useful data with security risks.

2. SCADA Honeypots
• A device or system (Honeynet) that is on a live
network, but has no operational purpose
– Different levels of interaction / realism
– How long will it fool an attacker

3. Detect Attacks
• Nothing should access the Honeypot since it has
no legitimate purpose
• Any traffic is either an attack or spurious traffic
• Debate on the value of Honeypot’s in detecting
attacks
– Many say there are better, more efficient solutions
– IDS and other network monitoring

4. Learn How Attackers Work
• Real value of the Honeypot
• High interaction may lead to attacker revealing
advanced techniques, end goals, other info
• Decision … how exposed is the Honeypot?
– Widely exposed (on Internet) many will hit the
Honeypot and lots of data to review
– Hidden on secure network, may see little activity

6. Analysis is Important

8. Incubator

9. Why An Incubator?
• Be prepared to analyze malware / attacks
• Identify what the attack did so you can fix the
affected systems
• Learn what information or control was lost
• Attempt to identify the attacker