Honeypots and honeypot networks help security researchers get a good look at different attacker techniques across a variety of systems. This information can be used to better protect our systems and networks, but it takes a lot of work to sift through the data. Installing a network of honeypots to provide useful information should be an easy task, but there just isn't much to tie everything together in a useful manner. In this presentation, I will demonstrate how I modify and use existing honeypot frameworks and applications with personal tools and techniques to process attack-related data to automate analysis and create actionable intelligence. All the code and instructions I use will be made available for others to work with.

Josh is a security analyst with OpenDNS. Previously, he worked as a threat analyst with NASA, where he was part of the team to initially help build out the Security Operations Center. He has also done some time at Mandiant. His professional interests involve network, computer and data security with a goal of maintaining and improving the security of as many systems and networks as possible. Josh rides motorcycles, likes minimalist camping and makes dark electronic music. Josh has presented at Defcon, various B Sides across the US and Source Boston.

Back to Derbycon 2015 video list