Industrial Control Systems honeypot

[Shlomi_Feldman]

Hi Checkmates,

This time I want to share with you a useful tool for ICS/IOT security.

Conpot is a low interactive server side Industrial Control Systems honeypot, which can allow us to simulate multiple systems types. 

Running an Honeypot might allow us to understand who are our opponents and how they attempts to exploit our environment. later this information might help us to develop accordingly our security solution for the "real" product environment.

you can get Conpot from  github.com/glastopf/conpot 

enjoy 

[007_mjn]

can you explain how to use honeypot with checkpoint firewall.

I have to deploy honeypot with 6200 and 3600 series firewall. 3600 series firewall for IOT devices security. 

where to deploy honeypot and how to designed topologies for this?

[Shlomi_Feldman]

please follow the instructions here https://conpot.readthedocs.io/en/latest/

the honeypot is not installed on CP GWs. however based on the results you can update your security policy and activate if necessary additional threat preventions tools

[Blason_R]

conpot is there for quite a long time and yes indeed its good one but its a low interaction.