Instructor: Internal intelligence sources
include the data and insights gathered
from within an organization's own network and systems
to identify potential threats.
Internal intelligence sources
include adversary emulation engagements,
honeypots, and honeynets.
Adversary emulation engagements
simulate real-world attacker behavior
within the network
to observe how attackers
might actually exploit vulnerabilities,
enabling defenses to be put in place.
Next, honeypots are decoy systems set up
to attract and detect real attackers
by mimicking valuable assets.
Finally, honeynets are networks
of honeypots designed to be attacked.
Let's learn more about adversary emulation engagements,
honeypots, and honeynets.
First, we have adversary emulation engagements.
Adversary emulation engagements
are simulations designed to mimic
the tactics, techniques, and procedures
of real-world attackers
within an enterprise's network.
The goal is to provide security teams
with an opportunity to see
how a specific attacker
would exploit vulnerabilities,
and move within the network
without any actual threat to the organization.
These engagements allow the security team
to test their defenses,
identify weaknesses,
and improve their response strategies
by observing how their systems hold up
under realistic attack scenarios,
organizations can ensure they are prepared
for genuine threats.
To implement adversary emulation engagements,
a security team would first select or design
a scenario based on a known threat actor
or attack vector.
To do this,
they could use tools that simulate
common attack behaviors like lateral movement,
privilege escalation, or data exfiltration,
all within a controlled environment.
Then the security team can monitor
how the network and its defenses
respond to the emulated engagement,
recording any gaps or delays in detection,
and then correcting them.
This helps refine detection capabilities
and improves the response
to future real-world incidents.
Overall, adversary emulation engagements
reveal how well current security measures
work against known threats.
The advantage of adversary emulation
is that these scenarios
mimic real attacker behavior,
meaning that defenses are tested
against the same methods
attackers will use in the wild.
So the insights gathered allow teams
to make necessary adjustments
before an actual attack occurs,
improving the overall security posture
of the organization.
Second, we have honeypots.
Honeypots are decoy systems or devices
set up within an organization's network
to attract attackers and study their behavior.
Honeypots mimic real assets
such as servers or databases,
but are intentionally left vulnerable,
or appear as high-value targets to attackers.
Honeypots are designed to detect unauthorized access,
gather information about attack methods,
and divert attackers away from actual systems.
So by luring attackers into attacking a honeypot,
organizations can collect detailed information
about their tactics without risking actual damage
to important infrastructure.
To set up a honeypot,
an organization would place the decoy asset
in an area of the network
where it is likely to be discovered by attackers,
such as within a screened subnet,
also known as a demilitarized zone,
or close to other visible systems.
The honeypot should appear as an attractive target,
perhaps by emulating a critical server,
or containing seemingly valuable data.
It can then be configured to log
all interactions and activity,
allowing security teams
to monitor any suspicious behavior in real time.
The honeypot's purpose
is not to actively defend the network,
but to serve as a decoy tool
for gathering intelligence,
and identifying actual attack patterns
and attack strategies.
For instance, a company might deploy a honeypot
designed to mimic a file server
containing sensitive financial information.
Then when an attacker tries to access
or manipulate files in the honeypot,
the security team can observe
the exact methods that are being used.
This real-time intelligence allows the team
to then adjust firewalls,
detection systems, and internal policies
to prevent similar attack techniques
on their actual production systems.
Third and last, we have honeynets.
Honeynets take the decoy concept a step further
by creating entire networks of honeypots.
A honeynet is a highly controlled
and monitored network of multiple honeypots
that work together to simulate
an organization's production network.
Honeynets appear as a legitimate network to attackers,
but all systems within a honeynet are fake,
serving only to trap, delay,
and allow observation of attack methods.
The idea behind honeynets
is to provide an environment that entices attackers
to reveal more complex tactics and techniques,
offering deeper insights into their operations.
Setting up a honeynet
involves creating a realistic network architecture
that includes different types of honeypots,
such as web servers, email servers, and databases.
Each of these components is designed
to appear as a legitimate part of a network,
luring attackers in,
and capturing their actions.
A honeynet is usually placed
in a part of the network
where attackers are likely to interact,
such as the same space as public-facing servers,
within a screened subnet,
or even within an internal network.
By observing the movement of attackers
within the honeynet,
security teams can analyze patterns of attack
that may not be visible in similar setups
like single honeypots.
In this way,
honeynets can provide in-depth intelligence
on how attackers escalate privileges,
pivot between systems,
and attempt to extract data.
This helps organizations
bolster their defenses,
particularly against complex multi-stage attacks.
For example, an enterprise might deploy a honeynet
that mimics their entire internal network,
including workstations and databases.
Over time, after initial compromise,
attackers may attempt to move laterally
within the honeynet,
testing different attack vectors.
The enterprise's security team
can then analyze the tactics, techniques,
and procedures used by the attackers,
allowing them to strengthen real network defenses
based on what they learned from the honeynet.
So remember, internal intelligence sources
refer to the data and insights
gathered from within an organization's network
to identify potential threats.
These sources include adversary emulation engagements,
honeypots, and honeynets.
Adversary emulation engagements
simulate real-world attacker behavior
to test how well an organization's defenses
hold up against potential vulnerabilities.
Next, honeypots are decoy systems
designed to attract attackers,
allowing security teams to study their tactics
without exposing critical assets to risk.
Finally, honeynets are networks of honeypots
that provide a more comprehensive view
of attack methods
by simulating an entire network environment
for attackers to target.