Tom Van de Wiele

The most cost effective control to catch attackers are honeypots, here is how. Attacker behavior is predictable: - scan an internal network, go towards lucrative targets - cat ~/.ssh/id_rsa (and other spicy files) - try api keys you’ve found - look for credit cards in Google Drive You can setup fake infra or api keys or gdocs. Whenever anyone interacts with them, you get alerted with indicators of the source of the interaction. It also demoralizes the attackers once they realize it’s a honeypot. AI pentesting is automated large-scale pentests. Attackers will leverage this to attack at wider scales. One of the best controls that scales really well, is honeypots. In a good setup, it is indistinguishable from a real asset, so almost guaranteed to trigger.

An LA Times sidebar showing the codes teens used to chat via pagers.