Scenario: You are responsible for security in a company and you need to protect
Place your order now for a similar assignment and have exceptional work written by our team of experts, At affordable rates
For This or a Similar Paper Click To Order Now
Scenario: You are responsible for security in a company and you need to protect the systems reviews. These are in a well-defined subnet and only specific systems can connect to it (jump points). Jump points allow two network maps. One is connected to the network (unprotected) and the second allows access to protected systems. You must introduce a honeypot into this network in order to detect lateral movements.
What you need to do:
Install a honeypot (OpenCanary). Refer to https://opencanary.readthedocs.io/en/latest/starti…. On another system located in the same network, use a port other than 22 for connections via the SSH protocol (one of your choice).
Via your Security Onion system, write a Snort rule that will generate an alert when it detects a connection to a honeypot coming from another network than that of jump points to the ports administration (ssh) or port knowcking. Implement the rule and ensure that it is hit.
Instructions
a. Create the honeypot (5p)
b. Configure port knocking for honeypot (5p)
c. Inside the snort.conf file activates a new variable that contains the IPs of the honeypots (ex HON_NET) (2.5p)
d. Inside the snort.conf file activates a new variable that contains the ports administration of honeypots (ex HON_PORTS) (5p)
e. Inside the snort.conf file activates a new variable which contains the list of IP addresses of jump points authorized to communicate with honeypots (ex JUMP_NET) (2.5p)
f. Create a single Snort rule that will detect:
– a. Communications (traffic) to a honeypot system (IP and Port via variables) (5p)
– b. Communications (traffic) originating from a system other than the jump points (via
variable) (5p)
– c. The alert generated by your SNORT rule, must contain your last name / first name (5p)
g. Generate traffic that will trigger/hit the rule (5p)
h. Document all the steps via explanations and screenshots (5p)
