designing implementing honeypot scada network 35252

7/24/2019 Designing Implementing Honeypot Scada Network 35252

1/39

Interested in learningmore about security?

SANS Institute

InfoSec Reading RoomThis paper is from the SANS Institute Reading Room site. Reposting is not permitted without express written permission.

Designing and Implementing a Honeypot for a SCADANetworkSupervisory Control and Data Acquisition (SCADA) networks are increasingly under attack. In a world ofwireless networks, removable media, and a desire to move to the Internet of Things, it is unrealistic tothink that these networks can be isolated from every threat. Devices on SCADA networks are often not designed

with security in mind, vendors are slow to create patches, and the systems usually are critical enough thatscheduling downtime is a problem. A layered approach to securing SCADA networks that includes bo...

Copyright SANS Institute

Author Retains Full Rights

AD
http://www.sans.org/info/36923http://www.sans.org/info/36923http://www.sans.org/info/36914http://www.sans.org/info/36914http://www.sans.org/reading-room/click/597http://www.sans.org/info/36914http://www.sans.org/info/36909http://www.sans.org/info/36923


2/39

"#$% &'() #%*+,

Designing and Implementing a Honeypot for aSCADA Network

GIAC (GCIA) Gold Certification

-'./012 3/4156) 780..9 8:80..;'.))1C ./1)4.$ D)>68): 0( 73-D- ().H01I: 41) 0L.)( (0. =):6J()= H6./ :)8'16.C

6( M6(=9 >)(=01: 41) :50H .0 81)4.) A4.8/):9 4(= ./) :C:.)M: ':'455C 41) 816.6845)(0'J/ ./4. :8/)='56(J =0H(.6M) 6: 4 A10@5)M$ - 54C)1)= 4AA1048/ .0 :)8'16(J

73-D- ().H01I: ./4. 6(85'=): @0./ A4.8/6(J 4(= M0(6.016(J 6: )::)(.645 .0 ./)

:4L).C 0L ./0:) :C:.)M:$ O/6: A4A)1 =6:8'::): 4 M)./0= 0L =6:80>)16(J 4..48I: 0( 4

73-D- ().H01I @C ':6(J 4 /0()CA0.$ -( 4(45C:6: 0L 4 L48656.6):Q@4:)= 73-D-().H01I H4: A)1L01M)=9 4 /0()CA0. =):6J()= 4(= @'65. .0 M6M68 ./) 80MM0(:)1>68): 0L ./6: ().H01I9 4(= M0(6.016(J H4: A'. 6( A548) .0 =).)8. H/)( ./)

/0()CA0. H4: .41J).)=$ O/6: 1):'5.)= 6( M01) 80MA1)/)(:6>) M0(6.016(J 0L ./)

73-D- ().H01I L01 4..48I: 4(= 4==)= 4(0./)1 54C)1 0L :)8'16.C .0 ./) )


3/39

Designing and Implementing a Honeypot for a SCADA Network 2

3/4156) 780..9 8:80..;'.)


4/39


3/4156) 780..9 8:80..;'.)


5/39


3/4156) 780..9 8:80..;'.)


6/39


3/4156) 780..9 8:80..;'.)


7/39


3/4156) 780..9 8:80..;'.)


8/39


3/4156) 780..9 8:80..;'.)


9/39


3/4156) 780..9 8:80..;'.)


10/39


3/4156) 780..9 8:80..;'.)


11/39


3/4156) 780..9 8:80..;'.)


12/39


3/4156) 780..9 8:80..;'.)


13/39


3/4156) 780..9 8:80..;'.)


14/39


3/4156) 780..9 8:80..;'.)


15/39


3/4156) 780..9 8:80..;'.)


16/39


3/4156) 780..9 8:80..;'.)


17/39


3/4156) 780..9 8:80..;'.)


18/39


3/4156) 780..9 8:80..;'.)


19/39


3/4156) 780..9 8:80..;'.)


20/39


3/4156) 780..9 8:80..;'.)


21/39


3/4156) 780..9 8:80..;'.)


22/39


3/4156) 780..9 8:80..;'.)


23/39


3/4156) 780..9 8:80..;'.)


24/39


3/4156) 780..9 8:80..;'.)


25/39


3/4156) 780..9 8:80..;'.)


26/39


3/4156) 780..9 8:80..;'.)


27/39


3/4156) 780..9 8:80..;'.)


28/39


3/4156) 780..9 8:80..;'.)


29/39


3/4156) 780..9 8:80..;'.))= U418/ V9 #%*+9 L10M O0L6(0 7)8'16.C2

/..A:2WWHHH$.0L6(0:)8'[email protected]:84=4Q:)8'16.CQA4.8/QC0'1Q80(.105Q:C:.)MQ6:(XS#XV%XYY.QJ)..6(J

D6J6.45 R0(=9 K(8$ F#%*+9 U418/ *G$ BA1C1 F'"+;"+%$ ?).16)>)= U418/ *9 #%*+9 L10M

D6J6.45 R0(=2 /..A:2WWHHH$=6J6.45@0(=$80MW.005:W:84=4Q/0()C().W

Z01()19 S$9 [ U)6)= U4C #+9 #%*+9L10M a6./'@2 /..A:2WWJ6./'@$80MWJ54:.0ALW80(A0.W6::'):W*#b

]6JJ6(:9 c$ &$ F#%*+9 &4('41C *bG$ BA1C1 Q+.+#(2&+( C('4. R+('SC#;= :ABSAIQ0 :..$+.

1,?).'(;9?).16)>)= Z)@1'41C *9 #%*+9 L10M D41I ?)4=6(J2

/..A2WWHHH$=41I1)4=6(J$80MW4AA5684.60(:W:84=4Q1):)418/)1Q=10A:Qd)10Q=4CQ68:Q

8)1.W#+%*eb+#%

]6JJ6(:9 c$ &$ F#%*\9 &4('41C *bG$ 0&+ BA1C1 >#%2& >('8)= &4('41C *#9

#%*+9 L10M D41I ?)4=6(J2 /..A2WWHHH$=41I1)4=6(J$80MW>'5()[email protected]./)Q:84=4Q

A4.8/QA10@5)MW#+%*+e\bb

]1':I49 &$ F#%%Y9 U418/ #bG$ T:GBS)= U4C #V9 #%*+9 L10M -1: O)8/(6842

/..A2WW41:.)8/(684$80MWJ4=J).:W#%%YW%\W1):)418/)1:Q=)M0(:.14.)Q@60:Q5)>)5Q

100.I6.Q4..48IW

c(4AA9 S$ D$ F#%**G$ :",$.%()#< U+%5'(6 B+2$()%;9_45./4M9 U-9 ^7-2 7C(J1)::$

f'455)(9 U$ S$ F#%*\9 Z)@1'41C *G$ B1UB BA1C1 #", >('2+.. A'"%('< B+2$()%; B$(?+;9

?).16)>)= &4('41C *#9 #%*+9 L10M 7-g7 K(:.6.'.)2 /..A:2WWHHH$:4(:$01JW1)4=6(JQ

100MW4(45C:.:QA10J14MW:4(:Q:'1>)CQ:84=4Q#%*\

`0./4M).:C9 h$9 [ Z14(d9 U$ F#%%b9 &'5C *bG$ BA1C1 F'"+;U+% >('V+2%H T$)


30/39


3/4156) 780..9 8:80..;'.)0:9 g$ F#%%V9 &'5C *bG$ C+?+)= U4C #V9 #%*+9 L10M 1:C:50J2

/..A2WWHHH$1:C:50J$80MW

78/(6)=)1 S5)8.168$ F#%*%9 &4('41C *G$ E#)" +"+(7; #", )".)7&% 5)%& >'5+( N'7)29

?).16)>)= U4C *+9 #%*+9 L10M 78/()6=)1 S5)8.168 301A014.)2/..A2WW=0H(504=$:8/()6=)1Q

)5)8.168$80MWL65):jAkZ65)kK=l#B+BYVBe[AkZ65)kg4M)l`f7SD*%e%*+Sg$A=L

7A5'(I9 K(8$ F#%*+9 U4C #YG$ Z% ). B4)= U4C #Y9 #%*+9

L10M 7A5'(I2 /..A2WWHHH$:A5'(I$80MW>6)HW:A5'(IW7`Q3---abB

7.0'LL)19 c$9 Z45809 &$9 [ 7841L0()9 c$ F#%**9 &'() *G$ U:B0 B4+2)#< >$8WA'@5684.60(:W(6:.A'@:WV%%QV#W7`V%%QV#QL6(45$A=L

O)(4@5) g).H01I 7)8'16.C$ F#%*+9 %+ *\G$ >


31/39


3/4156) 780..9 8:80..;'.))= &4('41C *#9 #%*+9 L10M _61)=2

/..A2WWHHH$H61)=$80MW./1)4.5)>)5W#%**W%BW/0HQ=6J6.45Q=).)8.6>):Q=)86A/)1)=Q:.')= U418/ V9 #%*+9 L10M D]- 7'LL4 ^(6>)1:6.C2

/..A2WWHHH$=:'$)='$AIW6(=)


32/39


3/4156) 780..9 8:80..;'.))= L10M ./) =4.4@': @C I)C QQq

oI)Ck>45')kM4AA6(J:q

oI)C (4M)lpZ48656.Cg4M)pq

o>45') .CA)lp>45')pqpZ-3poW>45')q

oWI)CqoI)C (4M)lp7C:.)Mg4M)pq

o>45') .CA)lp>45')pqpZ-3 )U).)1poW>45')qoWI)Cq

oI)C (4M)lp7C:.)MD):816A.60(pq

o>45') .CA)lp>45')pqpKTg e#%% S**BepoW>45')qoWI)Cq

oI)C (4M)lp^A.6M)pqo>45') .CA)lpL'(8.60(pq80(A0.$)M'54.01:$M6:8$'A.6M)$^A.6M)oW>45')q

oWI)Cq

oI)C (4M)lp:C:T@i)8.KDpq

o>45') .CA)lp>45')pqp*$\$e$*$+$+\+e$**$*$#$*$*$*bpoW>45')qoWI)Cq

oI)C (4M)lp:C:30(.48.pq

o>45') .CA)lp>45')pqp3/4156) 780..poW>45')q

oWI)Cq

oI)C (4M)lp:C:g4M)pq

o>45') .CA)lp>45')pqpZ-3 )U).)1poW>45')q

oWI)CqoI)C (4M)lp:C:f084.60(pq

o>45') .CA)lp>45')pqpZ-3poW>45')qoWI)Cq

oI)C (4M)lp:C:7)1>68):pq

o>45') .CA)lp>45')pqp*#poW>45')qoWI)Cq

oI)C (4M)lpM)M01CU0=@':754>)*R508I-pq

o>45') .CA)lp>45')pq"14(=0M$14(=6(.F%9*G L01 @ 6(

14(J)F%9*#VG,oW>45')q

oWI)Cq


33/39


3/4156) 780..9 8:80..;'.))*R508IRpq

o>45') .CA)lp>45')pq"14(=0M$14(=6(.F%9*G L01 @ 6( 14(J)F%9\#G,oW>45')qoWI)Cq

oI)C (4M)lpM)M01CU0=@':754>)*R508I3pq

o>45') .CA)lp>45')pq"14(=0M$14(=6(.F%9*G L01 @ 6( 14(J)F%9VG,oW>45')q

oWI)CqoI)C (4M)lpM)M01CU0=@':754>)*R508IDpq

o>45') .CA)lp>45')pq"% L01 @ 6( 14(J)F%9\#G,oW>45')q

oWI)Cq

oI)C (4M)lp30AC16J/.pq

o>45') .CA)lp>45')pqppoW>45')q

oWI)Cq

oI)C (4M)lp:Bk6=pq


oWI)Cq

oI)C (4M)lp:BkM0='5)k.CA)pq


oWI)CqoI)C (4M)lp)MA.Cpq


oWI)CqoWI)Ck>45')kM4AA6(J:q

oW=4.4@':qoW801)q

oA10.0805:q

o:(MA )(4@5)=lpO1')p /0:.lp%$%$%$%p A01.lp*e*pq

o80(L6Jq

orQQ 30(L6J'1) 6(=6>6='45 =)54C: L01 7gU` 80MM4(=: QQq

o)(.6.C (4M)lp.41A6.p 80MM4(=lpJ).pq%$*s%$#oW)(.6.Cq

o)(.6.C (4M)lp.41A6.p 80MM4(=lp:).pq%$*s%$#oW)(.6.Cq

o)(.6.C (4M)lp.41A6.p 80MM4(=lp()4:60( ./1):/05=:F1)EkA)1k6AWM6('.)s1)Ek0>)1455WM6('.)G QQq

o)(.6.C (4M)lp)>4:60(p 80MM4(=lpJ).pq*#%s#+%oW)(.6.Cq

o)(.6.C (4M)lp)>4:60(p 80MM4(=lp:).pq*#%s#+%oW)(.6.Cq

o)(.6.C (4M)lp)>4:60(p 80MM4(=lp()4:60(p 80MM4(=lp@'5Ipq*#%s#+%oW)(.6.CqoW80(L6Jq

oM6@:qoM6@ (4M)lp7gU`>#QUKRpq

o:CM@05 (4M)lp:C:D):81pq

orQQ h45') 6: I)C 6( =4.4@': QQq

o>45')q7C:.)MD):816A.60(oW>45')q


34/39


3/4156) 780..9 8:80..;'.)45')q

oW:CM@05q

o:CM@05 (4M)lp:C:30(.48.pq

o>45')q:C:30(.48.oW>45')qoW:CM@05qo:CM@05 (4M)lp:C:g4M)pq

o>45')q:C:g4M)oW>45')q

oW:CM@05q

o:CM@05 (4M)lp:C:f084.60(pq

o>45')q:C:f084.60(oW>45')q

oW:CM@05q

o:CM@05 (4M)lp:C:7)1>68):pq

o>45')q:C:7)1>68):oW>45')q

oW:CM@05q

oWM6@q

oWM6@:qoW:(MAq

oM0=@': )(4@5)=lpO1')p /0:.lp%$%$%$%p A01.lpb%#pq

o=)>68)k6(L0qoh)(=01g4M)q78/()6=)1 S5)8.168oWh)(=01g4M)q

o`10='8.30=)q`0H)1f0J68oW`10='8.30=)qoU4i01U6(01?)>6:60(qKTge#%%oWU4i01U6(01?)>6:60(q

oW=)>68)k6(L0q

o:54>):q

o:54>) 6=lp*pq

o@508I:q

o@508I (4M)lpM)M01CU0=@':754>)*R508I-pq

orQQ 3TKf7WDK73?SOSkTÔ`Ô7 4I4$ @6(41C 0'.A'.9 A0H)1 0(WA0H)1

0LL

])1) H) M4A M0=@': 4==1)::): * .0 *#B .0 7BQ#%% `f3 -==1)::):

t%$% .0 t*b$B QQq

o.CA)q3TKf7oW.CA)qo:.41.6(Jk4==1)::q*oW:.41.6(Jk4==1)::q

o:6d)q*#VoW:6d)q

o80(.)(.qM)M01CU0=@':754>)*R508I-oW80(.)(.q

oW@508Iqo@508I (4M)lpM)M01CU0=@':754>)*R508IRpqorQQ 3TgO-3O7WDK73?SOSkKg`Ô7 4I4$ @6(41C 6(A'.$

U4A M0=@': 4==1)::): *%%%*Q*%%\# .0 7BQ#%% `f3 6(A'.::.41.6(J L10M K%$% QQq

o.CA)qDK73?SOSkKg`Ô7oW.CA)q

o:.41.6(Jk4==1)::q*%%%*oW:.41.6(Jk4==1)::q

o:6d)q\#oW:6d)q


35/39


3/4156) 780..9 8:80..;'.))*R508IRoW80(.)(.q

oW@508IqoW@508I:q

oW:54>)q

o:54>) 6=lp#pq

orQQ O/6: :54>) =0): :0M) M)4:'16(J$ F4(450J 6(A'.:G$U4A M0=@': 4==1)::): \%%%*Q\%%%Y .0 7B `f3 4(450J 6(A'. @6.:

-K_%Q-K_V QQq

o@508I:q

o@508I (4M)lpM)M01CU0=@':754>)*R508I3pq

orQQ _655 @) A41:)= H6./ )>45FG QQq

o.CA)q-g-fTakKg`^O7oW.CA)q

o:.41.6(Jk4==1)::q\%%%*oW:.41.6(Jk4==1)::q

o:6d)qVoW:6d)q

o80(.)(.qM)M01CU0=@':754>)*R508I3oW80(.)(.q

oW@508Iq

o@508I (4M)lpM)M01CU0=@':754>)*R508IDpq

orQQ U4A: .0 7BQ#%% `f3 4==1)::): ]05=7.41.uV QQqo.CA)q]TfDKgak?SaK7OS?7oW.CA)q

o:.41.6(Jk4==1)::q+%%%*oW:.41.6(Jk4==1)::q

o:6d)qVoW:6d)qo80(.)(.qM)M01CU0=@':754>)*R508IDoW80(.)(.q

oW@508IqoW@508I:q

oW:54>)q

oW:54>):q

oWM0=@':q

o:B80MM )(4@5)=lpZ45:)p /0:.lp%$%$%%p A01.lp*%#pq

o:C:.)Mk:.4.':k56:.:q

o::5 6=lp_v*ev


36/39


3/4156) 780..9 8:80..;'.)) QQq

o)(.6.C (4M)lpD4.)pq74.9 #V -A1 *YV+ %B2\%2%% aUOoW)(.6.Cq

oW/)4=)1:q

oWJ50@45q

orQQ /0H :/0'5= ./) =6LL)1)(. ^?K 1)E'):.: @) /4(=5)= QQqo/.=08:q

o(0=) (4M)lpWpq

orQQ L018) 1):A0(:) :.4.': 80=) .0 \%# QQq

o:.4.':q\%#oW:.4.':qo/)4=)1:qorQQ ./):) /)4=)1: H655 @) :)(. 450(J H6./ ./6: 1):A0(:) QQq

o)(.6.C (4M)lp30(.)(.QOCA)pq.)


37/39


3/4156) 780..9 8:80..;'.))= L01

A10='8.60( QQq

o(0=) (4M)lpW.):.:W'(6..):.k@4:)$/.M5pqo/)4=)1:q

o)(.6.C (4M)lpf4:.QU0=6L6)=pqO')9 *Y U4C *YY\ %Y2%%2%%

aUOoW)(.6.Cqo)(.6.C (4M)lp30(.)(.QOCA)pq.)


38/39


3/4156) 780..9 8:80..;'.)) QQq

o.41A6.q%oW.41A6.q

o)(.6.C (4M)lp30(.)(.QOCA)pq.)) QQq

o.41A6.q%oW.41A6.qo)(.6.C (4M)lp30(.)(.QOCA)pq.)) QQqo.41A6.q%oW.41A6.q

o)(.6.C (4M)lp30(.)(.QOCA)pq.)


39/39

Last Updated: February 23rd, 2016

Upcoming SANS TrainingClick Here for a full list of all Upcoming SANS Events by Location

SANS Philadelphia 2016 Philadelphia, PAUS Feb 29, 2016 - Mar 05, 2016 Live Event

SANS London Spring 2016 London, GB Feb 29, 2016 - Mar 05, 2016 Live Event

HIMSS Las Vegas, NVUS Mar 03, 2016 - Mar 03, 2016 Live Event

SANS Abu Dhabi 2016 Abu Dhabi, AE Mar 05, 2016 - Mar 10, 2016 Live Event

SANS 2016 Orlando, FLUS Mar 12, 2016 - Mar 21, 2016 Live Event

ICS410 Dubai 2016 Dubai, AE Mar 13, 2016 - Mar 17, 2016 Live Event

NetWars @ NSM Conference '16 Oslo, NO Mar 16, 2016 - Mar 17, 2016 Live Event

SANS Secure Singapore 2016 Singapore, SG Mar 28, 2016 - Apr 09, 2016 Live Event

SANS Northern Virginia - Reston 2016 Reston, VAUS Apr 04, 2016 - Apr 09, 2016 Live Event

SANS Secure Europe 2016 Amsterdam, NL Apr 04, 2016 - Apr 16, 2016 Live Event

SANS Atlanta 2016 Atlanta, GAUS Apr 04, 2016 - Apr 09, 2016 Live Event

Threat Hunting and Incident Response Summit New Orleans, LAUS Apr 12, 2016 - Apr 19, 2016 Live Event

ICS Amsterdam 2016 Amsterdam, NL Apr 18, 2016 - Apr 23, 2016 Live Event

SANS Pen Test Austin Austin, TXUS Apr 18, 2016 - Apr 23, 2016 Live Event

SANS Secure Canberra 2016 Canberra, AU Apr 18, 2016 - Apr 23, 2016 Live Event

SANS Copenhagen 2016 Copenhagen, DK Apr 25, 2016 - Apr 30, 2016 Live Event

SANS Security West 2016 San Diego, CAUS Apr 29, 2016 - May 06, 2016 Live Event

SANS SEC542 Budapest Budapest, HU May 02, 2016 - May 07, 2016 Live Event

SANS Houston 2016 Houston, TXUS May 09, 2016 - May 14, 2016 Live Event

SANS Baltimore Spring 2016 Baltimore, MDUS May 09, 2016 - May 14, 2016 Live Event

SANS Stockholm 2016 Stockholm, SE May 09, 2016 - May 14, 2016 Live Event

SANS Prague 2016 Prague, CZ May 09, 2016 - May 14, 2016 Live Event

SANS Melbourne 2016 Melbourne, AU May 16, 2016 - May 21, 2016 Live Event

Security Operations Center Summit & Training Crystal City, VAUS May 19, 2016 - May 26, 2016 Live Event

RSA Conference 2016 OnlineCAUS Feb 28, 2016 - Feb 29, 2016 Live Event

SANS OnDemand Books & MP3s OnlyUS Anytime Self Paced
http://www.sans.org/info/36919http://www.sans.org/info/36919http://www.sans.org/link.php?id=40922http://www.sans.org/philadelphia-2016http://www.sans.org/link.php?id=40947http://www.sans.org/london-in-the-spring-2016http://www.sans.org/link.php?id=44415http://www.sans.org/himss-2016http://www.sans.org/link.php?id=41225http://www.sans.org/abu-dhabi-2016http://www.sans.org/link.php?id=27559http://www.sans.org/sans-2016http://www.sans.org/link.php?id=44047http://www.sans.org/ics410-dubai-2016http://www.sans.org/link.php?id=44430http://www.sans.org/netwars-at-nsm-annual-security-conference-2016http://www.sans.org/link.php?id=40932http://www.sans.org/secure-singapore-2016http://www.sans.org/link.php?id=41542http://www.sans.org/reston-2016http://www.sans.org/link.php?id=40985http://www.sans.org/secure-europe-2016http://www.sans.org/link.php?id=41557http://www.sans.org/atlanta-2016http://www.sans.org/link.php?id=41307http://www.sans.org/threat-hunting-and-incident-response-summit-2016http://www.sans.org/link.php?id=41230http://www.sans.org/ics-amsterdam-2016http://www.sans.org/link.php?id=41562http://www.sans.org/pentest2016http://www.sans.org/link.php?id=41592http://www.sans.org/secure-canberra-2016http://www.sans.org/link.php?id=41220http://www.sans.org/copenhagen-2016http://www.sans.org/link.php?id=41547http://www.sans.org/sans-security-west-2016http://www.sans.org/link.php?id=44435http://www.sans.org/sec542-budapest-2016http://www.sans.org/link.php?id=41572http://www.sans.org/houston-2016http://www.sans.org/link.php?id=41567http://www.sans.org/baltimore-spring-2016http://www.sans.org/link.php?id=41240http://www.sans.org/stockholm-2016http://www.sans.org/link.php?id=41235http://www.sans.org/prague-2016http://www.sans.org/link.php?id=41602http://www.sans.org/melbourne-2016http://www.sans.org/link.php?id=43422http://www.sans.org/security-operations-center-summit-2016http://www.sans.org/link.php?id=43567http://www.sans.org/rsa-conference-2016http://www.sans.org/link.php?id=1032http://www.sans.org/ondemand/about.phphttp://www.sans.org/ondemand/about.phphttp://www.sans.org/link.php?id=1032http://www.sans.org/rsa-conference-2016http://www.sans.org/link.php?id=43567http://www.sans.org/security-operations-center-summit-2016http://www.sans.org/link.php?id=43422http://www.sans.org/melbourne-2016http://www.sans.org/link.php?id=41602http://www.sans.org/prague-2016http://www.sans.org/link.php?id=41235http://www.sans.org/stockholm-2016http://www.sans.org/link.php?id=41240http://www.sans.org/baltimore-spring-2016http://www.sans.org/link.php?id=41567http://www.sans.org/houston-2016http://www.sans.org/link.php?id=41572http://www.sans.org/sec542-budapest-2016http://www.sans.org/link.php?id=44435http://www.sans.org/sans-security-west-2016http://www.sans.org/link.php?id=41547http://www.sans.org/copenhagen-2016http://www.sans.org/link.php?id=41220http://www.sans.org/secure-canberra-2016http://www.sans.org/link.php?id=41592http://www.sans.org/pentest2016http://www.sans.org/link.php?id=41562http://www.sans.org/ics-amsterdam-2016http://www.sans.org/link.php?id=41230http://www.sans.org/threat-hunting-and-incident-response-summit-2016http://www.sans.org/link.php?id=41307http://www.sans.org/atlanta-2016http://www.sans.org/link.php?id=41557http://www.sans.org/secure-europe-2016http://www.sans.org/link.php?id=40985http://www.sans.org/reston-2016http://www.sans.org/link.php?id=41542http://www.sans.org/secure-singapore-2016http://www.sans.org/link.php?id=40932http://www.sans.org/netwars-at-nsm-annual-security-conference-2016http://www.sans.org/link.php?id=44430http://www.sans.org/ics410-dubai-2016http://www.sans.org/link.php?id=44047http://www.sans.org/sans-2016http://www.sans.org/link.php?id=27559http://www.sans.org/abu-dhabi-2016http://www.sans.org/link.php?id=41225http://www.sans.org/himss-2016http://www.sans.org/link.php?id=44415http://www.sans.org/london-in-the-spring-2016http://www.sans.org/link.php?id=40947http://www.sans.org/philadelphia-2016http://www.sans.org/link.php?id=40922http://www.sans.org/info/36919

designing implementing honeypot scada network 35252

Documents