Active defence using an operational technology honeypot

This paper presents research to examine the benefits of deploying a high interaction hardware Operational Technology (OT) or Industrial Control System (ICS) honeypot, as opposed to a virtualised system. The Honeypot Project successfully developed and demonstrated an innovative approach to implementing a situational awareness capability in an operational industrial control system environment. The approach also contributes to an organisation's potential forensics capability for ICS systems. Furthermore, this has been achieved via a remote access platform without disrupting operations, whilst preserving vital evidence. The Honeypot project has demonstrated new techniques to enhance monitoring of ICS systems, indicated further benefits and illustrated where such approaches would be suitable.