3 Implementation of Honeypot, NIDs, and HIDs Technologies in SOC Environment

The cybersecurity industry is often disinclined to adopt new technologies due to perceived complications, assumed dependencies, and unclear information about the benefits. Putting the right information security architecture into practice within an organization can be an intimidating challenge. Many organizations have enforced a security information and event management (SIEM) system to comply with the logging requirements of various security standards, only to find that it does not meet their information security expectations. They do not get the benefit of the value they spend on the proprietary SIEM tools. The solution should be simple, affordable, and maintainable with readily available resources and open-source products. The aim of this study is to understand honeypot technologies, networkbased intrusion detection systems (NIDS) and host-based intrusion detection systems (HIDS), and their implementation in a scalable security operation center (SOC) environment with the help of open-source tools which would include monitoring and investigation. Based on our learning, we have designed a virtualized SOC environment protected with firewall solution like pfSense, threat hunting solution like Security Onion which can be used for monitoring network traffic both internally and externally, further integrated with honeypot technology, i.e., T-Pot for better security enhancements. Threat intelligence information from this study is used to prepare, prevent, and identify cyber threats looking to take advantage of valuable resources. Lastly, conclusions and recommendations from our study will provide the best practices for implementing effective defense tools for various micro, small and medium enterprises (MSME) with affordable budgets.