I went to the Chisec meet-up last night and had a good time. There were about 35 people that met so it was a pretty good sized group. The Honeynet folks are kicking off a three or four day gathering so some of them attended Chisec.

I got to talk to one of them and bounce a few questions off him about honeypots. I just started building one yesterday. He had some interesting opinions on the legality issues I’ll face and the logistics of the actual honeypot. He suggested using Honeywall in front of a ‘real machine’ because honeyd is easily fingerprinted.

I also met someone I knew from a SANS course on forensics. I think she used to go by the name gothchic but my memory is shite these days. We met in Vegas last year and oddly enough both had ambitions of moving to Chicago and wouldn’t ya know it, we both made it.

I’m horrible with names, which is why I haven’t mentioned any. I do know I was the third “Michael” at our table…

Also at our table was an ISS employee who was understandably nervous about his future after IBM purchased them. He suspects IBM bought them for their software and not necessarily for their services and will soon start chopping heads. Only time will tell!

A couple of the guys at the table had a great discussion about NAC that I listened in on. The interesting point they made was that NAC as a whole is a scam. You don’t need a bunch of appliances when you can run 802.1x and dynamic VLANS. If a machine can’t authenticate to the domain, put it in a quarantine VLAN and be done with it.

Great stuff and I’m sure I’ll have more to blog about as I digest it all. The folks at my table were all coders so they are on a completely different level than I am.

For more information about this topic

• No Related Post