Honeypots
for industrial
networks
HoneyShark places imitation industrial equipment on your control network and records everything that touches it. The equipment has no production role, so contact with it is worth investigating.
HoneyShark is an OT honeypot appliance developed by EEHA Automation.
Every decoy is reproduced from packet captures of real industrial equipment, so it responds the way genuine devices do. Built and supported by EEHA Automation's IT/OT and PCS team.
Most control networks cannot detect an intruder.
An attacker who reaches the plant network will look for controllers and operator stations, map what is there, then attach engineering software. That traffic looks normal and usually passes unnoticed.
No Visibility
Most control networks carry no security monitoring, so scanning goes unnoticed.
No Software Can Be Installed
Industrial equipment cannot run security software, and production traffic must not be disturbed.
Unclear Alerts
IT security tools report protocol errors, not what somebody tried to do to a controller.
What the decoys do
The main capabilities of a HoneyShark appliance.
Authentic Decoys
Each decoy is reproduced from packet captures of the real equipment collected from over a decade of control systems engineering.
Protocol Accuracy
Industrial protocols and device services answer as the genuine unit does with support for a variety of OT protocols.
Engineering Tool Detection
Detects device enumeration and engineering sessions from crafted scripts and commercial engineering software.
Event Detection
Honeyshark is not just a packet scanner. It scans for patterns in bursts of packets to report a single event to operators.
Source Attribution
Every event carries the source address, the hardware address and the vendor behind it.
OT Secure
A non-invasive standalone device on your network. Runs passively without connection to the internet.
All activity on one dashboard
One dashboard showing who touched the decoys, what they attempted and how serious it is.
Events, last 24 hours
Recent Activity
Why plants run HoneyShark
Network Oversight
Adds detection to a network that has no security tools of its own.
Decoy Spawning
One appliance runs several decoys, and more can be added as the network grows.
Early detection
Scanning and browsing happen long before anything is changed on real equipment.
No Change To Production
Decoys use their own addresses and do not interact with real equipment.
Robust Reporting
Each event names the source, the software used and what it attempted to do.
How an event is built
Every packet a decoy receives is recorded. Packets that belong to one action are grouped together, given a plain description and a severity, then shown on the dashboard.
From install to first alert
Place
Give the appliance one address on the control network you want to watch.
Configure
Choose which devices to imitate, their addresses and their identities, from the dashboard.
Deploy
Decoys appear on the network with vendor hardware addresses and answer like the real equipment.
Watch
Any contact is captured, classified and raised on the dashboard, with an email alert if you want one.