Re: Honeynet Requirements

[Julian Grizzard <grizzard () ece gatech edu>]

If you are looking to use a honeynet to help secure you company, then 
we can suggest that you make your honeypots accessible from you 
production company machines.  Then you can extend the honeypot theology 
and say that any production machine that is scanning your honeynet is 
automatically suspicious and can be marked for investigation (i.e. the 
scanning machine was infected by worm/virus/attacker and is scanning 
your other production/honeypot machines).  You can pick up scanning 
activity even if your honeypots look nothing like your production 
machines.

-Julian

On May 15, 2004, at 7:14 PM, Chuck Fullerton wrote:

> I am in the planning stages of a Honeynet project for my company.  I 
> have a
> question that, so far, I haven't been able to find an answer.
>
> Using the diagram from the Honeynet Paper from www.honeynet.org, when 
> you
> add honeypots to your honeynet,  how closely must they mirror the 
> production
> machines?
>
> Any advice is appreciated.
>
> Chuck Fullerton
> OPST,CISSP,CSS1,CCNP,CCDA,CNA,A+