When You Open The Honeypot, Who Really Gets Stung?
Saw this over at SNN
You're proactive and paranoid, two vital security traits, and now you want to take your network security to the next level. So, you consider building a Honeypot to snare any potential security breaches before the attacker can reach your vital infrastructure. Honeypots are not a new wave in the security community; the concept and their existence have been around for quite some time. In a nutshell, a Honeypot is designed to look and feel like your actual network systems, but is actually a trap for anyone who tries to penetrate your systems. It may seem to be running some easily exploited service that will set off silent alarms and log intruder data for potential prosecution. The bottom line: they are used to draw attackers away from their true goal of compromising your actual systems or data.
So, how do you decide to actually build your Honeypot? Here are some simple steps to follow when you are considering building this ingenious trap.
1. Review and revise your current security policies, systems, network infrastructure, network design, host hardening, application hardening, firewall and router rule sets, IDS implementation, etc.
2. Repeat Step 1
3. If you got here, first of all, I'm impressed. Now, maintain the hard work from steps 1 and 2.
4. Now, design and roll out your Honeypot while continuing step 3.
So, what's the point? There are so many aspects of security to worry about and deploy resources for already. Especially in the current economy when budgets are tightening and resources are scarce, it is difficult to justify spending to set up and maintain systems that are not directly employed for your business. Don't worry; I'm not letting you go without an earful of my paranoia! Say you build your Honeypot and an enlightened attacker usurps your defenses and turns it against you to mount internal attacks. Solve this by building an entire segmented HoneyNet, but then justify the time and resources to put that together. In my humble opinion, the concept of the Honeypot is a good one. It can be an excellent opportunity to learn how to think like a hacker and improve the security of your infrastructure. It can divert less experienced attackers and even the seasoned hacker if properly configured and deployed. The decision, unfortunately, will come down to time and money: Can you deploy and maintain comprehensive security measures and still spare resources for a Honeypot/Net?
