What is called HONEYPOT systems?.. You might have got doubt about his, Hope that I could clear your doubts here.
Honey Pot Systems are decoy servers or systems setup to gather information regarding an attacker or intruder into your system... It is important to remember that Honey Pots do not replace other traditional Internet security systems; they are an additional level or system. .. Honey Pots can be setup inside, outside or in the DMZ of a firewall design or even in all of the locations although they are most often deployed inside of a firewall for control purposes... In a sense, they are variants of standard Intruder Detection Systems (IDS) but with more of a focus on information gathering and deception. ..
A Honey Pot system is setup to be easier prey for intruders than true production systems but with minor system modifications so that their activity can be logged of traced. The general thought is that once an intruder breaks into a system, they will come back for subsequent visits. During these subsequent visits, additional information can be gathered and additional attempts at file, security and system access on the Honey can be monitored and saved. Generally, there are two popular reasons or goals behind setting up a Honey Pot:
I) Learn how intruders probe and attempt to gain access to your systems. The general idea is that since a record of the intruder's activities is kept, you can gain insight into attack methodologies to better protect your real production systems.
II) Gather forensic information required to aid in the apprehension or prosecution of intruders... This is the sort of information often needed to provide law enforcement officials with the details needed to prosecute. ...
The common line of thought in setting up Honey Pot systems is that it is acceptable to use lies or deception when dealing with intruders. What this means to you when setting up a Honey Pot is that certain goals have to be considered.
Those goals are:
I) The Honey Pot system should appear as generic as possible. If you are deploying a Microsoft NT based system, it should appear to the potential intruder that the system has not been modified or they may disconnect before much information is collected.
II) You need to be careful in what traffic you allow the intruder to send back out to the Internet for you don't want to become a launch point for attacks against other entities on the Internet. (One of the reasons for installing a Honey Pot inside of the firewall!)
III) You will want to make your Honey Pot an interesting site by placing "Dummy" information or make it appear as though the intruder has found an "Intranet" server, etc. Expect to spend some time making your Honey Pot appear legitimate so that intruders will spend enough time investigating and perusing the system so that you are able to gather as much forensic information as possible...
Manu
