To honeypot or not

Nutter offers up resources and advice to an IT pro considering implementing a honeypot

It’s been a challenge to keep all the patches/updates applied to our servers. We’ve been looking for something we can use as an additional layer of protection. I’ve been reading about using a  honeypot, but I’m not sure which way to go. What are our options?

– Via the Internet

This is a deep subject that will take more room than I have here, but I’ll give you some places to get started. The first thing I would do is check with your corporate attorney to see what the laws/regulations are in your state and or at the federal level before turning up a honeypot. If your attorney doesn’t specialize in subjects dealing with the Internet, find one who does and check with the person periodically to ensure you stay out of harm’s way in the legal area.

Having said that, there are several ways you can implement a honeypot. A basic Windows-based honeypot called Back Officer Friendly is available from www.nfr.com. They also have a Linux version available. A more robust honeypot by the name of Specter that can emulate different operating systems and more services than Back Officer Friendly is available from www.specter.com.

If you’re comfortable working with Linux, honeyd may be something you should look at. Available at www.honeyd.org, this is one of the more popular honeypot options available. This is just the start of implementing a honeypot. You also have to think about whether to put it inside and/or outside the firewall. There are several different Web sites, such as honeyd.org, that you can go to for information. I also suggest getting a copy of Lance Spitzner’s book, Honeypots: Tracking Hackers. This will take you through most of the more common honeypots in use, where to put them, how best to implement them, etc.

Don’t put all your faith in a honeypot that it will protect your servers. At best it will be a distraction that may give you a little time to know someone is trying to hack you and give you the time to record what they’re doing so you will have information to turn over to prosecuting authorities if the hackers are found.