1. Security Overview: Honeypots
Stuart Hoxie

2. General Concept
Honeypot Servers are an intrusion detection system for medium, large and experimental networks.
As the name implies, honeypots are used to attract and trap malicious traffic.
Primary Values in being:
Probed
Attacked
Compromised

3. Honeypot Solutions
Generally there are three solutions for what a Honeypot server can do:
Deceive attackers
Detect attacks/attackers
Be compromised and learned from

4. Achieving The Three Goals
In order to achieve the three primary goals, the system should:
Look as real as possible.
Be constantly monitored and surveyed.
Appear as usable and meaningful as the real thing

5. How It Works
Attackers are drawn to large deposits of valuable informations and honeypots exploit this. By faking information and hiding their true purpose, a well placed server can contribute to overall network security.
These servers are exposed and are rather difficult to break, not impossible. This makes them more a legitimate target.
Monitoring and Tracking tools are loaded to trace all activity of the attackers in detail.
Using many Honeypots is considered a Honeynet.

6. How It Works
Example:

7. Why We Use Honeypots Divert attention from the real network
Building attacker profiles
Identify new vulnerabilities and risks associated with new software
Capture & study new viruses, worms, and other malware

8. Research Honeypots Criteria:
Not implemented for the purpose of protecting a network
Used to study attack patterns, behaviors, offensive tools, and other threats
Education/research driven

9. Production Honeypots Criteria:
Implemented for the purpose of protecting an organization or environment
Directly assist in securing a network
Detection, prevention, and response
For example Tarpits can be used to slow down automated attacks and worms.
For humans, psychological defenses are used. Confusing the attacker with complex or unordinary layouts/design, misleading or deceiving and deterring attacks.

10. Advantages Live and Gathering Resources Information Gathering
Designed to capture anything that interacts with them
Unknown can be researched
Resources
Basic machines can be implemented to handle large networks
Information Gathering
Collect detailed information on all interactions as a security incident tool
Real Environments
IPv6/v4 implementation
Simplicity
Basic to design, implement and install
Tactics never seen before and Zero day attacks can be researched and analysed

11. Disadvantages Vision Risk
Limited to implemented scope and interaction with them
Inability to support/analyse neighbors
Risk
Potential to hijacking and leveraging
Misconfiguration

12. Resources