Newsletter Sign-Up

Receive the latest technology news and information.

To Trap A Thief

By Mathew Schwartz

April 2, 2001 12:00 PM ET

Computerworld - If you want to break into a house, why spend time prying open the front door if the back door is wide open? Same goes when breaking into computer networks. Most networks and servers are set up with configuration errors that are well known to hackers, who can download free tools that will scan many different networks looking for those easy-open entry points. No genius-level code manipulation or high IQ is needed.

Honeypots

Core Elements

Looks and behaves as if real

Doesn't disclose its existence at any point

Is partially disabled so hackers can't still take it over

Has a dedicated firewall that prevents all outbound traffic, in case honeypot is compromised

Lives in a network DMZ, untouched by normal traffic

Sounds silent alarms when any traffic goes to or from it

Begins logging all intruder activity when it first senses intrusion

Your network administrators haven't had time to install the latest Microsoft Windows NT security patch yet? Great. A consultant left obvious root access passwords on the firewall he built for you? Even better.

Things get interesting, however, when a security administrator purposely leaves a back door open but hides a tripwire behind it. Now the security person knows when an intruder trips the wire and, with luck, the perpetrator can be caught or scared away before causing any damage.

That's the theory behind "honeypots," which are servers and network equipment designed to attract hackers into secure lockboxes rather than let them hack at the network proper. When criminals move in to exploit security flaws in a honeypot, silent alarms go off and network managers can block the intrusion, begin amassing evidence for use in court or even launch a counterattack.

There are two types of honeypots. Hardware-based honeypots are servers, switches or routers that have been partially disabled and made attractive with commonly known misconfigurations. They sit on the internal network, serving no purpose but to look real to outsiders. The operating system of each box, however, has been subtly disabled with tweaks that prevent hackers from really taking it over or using it to launch new attacks on other servers. A honeypot is easy enough to build, but if an experienced cracker succeeds in compromising it, he could use it to launch other attacks.A safer option might be to create an entire network of honeypots, such as the HoneyNet Project. Lance Spitzner, a security consultant at Sun Microsystems Inc. in Chicago, runs the project with 30 other security professionals.

Recommend Digg Twitter ShareThis

Email Print Send Feedback Reprints

Jump to comments

LAN/WAN

Additional Resources

Xerox

Win a color printer!

By using solid ink technology only from Xerox, you could save up to 65% by printing color for the cost of black and white. Enter for a chance to WIN a PhaserTM 8860 network color printer!

Microsoft

Upgrade to Internet Explorer 8 today.

Save time and mitigate security risk. Deploy it now.

Sybase

NEXT-GENERATION MOBILITY PLATFORMS

In this white paper, IDC analyzes the role of next-generation mobile enterprise platforms as organizations seek a more strategic deployment of mobile solutions.

Learn the important issues you must consider before starting your next mobility initiative. Get your mobility white paper from IDC now, compliments of Sybase.

White Papers & Webcasts

Informatica 9 Launch: Transform your Business. Transform your world.

LIVE Nov 10, 2009 12:00 PM ET

Architecting Business Intelligence Applications for Change: The Open Solution

LIVE Nov 12, 2009 02:00 PM ET

How to Secure and Accelerate Your Oracle Applications
Learn about the escalating application performance and security challenges facing corporations, today!

Mitigate Risk, Lower Costs and Improve Network Efficiency
Create a stable IP network that not only meets today's challenges, but is flexible enough to also meet future demands.

Practical Strategies to Accelerate Business Applications Across the WAN
Discover how Blue Coat SG appliances, uses five essential techniques to speed delivery of internal and externally hosted business applications

Top to Bottom Performance Management Excellence at the City of Chicago
View now.

Acceleration 101
Learn how an Application Delivery Network can accelerate your applications and help make sure they are secure, fast, and available.

Effectively Implementing Datacenter Automation
Effectively select and deploy the best datacenter automation solution today!

Optimize VMware View VDI Deployments with F5
F5 BIG-IP Local Traffi c Manager optimizes VMware View deployments between offi ces to create a user experience on par with local desktops.

Aligning IT to Business: The Rising Importance of Application Delivery Networks
Application Delivery Networking (ADN) will play a vital role in helping enterprises incorporate strategic technologies to achieve business initiatives.

Connecting to the Cloud with F5 and VMware VMotion
F5 and VMware partner to enable live application and storage migrations between datacenters and clouds, over short or long distances.

Strategies for Driving Down IT Support Costs with Lite ITIL Practices
View this now!

All White Papers | All Webcasts