Printable View
I am currently interning at a rather large company in there computer security department and the task they gave me is to set up a honeynet. We have a switch network, so my question is: Do I have to deploy a honeynet for each switch to monitor the whole network or will one work? Thanks for any help you can provide.
Asking this question actually indicates that you have no idea as to what a honeynet/honeypot really is..Quote:
Originally Posted by gloomis2
Have fun reading:
http://www.honeynet.org/
That's why he came to a security forum and titled it "a newbie question".
My question is would I be substantially more successful at detecting any kind of malware or intrusion by setting up honeynets on different parts of the network or will one one end of the switch be sufficient?
I believe your looking for more of a IDS/IPS system rather than a honeypot. Check out hanging a snort sensor off the main switch.
Cheers:
He was aked to set up a honey pot though!
Setting up a honeypot and not knowing how it works can really backfire on you... Suppose your honeypot gets cracked.. That's why it's there in the first place.. Then suppose "they" start using your honeypot to attack the rest of your network..
I agree with DjM.. You need one or more IDS'es, not honeypots. They're definitely not the same..
But he has to set up a honeypot.Quote:
I am currently interning at a rather large company in there computer security department and the task they gave me is to set up a honeynet.
Yes, but his superiors don't know sh*t about what they're asking and setting one up on your network can really, really, really backfire...
So, reading between the lines, they (his superiors) want to detect intrusions and/or malware. Perfect job for an IDS.Quote:
My question is would I be substantially more successful at detecting any kind of malware or intrusion by setting up honeynets on different parts of the network or will one one end of the switch be sufficient?
Yeah I do agree with you that a honeypot is not the best solution, but since he is just doing an internship - I'd say they are just getting him to set up a honeypot as an exercise and would severely doubt that they would allow an intern to set up a honey pot that would actually be deployed on a live network.
Perhaps it is just an exercise to allow him to demonstrate his ability.
Been realistic, and no offence to the original poster, what sort of company would allow an intern (no matter how good) to set up a live honeypot??
True.. None of the companies I worked for even dared having one let alone one setup by an intern..Quote:
Originally Posted by WolfeTone
There are a few whitepapers on the site I mentioned in the second post. That should be enough to get started.
Yeah I agree with you SirDice, honeypot.org is a good starting point.
Also, honeypots for dummies if you can get your hands on a copy.