Re: Usefulness of low-interaction honeypots.

[Kostas K <acezerocool () yahoo com>]

In-Reply-To: <20030908133938.70204.qmail () web40905 mail yahoo com>

Hi, Raymond

  I did not exclude the use of both IDS and Honeypot. I just said that 
using honeypot and especially a LIH alone you can't rely much on it. 
Furthermore, someone mentioned that a co-operation between a firewall and 
a LIH is feasible. 
The answer is simply yes, and it's a lot easier to deploy a LIH at the 
internal network rather than communicating with the Internet.
I believe that a LIH could be deployed at the internal for the following 
reason:
-you can monitor your employees. There is always the capability of 
installing certain kind of application in Desktops/workstations.

But if you install a LIH that will be responsible for the surveillance of 
what's going outside is a bit risky. Feeding them with false webpages, 
someday LIH could be exposed. Ok, you could say that the attacker should 
be an expert but you never know.
I agree that we should invest more on IT security, IT is the future if we 
are not already in the future. The more people on the Internet the more 
we need to spend for security. 


Regards,

Kostas



> Hi Kostas,
>
> Why don't we use both IDS and Honeypot together ? As a
> matter of fact, given the traffic loading and
> correction of events, would it be more easily for
> administrator to do the cross-validation with both
> tools.
>
> regards, Raymond.
>
>
>
> __________________________________
> Do you Yahoo!?
> Yahoo! SiteBuilder - Free, easy-to-use web site design software
> http://sitebuilder.yahoo.com



> --- Kostas K <acezerocool () yahoo com> wrote:
> In-Reply-To:
> <Pine.LNX.4.44.0309072022340.18729-100000 () marge spitzner net>
>
> Hi Kostas,
>
> Why don't we use both IDS and Honeypot together ? As a
> matter of fact, given the traffic loading and
> correction of events, would it be more easily for
> administrator to do the cross-validation with both
> tools.
>
> regards, Raymond.
>
>
>
> __________________________________
> Do you Yahoo!?
> Yahoo! SiteBuilder - Free, easy-to-use web site design software
> http://sitebuilder.yahoo.com