Re: question

[Sam Varughese <sam.varughese () paladion net>]

On Thu, 21 Aug 2003 07:07:36 EDT
Motayyam79 () aol com wrote:

> Hi,
>
> Just one question. Can honeypots be deployed internally in order to monitor 
> for insider attacks?if so how?

Some idea about how ur setup is done could be helpful in answering this question. 
In general the GenII honeynet setup is good idea. 

http://www.sfhn.org/whites/gen2.html 
This is cool paper. 
The idea is that your internal people would access the servers in question through a Bridge mode iptables box along 
with the normal honeypot setup for monitoring etc.  

Regards 
Sam V




Security Consultant
Paladion Networks 

> Thanks