Re: Honeypot/net IDS System

[Valdis.Kletnieks () vt edu]

On Tue, 24 Feb 2004 22:27:49 +0530, ravivsn () roc co in said:

>  - honeypots can only trace out the hacker but it cant identify a possible
> threat, unless administrator goes thro the logs it is difficult to
> identify.

The same is true for firewalls and application servers as well.  You can syslog
all you want, but it's pointless if there's nobody reviewing the logfiles.
Want to make guesses how many times I've run into people who install firewalls
and then *don't even know* that the firewall keeps logs? :)

Remember - firewalls aren't a protection device, they're a detection device. If
somebody wants "in" badly enough, they *will* find a way around it (find an
unsecured modem port inside, social engineer a few hours in an empty cubicle,
etc).  So if you're not paying attention to the "somebody wants in" warning
signs, you're a sitting duck....

And the same exact thing goes for honeypots - if you're not paying attention
to what it's telling you, do the world a favor and do your part to slow down
global warming by unplugging the box. :)

Attachment: _bin
Description: