I have waited a while before I weighed in on the
subject because I wanted to try and be convinced by
some of the discussion.

I like Option A the best.

It is the easiest to sell to someone (management,
client, etc.). And it offers a great amount of
latitude in how the final system will result. It is
simple, elegant, and can be comprehended by most
people who will end up caring about results and
success in the end.

Thanks for starting an interesting discussion.

Regards,
Chris

--- Lance Spitzner <lance (at) honeynet (dot) org [email concealed]> wrote:
> In the past week we have received over thirty
> postings
> about the definition of honeypots, each posting
> suggesting
> a different defintion. I think we are all beginning
> to
> realize just how tough it is to define this
> technology.
> Honeypots are an extremely powerful tool that can
> accomplish many different things. Some trends I've
> noticed.
>
> First, many people are including the term 'decoy' in
> the
> definition. While honeypots can 'decoy', I don't
> think
> that should be in the definition. The term decoy
> implies
> "to lure or entrap". Often honeypots don't lure.
> You just
> put them out there and the bad guys find them on
> their own
> intiative, nothing special is done to insare the
> attacker.
> The Honeynet Project has being doing this for years
> now.
>
> Second, many people are including in the definition
> how
> honeypots are used to learn or research. Once
> again, while
> honeypots can do this, they can do so much more.
> They
> can be used for preventing attacks (such as LaBrea
> Tarpit)
> or be used purely for detection similar to an IDS
> system (such as Honeyd). We have to be very careful
> in our defintion to ensure we do not imply why we
> would
> want to use a honeypot.
>
> Honeypots do not solve a specific problem, they are
> a
> highly flexible tool with many different
> applications to
> security. This is one of the things that makes
> honeypots
> unique.
>
> Based on all the feedback we have been getting, I've
>
> narrowed this down into two options.
>
> Thoughts?
>
>
> OPTION A
> --------
> "A honeypot is an information system resource
> who's
> value lies in being probed, attacked, or
> compromised"
>
>
> OPTION B
> --------
> "A honeypot is an information system resource
> who's
> value lies in monitoring unauthorized or illicit
> use of
> that resource"
>
>
> --
> Lance Spitzner
> http://www.tracking-hackers.com
>
>
>

__________________________________
Do you Yahoo!?
The New Yahoo! Search - Faster. Easier. Bingo.
http://search.yahoo.com

[ reply ]