Lance,
let me follow up on Volker's remark and also on what Fabien and Dave wrote
a few days ago.

I'll be a little bit provocative ... no offense please, I'm trying to get
things moving :-}

At 09:30 23/05/2003 -0500, you wrote:
>Okay folks, attempting to define what a honeypot is has
>been extremely interesting (and challenging).
>[...]
>Based on the feedback we have gotten over the past week,
>it looks like Option B was the preferred option. That
>definition is as follows.
>
> "A honeypot is an information system resource who's
> value lies in monitoring unauthorized or illicit use
> of that resource"

if I say
"the definition of a honeypot is a sentence who's value lies
in getting a consensus in the honeypots mailing list",

I'm sure that you will agree with me that this is certainly not a good
definition of the "definition of a honeypot".

Similarly, you should agree that your sentence can not be taken as a
definition of a honeypot.

Instead, it is a good sentence to let people understand
*what we do with honeypots*, *why we need honeypots*, *why they should pay
for honeypots*,
but not
*what honeypots are*.

In other words, this is a definition of honeypots usage, not of honeypots
per se.

As long as we keep focusing on the usage, we will have an endless debate
since every new usage could lead to a new definition..

For instance, suppose that I install a honeypot behind my firewall where
it should -hopefully- see nothing. I don't want to use that honeypot to
monitor anything but, instead, to be a simplistic intrusion detection
system. My policy states that, as soon as a single packet reaches the
honeypot, my network must be disconnected from the internet because
something is wrong with the firewall (ok, it's a silly example and a
rather stupid reaction but bare with me :-) ).

Based on this "usage", is this "information system resource" a honeypot ? I
would tend to say yes but your definition leads me to believe that you
would say no.

Can't we come up with a definition that does not take the usage into
account at all ?

>Since this is the preferred option of the two, this is
>what we will go with.

Mmmmm ... the least worst of the two 'definitions' does not make a good one :-)

Reactions, remarks ?

Cheers,
Marc

[ reply ]