On Fri, 23 May 2003 17:05:30 +0200, Marc Dacier <marc.dacier (at) eurecom (dot) fr [email concealed]> said:

> For instance, suppose that I install a honeypot behind my firewall where
> it should -hopefully- see nothing. I don't want to use that honeypot to
> monitor anything but, instead, to be a simplistic intrusion detection
> system. My policy states that, as soon as a single packet reaches the
> honeypot, my network must be disconnected from the internet because
> something is wrong with the firewall (ok, it's a silly example and a
> rather stupid reaction but bare with me :-) ).

There exist environments where this is *not* a silly example.. ;)

Heck, there exist environments where cable between rooms is run through
pressurized conduit, with pressure-sensitive alarms to detect the pressure
drop caused by a break, and armed Marines. And Marines are renowned for
their ability to follow orders like "If this alarm goes off, shoot whoever
is standing by the pipe"

Needless to say, conduit maintenance is scheduled *VERY* carefully :)

[ reply ]