Re: Moving forward with defintion of honeypots

["Richard La Bella \(Florida Honeynet\)" <richard () sfhn org>]

> OPTION B
> --------
>   "A honeypot is an information system resource who's
>    value lies in monitoring unauthorized or illicit use of
>    that resource"


I like OPTION B. After reading the definition over and over this came to
mind:





 "A honeypot is any interconnected system whose purpose and value lies in
monitoring unauthorized or illicit use of that system"






I use the term "any interconnected" to explain that a disconnected honeypot
by itself does not provide purpose and value. Also, a honeypot can be "any"
interconnected system as well. A router, a server, VoIP phone, etc.



It's obvious to us honeypots must be connected to a network. For those who
are not familiar with honeypots, computers, and / or networking I believe
"interconnected" might help to make the definition more specific. Part of me
thinks, "it's obvious that honeypots must be connected to the Internet in
some way", and another part of me thinks, "it's not so obvious to folks like
my Grandmother."  ;-)





I left out the word "resource" for the word "system" because system is
defined as:

  1.. A group of interacting, interrelated, or interdependent elements
forming a complex whole.
  2.. A functionally related group of elements, especially:
    1.. A network of structures and channels, as for communication, travel,
or distribution.
    2.. A network of related computer software, hardware, and data
transmission devices.

I added "purpose" with value.



Thoughts anyone?







Richard



Florida Honeynet Project
http://www.floridahoneynet.org
richard () floridahoneynet org