Re: Honeynet Requirements

[Maximillian Dornseif <md () un bewaff net>]

On 15.05.2004, at 18:14, Chuck Fullerton wrote:

> Using the diagram from the Honeynet Paper from www.honeynet.org, when 
> you
> add honeypots to your honeynet,  how closely must they mirror the 
> production
> machines?

My research (http://md.hudora.de/publications/#honeyeco ) indicates 
that greater similarity to production machines increases the likelihood 
 that your Honeynet will get profitable. Which means that you get mor 
value in information out of the Honeynet than you put into it in the 
form of maintenance and creating a realistic mirror of production 
machine.

But keep inn mind that this research is rather abstract and might not 
apply th your specific circumstances. Nevertheless it gives some 
guidance.

Regards

Max

--
Maximillian Dornseif, Dipl. Jur., CISSP
Laboratory for Dependable Distributed Systems, RWTH Aachen University
Tel. +49 241 80-21431 - http://md.hudora.de/