A Honeypot Deployment Plan

Summary

Deploying a honeypot system requires methodical planning and understanding of your motivations for installing one in the first place. Basic underlying honeypot tenets must be considered during the design phase. You need to decide whether you want to implement a research or production honeypot, real or virtual, and where to place it. These decisions depend on your objectives and resources. Externally placed honeypot systems are the most exposed type of (research) honeypot and will gain the attention of hackers the quickest.

Production honeypots placed on the DMZ can warn you of malicious activity happening within your DMZ. Internally placed honeypot systems can act as an early-warning system to alert you that a threat has bypassed your other network security countermeasures, as well as alert you to internal attacks.

A honeypot system is a collection of components, including tools for alerting, monitoring, logging, and analyzing found data. Chapter 3 will cover the basic behaviors and services a Windows honeypot should mimic.