Summary

skip navigation

honeypots for windows
Chapter 10 - Honeypot Monitoring
Honeypots for Windows
by Roger A. Grimes
Apress 2005
progress indicator progress indicatorprogress indicator progress indicator

This chapter covered the many methods and some of the applications you can use to monitor your honeypot system. Setting up a honeypot monitoring system means collecting a baseline, creating log files, collecting them to a centralized location, and then prioritizing the critical events so the administrator is alerted to only the appropriate exploits.

I emphasized how the goal of honeypot system logging is to capture all traffic into and out of the system, while only presenting the most relevant data first. The worst possible outcome is for log files to be left distributed and unranked, forcing the administrator to wade through a myriad of data looking for the clues manually. This virtually guarantees unread log files, and consequently, a less useful honeypot system. Logging data in a honeypot system requires thoughtful consideration. All log-generating systems must be time synchronized and the data collected to a centralized location. The most important events must be brought to the attention of the administrator using an alert system, and all the data stored securely for future analysis.

Chapter 11 discusses the forensic analysis of the collected data.

progress indicator progress indicatorprogress indicator progress indicator


Honeypots for Windows
Honeypots for Windows (Books for Professionals by Professionals)
ISBN: 1590593359
EAN: 2147483647
Year: 2006
Pages: 119

Similar book on Amazon
Honeypots: Tracking Hackers
Honeypots: Tracking Hackers
Know Your Enemy: Learning about Security Threats (2nd Edition)
Know Your Enemy: Learning about Security Threats (2nd Edition)
Virtual Honeypots: From Botnet Tracking to Intrusion Detection
Virtual Honeypots: From Botnet Tracking to Intrusion Detection
Malware Analyst's Cookbook and DVD: Tools and Techniques for Fighting Malicious Code
Malware Analyst's Cookbook and DVD: Tools and Techniques for Fighting Malicious Code

flylib.com © 2008-2017.
If you may any questions please contact us: flylib@qtcs.net