| |||||||||||||||
"The text is comprehensive, an honest survey of every honeypot technology I had ever heard of and a number I read about for the first time."
--Stephen Northcutt, The SANS Institute
"One of the great byproducts of Lance's work with honeypots and honeynets is that he's helped give us a much clearer picture of the hacker in action."
--From the Foreword by Marcus J. Ranum
"From the basics of shrink-wrapped honeypots that catch script kiddies to the detailed architectures of next-generation honeynets for trapping more sophisticated bad guys, this book covers it all....This book really delivers new information and insight about one of the most compelling information security technologies today."
--Ed Skoudis, author of Counter Hack, SANS instructor, and Vice President of Security Strategy for Predictive Systems
Honeypots are unique technological systems specifically designed to be probed, attacked, or compromised by an online attacker. Implementing a honeypot provides you with an unprecedented ability to take the offensive against hackers. Whether used as simple "burglar alarms," incident response systems, or tools for gathering information about hacker motives and tactics, honeypots can add serious firepower to your security arsenal.
Honeypots: Tracking Hackers is the ultimate guide to this rapidly growing, cutting-edge technology. The book starts with a basic examination of honeypots and the different roles they can play, and then moves on to in-depth explorations of six specific kinds of real-world honeypots: BackOfficer Friendly, Specter, Honeyd, Homemade honeypots, ManTrap®, and Honeynets.
Honeypots also includes a chapter dedicated to legal issues surrounding honeypot use. Written with the guidance of three legal experts, this section explores issues of privacy, entrapment, and liability. The book also provides an overview of the Fourth Amendment, the Electronic Communications Privacy Act, the Wiretap Act, and the Pen/Trap Statute, with an emphasis on how each applies to honeypots.
With this book you will gain an understanding of honeypot concepts and architecture, as well as the skills to deploy the best honeypot solutions for your environment. You will arm yourself with the expertise needed to track attackers and learn about them on your own. Security professionals, researchers, law enforcement agents, and members of the intelligence and military communities will find this book indispensable.
Lance Spitzner is a senior security architect for Sun Microsystems, Inc., and an acknowledged authority in security and honeypot research. He is a developer, the moderator of the honeypots mailing list, and an instructor for the SANS honeypot course. He is also the founder of the Honeynet Project, a nonprofit group of thirty security professionals dedicated to Honeynet research and learning the tools, tactics, and motives of blackhats and sharing their lessons learned. Lance has presented data on honeypot technologies to organizations such as the Pentagon, the FBI Academy, the Naval War College, the National Security Agency, West Point, SANS, CanSecWest, and Black Hat Briefings.
Product Details
Would you like to update product info or give feedback on images?
|
The structure of the book is different from the "Know Your Enemy":
Lance starts from the very beginning - namely, his first honeypot
penetration experience and then goes on to talk about all aspects of
honeypots. In-depth and structured background on honeypot technology
is provided. Honeypots are sorted by the level of interaction with
attacker they are able to provide.
In addition, the book covers the business benefits of using
honeypots. By classifying the value of honeypots into prevention,
detection and response (exactly as done in Honeynet Project white
papers) Lance Spitzner analyzes the honeypot technology contributions
to an overall security posture. Also, the book describes the
differences between the research and production honeypots and
demonstrates the benefits of both for various deployment scenarios.
A good part of the book is devoted to particular honeypot solutions:
'honeyd' by Niels Provos and several commercial honeypots with
detailed explanation of how they work. For example, there is a clear
description of ARP spoofing and how it is used by the 'honeyd'
honeypot daemon. An interesting chapter on "homegrown" honeypot
solutions (such as the ones used to capture popular worms of 2001)
sheds some light on the simplest honeypots that can be built for
specific purposes, such as to capture a popular attack by means of a
simple port listener. Use of UNIX chroot() jail environment for
honeypots is also analyzed.
Of course, a special chapter is devoted to honeynets - Project's
primary weapon in a war against malicious hackers. The Generation II
(GenII) honeynet technology is first introduced in a book. The chapter
not only lists honeynet deployment and maintenance suggestions, but
also talks about the risks of honeynets.
Another great feature of the book is a chapter on honeypot
implementation strategies and methods, such as using NAT to forward
traffic to a honeypot and DMZ honeypot installation. The information
is then further demonstrated using the two full honeypot case studies,
from planning to operation.
What is even more important, maintaining the honeypot architecture is
covered in a separate chapter. Honeypots are a challenge to run,
mainly since no 'lock it down and maintain state' is possible. One has
to constantly build defenses and hide and dodge attacks that cannot be
defended against.
"Tracking hackers" also has a "Legal Issues" chapter, written with a
lot of feedback from the DoJ official. It dispels some of the
misconceptions about the honeypots such as the "entrapment" issue,
summarizes wiretap laws and related data capture problems.
The book describes an almost cutting edge of the honeypot research and
technology. To truly get the cutting edge and to know about the
Honeynet Project latest activities in detail, wait for the second
edition of "Know Your Enemy" (coming out next year). In "Tracking
Hackers" Lance makes some predictions about honeypots in "Future of
Honeypots" chapter. Honeypot-based early warning system and
distributed deployments, analysis of new threats and expanding
research applications, making honeypots easier to deploy and maintain
are all in this chapter.
To conclude, Marcus Ranum's enthusiastic preface is not an
overstatement, it is indeed a great book for both security
professionals and others interested in this exciting technology.
While I was already familiar with most of the information in the book,
it was a fascinating read! This is the kind of book you don't want or
even cannot put down until the last page is turned.
Anton Chuvakin, Ph.D., GCIA is a Senior Security Analyst with a major
information security company. His areas of infosec expertise include
intrusion detection, UNIX security, honeypots, etc. In his spare time
he maintains his security portal info-secure.org
Lance begins with how he got interested in honeypots and goes on to describe the different tools that are available, how they work and how anyone can set up their system to learn how to defend from novel attacks attacks. From the personal home computer to huge networks, Lance and his team have a solution.
He puts attackers in two categories: those who want to attack as many systems as possible and those who target a specific system of high value. By defining these attackers the audience has a clear understanding of what they are dealing with.
Starting with the history and definition of honeypots and honeynets, he takes us through characteristics and the different levels of interaction, how to configure different levels of honeypots, then on to the need to convince management of the value of honeypots and finally the legal issues (USA law) involved.
Honeypots are becoming more acceptable as hackers get into more systems and management is mandated to stop the attacks. They shouldn't be anyone's first line of defense, but for advanced sites, this is an important suite of technologies.
Honeypots: Tracking Hackers is a must read for novices and experienced security officers, alike. It will keep your attention and make you want to set up your own honeypot! If the book is not on your bookshelf and if honeypots are not part of your defensive information plans, something is wrong!
Tags Customers Associate with This Product(What's this?)Click on a tag to find related items, discussions, and people.
|
|
This product's forum
Active discussions in related forums
Search Customer Discussions
|
Related forums
|