Managed Security Services

Honeypots: Tracking Hackers

Honeypots are systems that are designed to log hacker activity. The book Honeypots: Tracking Hackers is a hands on book that tells you how to set up honeypots on your network.

by Alex Goldman ISP-Planet Associate Editor [March 14, 2003]

If you've ever been attacked by a hacker and really wished you knew what was going on, you've wanted a honeypot. If you've ever worried about whether your network was really secure, you've wanted a honeypot. If you've ever wanted to know more about what hackers really do, you've wanted a honeypot.

Honeypots are systems whose sole value lies in being hacked. Whereas it can be difficult to tell when a normal computer has been hacked, because a normal computer handles a massive amount of data each day, a honeypot is a computer that is connected to the network but handles almost no data during the course of a normal day. All traffic on the computer is suspect and should be analyzed.

Analysis, however, is the true cost of a honeypot. It can cost little or no money to set up a honeypot, but analyzing the data it produces can take an extraordinary amount of time—members of The Honeynet Project estimate that each 30 minutes of hacker activity requires 40 hours of data analysis—and that's just an average. Complex or sophisticated hackers can require even more time.

Nevertheless, if you're ready to deploy a honeypot, there's a book out there for you. Lance Spitzner, team leader for the group that wrote Know Your Enemy, has written a sequel, Honeypots: Tracking Hackers, that describes in detail the various commercial off-the-shelf honeypots, your options when deploying them, and how to analyze the data you obtain from them.

The book is 452 pages long and contains sixteen chapters, five appendixes, an index, and a CD-ROM. Chapter 1 describes how Spitzner became interested in honeypots. Chapters 2 through 5 help the reader classify honeypots and learn what to expect from them. Chapters 6 through 11 describe various off-the-shelf honeypot products as well as several do-it-youself options. Chapter 12 describes building a honeypot. Chapter 13 covers maintaining a honeypot. Chapter 14 is a (mostly) fictional account of an actual honeypot deployment. Chapter 15 covers legal issues, which are especially important to those in the U.S. who are considering deploying a honeypot. In Chapter 16, Spitzner discusses the future of honeypots.

The appendixes and the CD-ROM contain additional documentation, research papers, and actual software for use with honeypots.

The book is clearly written, with numerous examples in the text and more available in the appendixes and CD-ROM. It is very much a hands on book for people who have decided to deploy honeypots. If honeypots do not interest you, or if you just what to know what they are, the book Know Your Enemy would be a better read. (A revised edition of Know Your Enemy should be published in early 2004 or towards the end of 2003.) However, if you have decided to deploy honeypots, this book is a must for you.

—End