PNW Honeynet Overview

Agenda What is a Honeynet What is the PNW Honeynet Alliance Who is involved in the project Where to get more information

Purpose of a Honeynet Demonstrate the feasibility to set up a domain honeynet Develop best practices for procedures, etc. Monitor misusers’ attempts to access computer resources Monitor computer network for viruses, worms, automated probes Attract users to target machines instead of real machines Automatically log info for: improving defensive measures, improving offensive measures, HR disciplinary measures, information for law enforcement

Components of a Honeynet Honeywall Target PCs  Windows XP  Linux  Network infrastructure  Other Management PC Hackers, Script Kiddies, etc.

Objectives of the Alliance Guide implementation of several GenII “Honeywalls” (honeynets)  Best Practice deployments  Best Practice on coordinating dispersed Honeynets Capture images of compromised systems Enter these (and “clean” images) into a database for retrieval and comparison Design that database Implement a client/server in FIRE for loading these images onto systems over the network Implement integrity checking functions in FIRE to simplify analysis

Vision of the Forensic Lab Student boots lab system using custom FIRE CD Chooses which compromised system to analyze Bits loaded to disk, verified Student performs analysis, answers specific questions (which are compared with analysis in database) Repeat…

Projects within PNW Honeynet Alliance UW  Creating new Honeywall  Creating target image/images SU  Creating a Database to manage compromised system images  Project management U of I  Administrative vetting  Trend Analysis

Project Deliverables GenII Honeywall Image Database Standard images for target machines Images of compromised images Honeywall logs of successful and unsuccessful attacks Best Practice documentation  Deployment  Coordinating Honeynets Other Documentation  Comparison of attacks on different Honeynets at different schools

Schools that are involved Schools deploying Honeynets Schools that will be using the images

Additional Information “The Use of Honeynets to Detect Exploited Systems Across Large Enterprise Networks” honeynet.pdf honeynet.pdf honeynet/reading honeynet/reading