November 17, 2010

Intrusion detection honeypots simplify network security

Low-cost, low-fuss honeypots are highly effective early-warning systems against external attacks and insider threats; KFSensor, HoneyPoint, and Honeyd offer safety, ease, and flexibility

Print|

Honeypots by the features: KFSensor, HoneyPoint, and Honeyd

	KFSensor	HoneyPoint	Honeyd
Product version	KFSensor v.4.7.0 Professional	HoneyPoint Security Server 3.00	Honeyd 1.5c
Built-in interaction level	Low to intermediate	Low, but more can be customized	Low, but more can be customized
Supported host OS	Windows only	Windows, Linux, Mac OS X	Linux, BSD, Solaris, Windows (problematic)
Install as service or daemon	Yes	Yes	Yes
Listen on all TCP and UDP ports	Yes	Yes	Yes
Denial of service prevention	Yes	No	No
Built-in IDS signature capabilities	Yes	No	No
Built-in emulated services
Network emulation	No	No	Yes
Emulate OS at network stack level	No	No	Yes
Emulate unrelated OSs	No	No	Yes
Web server	Yes	Yes	Yes
SQL	Yes	No	No
NetBIOS/SMB/CIFS	Yes	No	No
FTP	Yes	No	No
SMTP	Yes	Yes	No
POP3	Yes	Yes	No
ICMP	Yes	No	Yes
Simulate open relay	Yes	No	No
Worm/trojan emulation	Yes	No	No
Supports external simulation scripts	Yes	Yes, basic	Yes
Forward probes to external servers/services	Yes	No	Yes
Store logs to databases	Yes	Yes, local SQL	Yes
Capture packet-level detail	Yes, with Winpcap installed	No	Yes, with libpcap installed
Supports plug-in extensions	No	Yes	Yes
Alert types
Displayed locally	Yes, plus status bar and audio	Yes, in console	Yes, in console
Email	Yes	Yes	Not built-in, but can be done
Email throttling	Yes	Yes	Not built-in, but can be done
Syslog	Yes	Yes	Yes
Windows Event logs	Yes	Yes	No
Central console	Yes	Yes	Not built-in, but can be done
External programs	Yes	No	Not built-in, but can be done
Logs exportable	Yes	Yes	Not built-in, but can be done
Severity/criticality ratings allowed	Yes	Yes	Yes
Reporting
Built-in reports	No	Yes	No
Reports customizable	N/A	Yes, using third-party SQL report tools	N/A
Pricing	KFSensor pricing starts at $199 for the Standard Edition and $599 for the Professional Edition; volume discounts available	HoneyPoint Security Server is licensed per sensor, includes one console; starter packages begin at $4,995 for 10 sensors	Free open source under the GNU General Public License

Roger A. Grimes is contributing editor of the InfoWorld Test Center. Roger holds over 40 computer certifications and has authored eight books on computer security. He has been fighting malware and malicious hackers since 1987, beginning with disassembling early DOS viruses. He currently runs eight honeypots to track hacker and malware behavior and consults to companies from the Fortune 100 to small businesses. A frequent industry speaker and educator, Roger currently works for Microsoft as a Principal Security Architect. He also writes the Security Adviser blog.

‹ previous page