Question

Both a firewall and a honeypot can function as an IDS. While the firewall's main purpose is typically to establish a barrier between two networks to control traffic, the honeypot is a unique type of IDS providing other functionality. One of your clients has asked you if they need to install both, or will one of them alone provide adequate protection for their network? Briefly analyze and discuss the benefits and drawbacks of each of the possible configurations (for example, firewall only, honeypot only, both firewall and honeypot) and answer your client's question on the need for both.

Answer 1

Firewalls

Firewalls can be either software based or hardware devices that are used in the enforcement of security policies. Both can filter traffic based on a set of rules as traffic passes through them.

Routers are not firewalls and should never be considered as such. Network-based firewalls will route traffic but this is only if the policy allows. Single hosts can be protected from both incoming and outgoing traffic by use of a host based firewall. Regardless of whether the firewall is software or hardware, all can create a troubleshooting nightmare should they not be configured carefully or correctly. This is the keystone to a business objective driven policy when it comes to firewall configuration.

Improvised configurations do not work well with firewalls. The configurations must be carefully thought through and any impact caused by the configuration must be considered. This should be done before the implementation of any firewall policies.

Physical or social engineering attacks cannot be protected against by any firewall. The most common weaknesses in any firewall are either leaving them in their default configurations or by careless implementation. Attackers are looking hard for these weaknesses and the best defensive measure it to prevent them from finding them by changing the default settings or by careful firewall configurations. Of equal importance is to understand both the benefits and the limitations of firewalls and prevent being lulled into the false sense of security by thinking their mere presence is equal to network security and protection.

Honeypot

Honeypots are designed to attract attackers with the idea that monitoring systems will allow the attacker to be observed. Honeypots come in different scales with a honeypot being a host, a honeynet is a network and a honeytoken is a piece of monitored data.

Before the deployment of a honeypot, a company or organization needs to verify that they are not violating the privacy rights of the attacker, (go figure...) Convert honeyposts deployed by third party projects rest in a different category.

The art to setting up a decoy victim is to make it appear legitimate. It must not stand out or seem in any way unusual or the attacker will notice and avoid it. With this, honeypots are not necessarily entirely exposed to risks, where a bastion host is used to describe one that is since it is completely exposed and completely hardened because it is getting no help. Honeypots cannot create additional risks or they could, and would be used against their attacker.

Firewall and Hnoeypot

A firewall in a honeypot works in the opposite way that a normal firewall works: instead of restricting what comes into a system from the Internet, the honeypot firewall allows all traffic to come in from the Internet and restricts what the system sends back out.

By luring a hacker into a system, a honeypot serves several purposes:

• The administrator can watch the hacker exploit the vulnerabilities of the system, thereby learning where the system has weaknesses that need to be redesigned.
• The hacker can be caught and stopped while trying to obtain root access to the system.
• By studying the activities of hackers, designers can better create more secure systems that are potentially invulnerable to future hackers.