Protecting the Local Network

By using one or more honeyBox appliances, networks ranging from small size to very large size can be monitored for attacks. For this purpose, the virtual honeypots are placed in different segments. Several hundred virtual honeypots can be configured with one appliance.

Monitoring Critical Areas (e.g. Server Farms and DMZs)

With the honeyBox appliances, sensitive network areas can be monitored for attackers? activities. Thus, monitoring of complex environments can be realized without interfering with productive systems and without interfering with the network.

Detection of Malware Spreading in the Local Network

Malicious software spreads across the internal network using mechanisms which can be reliably detected by the honeyBox appliance. These mechanisms include scanning for existent systems, addressing the services running thereon and contaminating these systems by introducing malicious code.

Using the honeyBox Appliance in a Research System

HoneyBox appliances can be employed as components of a research system. Thus, a plurality of virtual honeypots can be set up for monitoring, tracking and analysing attacks. Such research systems are valuable tools which provide a better understanding of attacks.

1. Efficient and reliable detection of attacks and malware spreading
2. Low effort for installation and putting into operation. The appliance is ready to go after the first configuration which will take about 1 hour.
3. Low costs for administration and operation. Backup and update functions are implemented already and can be automated.
4. Checking the event logs is very easy. Only if something is happening, events are logged.
5. No adverse effect on availability like in IDS/IPS. The honeyBox does not have to be looped into the data stream. So no redundant honeyBox appliances are required.

Conclusion: High benefit, low investment and low operating effort

In addition to the all software version, the honeyBox appliance is also available as a hardware appliance. The advantages of an all hardware solution are:

• Faster installation, because the appliance is pre-configured
• Hardware is adapted to the functionality
• More cost-efficient than a standard server
• Simplified disaster recovery
• Hardware exchange service NBD (Next Business Day) (optional)

The appliance is equipped with 4 Gigabit Ethernet ports, with one of them being used as a dedicated management interface.