KFSensor

 

Benefits of KFSensor

Benefits

  • Signature attack identification
    KFSensor's rule base signature engine can identify known attack patterns, which greatly helps in analizing the nature of a event. Rules can be imported from external sources in Snort format giving access to a huge amount of security knowledge.
  • Detects Windows networking attacks
    KFSensor contains the world's only Windows networking/ NetBIOS / SMB / CIFS emulation honeypot. This unique feature enables it to detect the nature of attacks on file shares and Windows administrative services, currently the most prevalent and damaging on the Internet.
    Firewalls can detect port scans, but not the nature of an attack. NIDS can identify certain attacks but not without the risk of compromising security. Only KFSensor can provide the maximum information on an attack, without risk of compromise.
  • Extendable architecture
    The already comprehensive emulation and reporting features of KFSensor can be further extended by writing your own scripts and database queries.
  • No false positives
    Firewalls and network based IDS are often overwhelmed by the amount of network traffic and often generate false alarms by misinterpreting legitimate network traffic. KFSensor's honeypot model has no legitimate uses, so all connections to them are suspect.
  • Low overheads
    KFSensor lies dormant until attacked, consuming very little processor time or network resources. Sensors can be installed on users' machines without affecting their normal use, eliminating the need for additional hardware.
  • Remote Administration
    Protect different locations in the corporate network with multiple KFSensor installations and manage the process from one location. KFSensor Enterprise Edition provides remote configuration and real time concatonation of events from a single administrator machine using top of the range encryption and authentication.
  • Simplicity
    The concepts behind KFSensor are easy to understand. Its configuration and operation is straightforward, requiring minimal training and m aintenance.
  • Advanced server simulation
    KFSensor emulates real servers, such as FTP, SMB, POP3, HTTP, Telnet, SMTP and SOCKS to improve deception and gain more valuable information on a hacker's motives.
  • Real time detection
    Attacks are detected, analyzed and reported immediately allowing response to an attack while still in progress.
  • Detects unknown threats
    Unlike other products KFSensor does not rely on signatures of known attacks and can therefore detect new or 0 day threats, such as new worms, viruses and elite hackers. KFSensor is just as effective at detecting internal threats.
  • Security in-depth
    KFSensor complements other types of security products, such as firewalls, anti-virus and network based IDS systems, to provide an additional layer of protection.
  • Designed for a corporate environment
    KFSensor's secure design and its ability to work both inside a LAN and in front of a firewall make it suitable for organizations that demand the highest security requirements.

    Next: How KFSensor works


    KFSensor On-Line Manual Contents