What is a Honeypot?
A honeypot is a system that is network-attached and is deployed as a decoy to lure cyber attackers and to find, change or study hacking procedures or attempts in order to gain unauthorized access to information systems. The function of a honeypot is to represent itself on the internet as a potential target for attackers and to gather information about how cybercriminals operate.
Honeypots are most often used by large enterprises and by companies involved in cybersecurity research. Honeypots can be important as a defense against attackers.
The cost of maintaining a honeypot can be high because of some special skills required to implement and administer this type of system.
How does it Work?
A honeypot operation consists of a computer, applications, and data that understand the behavior of a real system and seems to be a part of a network. The honeypot is actually kept remote and is closely monitored. As there is no reason for legitimate users to be interested in a honeypot, any attempts to communicate with it should be considered hostile.
Viewing and logging this activity can help improve security by providing information on the level and types of threat a network infrastructure faces while deflecting the attackers away from assets of real value.
Virtual machines are often used to host honeypots, so if it is compromised by malware, for example, the honeypot can be quickly restored.
Types of honeypots
There are two types of honeypots based on design and deployment :
- Production
- Research
Research honeypots analyze the attacker’s activity very closely and discover how they develop and progress to learn how to smoothen protect systems against them. Data placed in a honeypot with unique identification properties can also help analysts to gather information about the data stolen and identify connections between different participants in a hacking process.
Production honeypots are usually deployed inside production networks with the production servers; the honeypot plays the role of a decoy as part of the production network intrusion detection system (IDS). A production honeypot is so designed that it seems to be real and contains information to deflect hackers to tie up their time and resources.
Honeypots can be classified as pure, high-interaction, or low-interaction.
A pure honeypot is a production system that uses a click on the honeypot’s link to the network. A high-interaction honeypot negates the activities of the production systems that host a variety of services and captures important and sensitive information. A low-interaction honeypot works and responds only to the services that attackers frequently request. As a result, they are less risky and their maintenance is easier. The goal of a high-interaction honeypot is to lure an attacker to gain root access on the server and to keep track of their activity.
In all, honeypots help researchers understand threats in network systems, but production honeypots should not be seen as a replacement for a standard IDS. If a honeypot is not configured correctly, it can be used to gain access to real production systems which might prove as a threat.
