Honeypot

A honeypot is a security tool designed to detect, divert and analyse malicious activity on a network.

It is a system or network resource that appears vulnerable and attractive to an attacker, but which is in fact controlled and monitored by the defenders.

Its purpose is to attract attention, gather information about the tactics and techniques being used, and protect the real systems by absorbing and containing the activity.

What characterises it

It is meant to be attractive. A honeypot is configured to look like valuable systems, services or data. It may emulate known vulnerabilities, weak configuration or sensitive information in order to draw an attacker into interacting with it.

Everything is recorded. Every event is logged and watched: access attempts, scanning, exploitation attempts, and anything else that indicates an attack in progress.

It is isolated. It is deployed separately from the real systems and data, so that if an attacker does compromise it the impact is confined to a controlled environment where their actions can be observed safely.

Decoys. Some honeypots exist to place false targets inside the network, files, directories or services that look genuine and are designed to alert as soon as anybody touches them.

A worked example

A web server is configured to look like a legitimate application with a known vulnerability, for example one susceptible to SQL injection.

When an attacker attempts to exploit it, the honeypot records what they do and alerts the security team, while the real web server carries on unaffected.

What the team gains is not the block. It is the record: which technique, which tooling, which infrastructure the traffic came from, and how the attacker behaved once they believed they were inside.

Why it is worth having, in one property

The reason a honeypot earns its place has nothing to do with deception being clever. It is that it produces almost no false positives.

Every other detection method has to separate malicious activity from a large volume of legitimate activity that resembles it, which is where detection engineering spends most of its effort. A honeypot has no legitimate users and no business function, so nothing has any reason to connect to it. An interaction is not evidence that something might be wrong, it is evidence that something is.

That is why the cheapest useful version is not a full honeypot at all. It is a decoy: a document nobody should open, an account nobody should use, a credential planted where only somebody enumerating the environment would find it. Each of those becomes a high-confidence indicator that costs almost nothing to maintain.

The limits are worth stating too. A honeypot only sees attackers who touch it, so it is a detection and intelligence tool rather than a control, and one that interacts deeply with an attacker has to be isolated properly or it becomes a foothold rather than a trap.

Where to read more

SANS Institute: material on honeypot design, the distinction between low and high interaction deployments, and the operational considerations of running one.