In this article, you’ll learn what a honeypot is, what honeypots are used for, and the benefits and risks associated with them. You’ll also learn about the different types and examples of honeypots and how they work. By the end of the article, you’ll have a deeper understanding of honeypots in cyber security, and how a secure infrastructure access platform can help you safeguard your network, systems, and apps without using a honeypot.
A honeypot is a phony digital asset designed to look like a poorly-guarded, valuable asset. The goal is to trick cyber attackers into targeting the vulnerable honeypot, which deflects attention away from critical assets, alerts companies to when and what type of attack is occurring, and enables them to mitigate the risk before important network security perimeters are compromised.
As a cyber attacker enters the decoy tool—for example, a honeypot security server—and tries to gain access to data and systems, the honeypot then detects and deflects their actions away from the real network. Not only do honeypots enable companies to prevent attacks on critical assets, they’re also able to collect valuable data from real attacks to help them improve their security posture for future attacks.
In pure research settings or government sting operations, organizations use honeypot espionage to gain a deep understanding of cyber-attack techniques and even thwart large-scale criminal operations.
A honeynet is a network of honeypots that encompasses multiple systems and behaves as a real network would. Deploying a honeypot network is useful if an organization’s security team wants to study threats to an especially large or complex network or if they want to gather deeper, more nuanced data about the attacker.
The original metaphor of a bear attracted to a pot of honey is illustrated in the well-known Winnie the Pooh children’s stories. The cybersecurity industry evolved the honeypot concept as a means to lure, trap, and observe cybercriminals. Honeypot schemes have been in use as far back as the late 1980s and early 1990s when Lawrence Livermore National Laboratories and AT&T Bell Labs, respectively, used early versions of the honeypot security concept to chase down hackers who had infiltrated their systems.
Over time, honeypot espionage became more prevalent. It’s now key in trapping hackers and helping cybersecurity professionals gain extensive knowledge about various kinds of cyber attacks so they can develop systems and techniques to counter them.
The purpose of honeypot cyber security—or honeypot network security—is ultimately to keep intruders away from the real network. Once an intruder is detected and isolated in the honeypot, security teams can gather intelligence about their tactics and how they move around inside the decoy system or network. Cyber professionals and security teams can learn how certain attacks work and even how to trace attacks back to the source.
The information gleaned from the honeypot data collection process is valuable for identifying system gaps and vulnerabilities so teams know where and how to improve security protocols. Honeypot security tools are also useful for detecting ransomware and malware.
72% of companies already use or plan to use honeypots or other deception technologies.
Outside of the cybersecurity space, there are companies in many industries that utilize honeypot network security systems, especially those that deal with huge volumes of highly sensitive information every day. They include healthcare, financial services, government, and retail organizations.
Honeypots are instrumental in preventing future attacks. Since the tools uncover where actual threats exist, they show organizations where to focus their security efforts and resources.
Additional benefits of honeypots in network security include:
Though it’s tempting to rely on a honeypot to enhance threat detection and mitigation, there are still reasons to be cautious when deploying one. This is for two primary reasons:
The primary types of honeypots can be grouped by either their goal, level of technical capabilities, or area of focus. Which type of honeypot an organization uses will depend on its goals, time constraints, and available resources.
There are a couple of notable examples of honeypots in cyber security that have made headlines. Publicized honeypots are typically research honeypots that have a high profile due to the success of government entities in using these resources to catch criminals.
Law enforcement agencies around the world used a single honeypot operation that co-opted the Anom encrypted communications service to trick cybercriminals. The agencies were able to observe hundreds of criminal organizations and thousands of criminals who thought they were using a safe, encrypted messaging service.
The honeypot operation enabled police operations across 16 countries, which led to 800 arrests and the seizure of eight tons of cocaine and over $48 million.
In this honeypot example, Dutch law enforcement took over a darknet market called Hansa and used it to secretly monitor criminal purchases of illicit products. The honeypot operation allowed the police to get the specific delivery addresses of several orders and learn more about high-value targets, before eventually shutting down the market.
The honeypot operation produced 10,000 foreign addresses of the market’s buyers that were then shared with law enforcement in those countries.
Another way to categorize a honeypot in cyber security is whether it’s used in production or for research.
Production honeypots are good for detecting threats and supplementing existing threat protection tools. They help improve the overall protection of an organization’s networks and infrastructure.
Research honeypots are used for educational purposes by collecting information about attackers’ activities that can be studied by experts. A nonprofit organization called the Honeynet Project is a prominent research group that uses the latest in honeypot tools and technologies to study and expand the world’s understanding of cyber threats.
An IT professional sets up a decoy system to look like a real system—such as a database with sensitive financial information—but isolated from actual production data or legitimate network traffic. The honeypot often includes a honeywall—or honeypot firewall—that keeps it separate from the rest of the network and limits the entry and exit points of the attacker. Importantly, the honeypot is deliberately built with security vulnerabilities that are irresistible to attackers.
An attacker notices the vulnerability, then exploits it by hacking into the system. But instead of gaining access to the organization’s live network, the attacker ends up in the honeypot environment. If the honeypot is set up outside the external firewall, it can deflect—and therefore prevent—outside attacks on the internal network.
Once the honeypot attack occurs, the honeypot tracks the attacker’s movements and actions. Security teams then use the data to understand where and how the network should be better secured, and how to prepare for potential new threats.
The top three honeypot attack types are:
• SSH brute force to access a server
• TCP/UDP attacks to hack into services that use these protocols and packets
• Credential stealers to scan devices for passwords and authentication tokens
Attackers who suspect the presence of a honeypot security tool may try to hide their activities with encryption, but the savviest attackers will have detections in place to help them directly detect the honeypot. The “honeypot hacking” term refers to the tools and techniques used by attackers to detect honeypots so they can avoid them and hack into poorly secured systems.
Attackers can use a variety of tools to help them detect honeypots, such as:
The catch, though, is that these detection tools can also be used by security teams to ensure that before they deploy a honeypot, it doesn’t contain mistakes or giveaways that attackers can find.
While it’s not illegal to use a honeypot operation, there are legal risks associated with it. One of the biggest is that companies can run afoul of various state and federal regulations if they’re not careful.
For example, tricking hackers into downloading systems that reveal their identity can put organizations at risk of violating anti-hacking laws. Gathering certain types of data about hackers can also violate privacy laws. Companies shouldn’t proceed with a honeypot trap unless they thoroughly understand the risks and ramifications and are careful not to violate any laws.
The ethics around honeypots are sometimes controversial. One line of thinking is that entrapping someone into committing a crime is considered unethical, so the same logic should be applied to honeypots in cyber security.
On the other hand, because honeypots reveal valuable information about attackers and threats that can improve security techniques, some argue that it’s fine and even advantageous to use them if it means organizations, systems, consumers, and data can be better protected.
The short answer is yes. Hackers and cybercriminals are constantly upping their game, so it’s often a matter of time before they can discover a new way to exploit a system—including a honeypot. That’s why honeypot security risks have to be considered when configuring and implementing one.
Any organization or entity can use a honeypot, including hackers themselves. Hackers have been known to use honeypot technology on each other as a means of exposing someone’s identity and knocking them out as a competitor.
While there is a variety of open-source honeypot software available on the market, you don’t need to employ honeypot solutions to learn how to better secure your systems. A honeypot is an invitation to attack, and no matter how well the decoy system is disguised, it can still carry some level of risk.
Delinea’s Infrastructure Access Platform includes security features like pervasive auditing, credential and secret management, identity federation, log management, and data protection that make honeypots unnecessary. The platform is built on the SOC 2 Type 2 security framework and certified by an independent audit firm to further establish trust and credibility in the platform’s security.
Because security doesn’t begin or end in the cyber world, Delinea also subjects all its new hires to background checks and provides security training for all its employees and contractors. Additional measures include frequently reviewing permissions and accounts and planning for any contingencies that could disrupt normal business operations.
With a secure platform, people, and processes, you don’t need honeypot security products to identify threats and attackers and secure your organization.
While there are some advantages of honeypot security that may be tempting, honeypots aren’t without risk and they can be a significant drain on resources. As hackers get smarter and savvier, honeypots have to as well, putting a burden on researchers and cyber professionals to stay one step ahead.
Instead of strengthening your network and data security using a honeypot system, you can secure your infrastructure, network, and apps with Delinea’s Infrastructure Access Platform—built with and supported by the highest security standards that keep hackers out.