What is a honeypot?
A honeypot is a system set up to look like a worthwhile target, such as a file server, database, web application, or SSH or RDP host, that holds no real data and serves no real users. Because nobody has a business reason to touch it, any connection, login attempt or scan against it is suspicious by definition. That gives honeypots high-fidelity alerts: when one fires, it is rarely noise. Honeypots are part of deception technology, along with honeynets, honeyfiles, honeytokens and canary accounts.
Low-interaction vs. high-interaction honeypots
| Low-interaction | High-interaction | |
|---|---|---|
| What it is | Software that emulates services on ports such as 22, 445 and 3389 | A real operating system and applications |
| What it records | Connection attempts and the usernames and passwords tried | Commands, tools, malware and privilege escalation attempts |
| Risk | Low, because there is no real system to take over | Higher, because a real system can be compromised and misused |
| Typical use | Internal detection | Research and threat intelligence |
Placement decides what a honeypot tells you
A honeypot exposed to the internet collects a constant stream of automated scans and exploit attempts. That is useful for research and threat intelligence but noisy as an alert source. A honeypot on the internal network, where nobody should be scanning, is a strong detector of lateral movement after an initial compromise. Two entries from an internal decoy file server identify exactly which workstation to isolate first:
02:14:07 decoy-fs02 smb auth src=10.20.4.117 user=CORP\svc_backup result=fail
02:14:22 decoy-fs02 rdp conn src=10.20.4.117
Decoys have to stay believable. Match naming conventions and operating system versions to the real servers around them, avoid the default banners of well-known honeypot packages, and test the alert path on a schedule, because a broken log forwarder can silence a decoy for months without anyone noticing.
Risks and legal considerations
A high-interaction honeypot can be taken over and used to attack other networks, host malware or send spam. Isolate honeypots on their own segment, restrict their outbound traffic, never join them to the production domain, and never store real credentials or sensitive data on them. Entrapment is often raised, but in the United States entrapment is a defense against inducement by government agents, so an organization passively running decoys on its own network generally isn't entrapping anyone. Monitoring and recording attacker activity can still raise privacy and interception questions that vary by jurisdiction, so legal counsel should review a deployment first.
Honeypot vs. honeynet, honeytoken and sandbox
- A honeynet is two or more honeypots connected into a realistic environment, used to watch an attacker move between systems.
- A honeyfile is a decoy document and a honeytoken is decoy data, such as a fake key or record. Both are bait, not systems.
- A sandbox detonates a suspicious file you already have in an isolated environment. A honeypot waits for an attacker to come to it.
- An IDS looks for malicious activity among normal traffic; a honeypot flags any activity at all.
Honeypot on the CompTIA Security+ exam
Deception and disruption technology sits under SY0-801 objective 4.1, a scenario objective about choosing mitigating controls. Wording such as a decoy server, a system that attracts attackers, learning attacker techniques, detecting lateral movement or alerts with a very low false positive rate points to a honeypot. If the scenario describes several decoy systems on their own segment, the answer is a honeynet. If the bait is a document, a piece of data or a directory account, look for honeyfile, honeytoken or canary account instead. A honeypot is detective, so if a question asks how to prevent an attack, a decoy is not the answer.