Take the 2-minute tour ×

I'd like to know where a Honeypot falls into the scheme of security, and if it is still an effective tool?

share|improve this question
security.rbaumann.net/download/diplomathesis.pdf i found this pdf which may usefull to you –  BlueBerry - vignesh4303 Aug 24 '12 at 5:10
add comment

1 Answer

up vote 3 down vote accepted

Typically a honeynet is used as a defensive tool and is used to (sort of) trap attackers. It is designed to fool them into thinking they are on a real system (though most good attackers can quickly detect it's a honeypot). By fooling the attacker, the "honeypot owner" is hoping to learn more about the attacker's motives and techniques. The honeypot is designed to be compromised but should not be placed anywhere in the infrastructure such that it can be used a staging or pivot point for further compromising of the "real" environment.

A lot of folk talk about "Defence in Depth" quite a bit and the honeypot is another facet of that and is designed to complement the other layers. Like attackers evolving, honeypots have evolved and changed also (the usual "arms race").

Technically speaking, a honeypot can be used as an offensive tool (for educational purposes) whereby a person wants to learn how to attack and exploit box, however, as I previously said it's more commonly used as defensive mechanism.

Regarding its viability or relevance today, there has been much discussion and there've definitely been issues with honeypot techniques and deployments but I still believe that honeypots are relevant, a great source of information and if used correctly, can enhance the security of your environment.

I don't like giving Wikipedia links but this one does define honeypots pretty well.

I also recommend reading about the Honeynet Project, it's absolutely awesome - they do fantastic challenges, give back amazingly to the community, participate in the Google Summer of Code and have some awesome technical papers.

share|improve this answer
add comment

Your Answer


