Honey-Pot Trap For Hackers
Introduction
A honeypot is a security mechanism that creates a virtual trap for attackers. They are used to study attacker behavior patterns.
You can apply a honeypot to any computing resourse from software and network to file servers and routers.
Honeypot Are Divided Into Two Parts
- Production Honeypots:-
It's a low interaction honeypot by which we can collect limited information about the hacker.
- Research Honeypots:-
Those are advance honeypot which is set up to retrieve the information of the Black Hat Hacker.It is mainly used by the Govt. Organizations.
Types Of Honeypot Deployments
- Pure Honeypots:-
Complete production system that monitor attacks through bug taps on the link that connects the honeypot to the network
- Low-Interaction Honeypots:-
They offer a method for collecting data from blind attacks such a botnets and worms malware.
- High-Interaction Honeypots:-
Complex Setups that behave like real production infrastructure. they don't restrict the activity of cybercriminal, providing extensive cybersecurrity insights.
Several Types Of Specialized Honeypot Technologies
- Malware Honeypot
These are honeypot that mimic malware attack vectors.
- Spam Honeypoy
These can detect the methods of spammers, monitor their activity and block spam.
- Database Honeypot
These create decoy database to mislead attackers using method that are somtimes missed by firewalls.
- Client Honeypot
These activity seek out malicious servers behind client attacks instead of passively waiting for connections.
Honeypot Limitations
- The honeypot cannot detect security breaches in legitimate system and it does not always identify the attacker.
- There is also a risk that, having successfully exploited the honeypot, an attacker can move laterally to infiltrate the real production network.
- To help scale your security operations, you can combine honeypots with other techniquies.
Honeypot: A Network Of Honeypot
A honey-net is a decoy network that contains one or more honeypots.
Advantages Of Honey Net
- It looks like a real network and contains multiple systems but is hosted on one or only few servers, each representing one environment.
- Any system on the honeynet may serve as a point of entry for attackers.
- The honey-net gathers intelligence on the attackers and diverts them from the real network.
- The advantage of a honey-net over a simple honeypot is that it feels more like a real network.
