What are Honeypots in Cyber Security?

Honeypots in network security are inducing servers or systems that are deployed to systems. They are designed to look like attractive targets, and they get deployed to permit IT teams to monitor the system’s security responses and to redirect the hacker away from their proposed target. A honeypot seems to be a legitimate system and runs the same processes as your actual system would run. It contains decoy files the attacker will see as appropriate for the targeted processes. 

Honeypots are set up on the basis of what your organization needs. They act as legitimate threats, just like a trap, which enables you to identify attacks as early and defend them in appropriate time. It is best to put the honeypot behind the firewall that protects your organization’s network. This helps you to discover threats that get past the firewall and prevent attacks designed to be launched from within a compromised honeypot. Whenever an attack is executed, your firewall, between the honeypot and the internet, can intercept it and eliminate the data.

How do Honeypots Work?

Honeypot looks exactly the same as a genuine computer system. It contains the applications and data that malicious attackers use to identify an ideal target . A honeypot imitates a system that contains sensitive consumer data such as credit card details or other personal information.  The system can be populated with decoy data that may draw in an attacker looking to steal and use or sell it. As soon as the attacker breaks into the honeypot, the IT team can observe how the attacker takes next steps, the techniques used by them and how the system defends them. This is used as a way to strengthen the overall defenses in the network.

Honeypots make use of security vulnerabilities to induce the attackers. They may have ports that are vulnerable to port scan, where it is a way to detect which ports are open on a network. If a port is left open, the attacker may take advantage of it, which is observed by the IT team. 

Honeypotting is a security measure that is not only designed to prevent attacks directly. The purpose of a honeypot is to refine an organization’s intrusion detection system (IDS) and threat response so that it can manage and prevent any further attacks. 

Intensity of Honeypots

• Pure Honeypots: A pure honeypot refers to a full-scale system running on various servers. It wholly imitates the production system. Data is made to look confidential as well as sensitive information, within a pure honeypot. It has a number of sensors used to track and observe the activity of attackers.
• High-interaction Honeypots: A high-interaction honeypot is engineered to lure the attackers to invest most of their time inside the honeypot. This provides more opportunities to the security team to observe the targets and check their intentions. In turn, it helps to discover more vulnerabilities within the system. A high-interaction honeypot may contain extra systems, databases and processes that the malicious attacker will want to try to infiltrate. 
• Mid-interaction Honeypots: Mid-interaction honeypot tries to imitate elements of the application layer, but they do not have any operating system. The purpose is to confuse an attacker or stall them, which will give more time to ascertain how to react to the kind of attack in the scenario.
• Low-interaction Honeypots: Low-interaction honeypots have less resources and help to gather rudimentary information regarding the kind of threat and its origin. These are comparatively simple to set up, and they make use of Transmission Control Protocol (TCP), Internet Protocol (IP), and network services. Generally, there is nothing inside the honeypot to hold the attention of the attacker for a considerable amount of time.

Types of Honeypots

There are various types of honeypots that are used as a security defense on a system and have a common purpose i.e., to trick the attacker into fake network environments and utilize the time to identify the attack and defend them. Some of the kinds are discussed below:

• Spam Honeypot- These types of honeypots are designed to lure the spammers with the use of open proxies and mail relays. Spammers perform tests on mail relays by using them to send an email to themselves. On being successful, they then transmit large amounts of spam. A span trap can identify a spammer’s test and then block the spam they try to send out.
• Malware Honeypot- These types of honeypots make use of attack vectors that are already known to induce in malware. For example, they can imitate a Universal Serial Bus (USB) as a storage device. If a system is attacked, the honeypot fools the malware into attacking the emulated USB.
• Client Honeypot- Client honeypots try to lure in malicious servers which are used by attackers while hacking clients. They look like the clients to notice how an attacker makes changes to a server during an attack. These types of honeypots are generally run in a virtualized environment and have containment protections in place to eliminate the risk of exposure to the researchers.
• Database Honeypot- These types of honeypots are used to decoy databases to lure database specific attacks like SQL injections, that illicitly manages the data. A database honeypot can be executed using a database firewall.
• Honeynet- Honeynets contain a network of honeypots. Several kinds of honeypots form a honeynet, which in turn helps to study several types of attacks, such as distributed denial-of-service (DDoS) attacks, attacks to a content delivery network (CDN) or a ransomware attack. As the honeynet is used to study different kinds of attacks, it contains all traffic, both inbound and outbound. This assists to protect the rest of the systems.

Benefits of Honeypot

Honeypots are an excellent way to enhance the security of the systems. There are several advantages of honeypots that a security team can use to improve network security.

• Test the incident response process- Honeypots are a well efficient way to check how the security team and the system will react to a threat. You can use a honeypot to analyze the effectiveness of your team’s responses towards the attack and how they address any weaknesses in policies.
• Interrupting the attacker kill chain- Often the attackers move through your environment like predators, scan your network and look for vulnerabilities. While they sneak into the system, they may engage with your honeypots. Here, you can trap the attacker inside and observe his behavior. This way, honeypots break down the kill chain by tempting the attackers to invest their time going after the useless information in the honeypot instead of the actual information.
• Straight forward and low maintenance- Honeypots are both easy to execute and effective tools that provide alerts and information about the attacker’s intentions. Thus, you can deploy a honeypot and wait for an attacker to engage with it. You don’t have to monitor constantly and arm it with intel regarding known threats for it to be an effective tool.

Want to start your learning journey on Cyber Security and Ethical Hacking field?