A honeypot is a security tool that allows you to attract possible attackers in an isolated environment, where they cannot do any harm to the network. Honeypots are controlled environments in which you can analyze the attackers’ behavior and gather information on the types of techniques they are using to get into the network.
Modern attacks are almost always automated, using a series of scripts to try different methods of accessing resources. If you are using a honeypot, you can see the exact techniques that are used and you can use that information to protect the network.
Honeynets are chains of honeypots on the same network or extended between networks. These allow you to gather more information that can be correlated to provide more insight on the attacker’s activity.
| Note: Honeypots are usually placed in network segments isolated by firewalls to minimize the chances of an attacker getting access to the real internal network.
|