Honeypot

A honeypot serves no business function and has no authorized users other than its administrators, so all activity directed at it is considered suspicious. Defenders log and analyze that activity to find indicators of compromise for a possible past or future attack against other systems. Attackers who scan and attack a honeypot give administrators data on new trends and attack tools, particularly malware. MITRE D3FEND lists honeypot as a synonym for a decoy environment, meaning hosts and networks set up to deceive an attacker.

Decoy environments differ in how close they sit to production. A standalone honeynet is not connected to any production systems; it is the lowest-risk option, but significant extra effort is needed to make it look realistic. A connected honeynet sits on the enterprise network and emulates certain services or parts of an operating system without exposing full access to a production system, and it may not offer enough functionality to detect new attack patterns or zero-day exploits. An integrated honeynet places decoys in a production environment and allows full interaction, which gives a complete view of an attack, but an attacker who controls one of its systems could try to attack other connected hosts.

A honeypot is a supplement to other security controls such as intrusion detection and prevention systems, not a replacement for them. NIST recommends that qualified incident handlers and intrusion detection analysts manage honeypots, and notes that their legality has not been clearly established, so organizations should study the legal implications before deploying one.