TL;DR
Honeypots are decoy systems designed to attract and study cyberattackers in a controlled environment. By mimicking real hardware, software, and data, they let security teams observe hacker behavior in real time — exposing vulnerabilities, revealing unknown threats, and informing stronger defenses — all without putting production systems at risk. While powerful, honeypots carry risks like misdirection and resource drain, and should be weighed against alternatives like penetration testing.
What is a honeypot?
A honeypot is a piece of hardware or software used to detect or study attacks from hackers. It functions just like a valid piece of equipment. But it's not tied to deeper or sensitive structures within your organization. Any information entered into the honeypot is contained, and all the data is gathered for research and security purposes.
Honeypots are networks or devices designed to look like legitimate systems. They look and feel just like a valid part of a computer network. But these devices are actually hacker bait.
Set up a honeypot, and you can lure hackers into a research environment. You'll watch everything an attacker does, and those insights can help you build an even stronger system for your company.
You can't use a honeypot to block undesired traffic or activity, and no legitimate work should happen on that device. Instead, you'll use it solely to understand how an attack on your system might progress.
Imagine you're asked to defend Utah's state computer systems, which endure as many as 300 million hacking attempts per day. The more you know about the people trying to steal data, the better you can do your job.
You could, in theory, wait for a hacker to tap into a legitimate part of your system. You could watch that person carefully, and you could hope that you'll contain the damage before it goes too far. When the attack is over, you can patch the holes that allowed the breach.
Or, you could use a honeypot to set up an experiment and watch a hacker with virtually no risk.
The very first honeypot study happened in 1991. A hacker gained access to a server, and the administrators watched him carefully for more than a month. Since then, computer experts all around the world have become intrigued with the idea.
The average hacker spends more than 200 days inside a system before discovery. Even with sophisticated tools and processes, you're likely missing signatures of an attack as they unfold. Set up a honeypot, and you'll learn about threats in real-time. That could help you keep the next hacker out altogether.
5 uses for honeypots
Common honeypot types include:
- Database decoys. Some attacks pass through your firewalls, as they come in the form of Structured Query Language (SQL) injection. A honeypot is made to capture these attacks, which allows the real resource to stay functional.
- Malware. Traps look like software apps, and they hope to pull down malware attacks that can be studied and replicated.
- Spider. Web pages made for website crawlers study malicious activity.
- Production. Traps seem like part of a valid network, and they're placed as decoys to protect a company's real resources. A hacker trapped inside a honeypot spends so much time there that the administrators can upgrade defenses on the real asset.
- Research. Data is tagged with identifiers, and when hackers steal that information, it's tracked to connect participants.
What are low-interaction and high-interaction honeypots?
Some of these honeypots use just a tiny amount of resources, and they collect only basic information. These low-interaction honeypots are easy to set up and quick to deploy.
A high-interaction honeypot is more elaborate, and teams hope to ensnare hackers for longer periods for detailed data collection.
| Type | Complexity | Data Collected |
|---|---|---|
| Low-interaction honeypot | Simple; uses a tiny amount of resources | Basic information; easy to set up and quick to deploy |
| High-interaction honeypot | More elaborate | Detailed data; designed to ensnare hackers for longer periods |
Sometimes, researchers take this idea one step further and connect many honeypots in one system that looks a whole lot like a valid network. Honeynets like this provide a wealth of information, and they're almost impossible to separate from real networks.
What are email traps and spam traps?
Researchers also set up email traps or spam traps that work a bit like a honeypot. A bogus email address is created, and it sits in a spot likely visited by hackers. Any email message to that address likely comes from a spammer, allowing researchers to spot and stop those actors from doing their work. Since email traps don't involve a computer or computer network, they're not true honeypots.
How do honeypots work?
All of the elements you'll need in a standard workstation also appear in a honeypot. The more you can mimic a real environment, the more likely you will trick your hackers.
In a common setup, a honeypot contains:
- A web-enabled device. A computer, tablet, or phone.
- Applications. That device must be able to do real work of some sort.
- Data. Information that appears valuable should either be on the device or accessible by it.
- Monitoring. Anything that happens on this honeypot is evidence of hacking.
How is a honeypot isolated from production systems?
A honeypot is typically isolated from the production portion of the network. And it might contain security vulnerabilities attractive to hackers.
What are the risks and benefits of honeypots?
Common benefits include:
| Benefits | Risks |
|---|---|
| Exposed vulnerabilities. Are you absolutely sure that your data is secure? A honeypot allows you to test your setup in real-time. | Decoys. If a hacker manages to discover that you have set up a honeypot, that person could deflect your attention from a real threat happening on your valid servers. |
| Low investment. Basic honeypots don't need a lot of hardware or software. You could have them working in minutes. | Deeper attacks. Mimic your setup too carefully, and a hacker could practice on your honeypot to launch an attack on your valid servers later. |
| New understandings. The data you gather could open your eyes to threats you just didn't know existed. For example, researchers set up a phony manufacturing server to see what hackers could do. One intrepid person managed to shut down the production line altogether, and that seemed very surprising. | Wasted resources. Build an in-depth system, and you could deflect time from your real work. |
If you decide that a honeypot isn't right for you, consider pentesting. You'll take your system through a series of elaborate challenges, and you'll discover how well you perform during an attack. Find out more about this approach in our blog post.
Frequently asked questions
Can a honeypot block hackers from accessing my real systems?
No. A honeypot is a research and detection tool, not a blocking mechanism. It cannot prevent undesired traffic or activity on its own. Its value lies in observing attacker behavior so that security teams can strengthen defenses on their actual production systems.
What is the difference between a low-interaction and a high-interaction honeypot?
A low-interaction honeypot uses minimal resources and collects basic information, making it quick and easy to deploy. A high-interaction honeypot is more elaborate, designed to keep attackers engaged for longer periods to enable more detailed data collection.
What is a honeynet?
A honeynet is a network of multiple interconnected honeypots that together resemble a legitimate network. Because honeynets are so convincing, they are difficult for attackers to distinguish from real infrastructure, making them a rich source of threat intelligence.
Are email traps the same as honeypots?
Not exactly. Email traps, or spam traps, work on a similar principle — a fake email address is placed where spammers are likely to find it, and any messages sent to it are flagged as malicious. However, because they do not involve a computer or network, they are not considered true honeypots.
What risks should I be aware of before deploying a honeypot?
Three key risks to consider are: a skilled attacker may detect the honeypot and use it as a distraction while attacking your real systems; a highly realistic honeypot could allow an attacker to practice techniques they later use against your production environment; and building a complex honeypot can divert time and resources away from core security work.
What is an alternative to using a honeypot?
Penetration testing (pentesting) is a common alternative. It puts your system through a series of simulated attack scenarios to evaluate how well it holds up under pressure, without the ongoing maintenance and risks associated with a live honeypot.
References
NSA Data Center Experiencing 300 Million Hacking Attempts Per Day. The Council of Insurance Agents and Brokers.
An Evening with Berferd in Which a Cracker is Lured, Endured, and Studied. AT&T Bell Laboratories.
Hackers Spend 200+ Days Inside Systems Before Discovery. (February 2015). Infosecurity.
Elaborate Honeypot 'Factory' Network Hit With Ransomware, Remote Access Trojan (RAT), and Cryptojacking. (January 2020). Dark Reading.
