What Is a Honeypot?

A honeypot is a trap used to lure hackers or cybercriminals. The name comes from espionage — spies who use romantic relationships to steal information set “honey traps” or “honeypots.” In cybersecurity, honeypots work in a very similar way.

Honeypots are set up to look like vulnerable networks and lure hackers. If a cybercriminal does take the bait and tries to launch an attack, the company or analyst that set the trap can figure out the hacker’s identity and learn about their method of attack.

They can be an extremely useful tool for cybersecurity and protection online, especially for companies. Let’s take a closer look at how they work.

How do honeypots work in cybersecurity?

The point of a honeypot is to lure in a cybercriminal, so they’re set up to be appealing. Hackers like to go after computer systems that contain a lot of sensitive information, aren’t secure, and resemble a legitimate system. A fake online banking or bill pay system is a good example of a honeypot.

Once the trap is set, cybersecurity analysts can monitor it. They can watch traffic coming to it and see which points of entry are used most often or what tools hackers might use to try and gain access.

Analysts can use this information to improve security of their legitimate systems. If they use a fake online bill pay system, for example, they can see how hackers get in and then make the appropriate changes to the real bill pay system.

Types of honeypots

Honeypots have varied uses. The two main purposes are for research and production.

Research honeypots

With research honeypots, network administrators are primarily gathering information. They study how hackers attack to learn better ways to shore up their system security. Using a honeypot can also help admins discover software vulnerabilities they may not have otherwise detected.

Production honeypots

Production honeypots are decoys. They’re usually internal, and they’re placed to draw attention away from real targets. They primarily distract hackers from the real computer system and aren’t used as much for gathering intel.

What honeypots are used for

The two main purposes of creating a honeypot in cybersecurity are for gathering information or distracting cybercriminals from a real target. But they can be implemented in several ways, including:

• Email: Fake email addresses that attracted automated email spam
• Databases: A fake database that attracts attackers so a security team can flag vulnerabilities
• Malware: Copies of software apps and APIs to attract malware
• HoneyBots: Honeypots that don’t stay in one place and interact with hackers to seem more real
• Spider honeypots: Web pages that are only accessible to automated web crawlers (also known as “spiders”) and not accessible by real users

Are honeypots illegal?

Technically, honeypots aren’t illegal. Some would argue that they’re unethical, though. They’re meant to be a protective measure to keep organizations and computer systems safe. But sometimes they can end up harming innocent parties by enticing someone who isn’t a hacker.

If a non-hacker visits a website because they think it’s real, could gathering their information be an invasion of privacy? One response to this question is that innocent people don’t end up finding honeypots if they’re not trying to hack anything, so honeypots are ethical.

But another argument is that luring a hacker could be considered entrapment. Collecting their information without them knowing might not be legal. For organizations that want to use honeypots for their security systems, it’s crucial that they follow the privacy laws in their jurisdiction, such as the General Data Protection Regulation (GDPR) in the European Union.

Advantages and disadvantages

Honeypots have a lot of benefits for IT security, and they’re used often by security teams. They have some risks as well, though. It’s important to consider both sides before deciding to use a honeypot.

Advantages

• Protection from hackers: Combined with other security measures, they can help organizations protect themselves from cyberattacks.
• Internal and external threats: Firewalls can only detect external threats; honeypots can identify both internal and external threats.
• Gather info about attackers: They let you see where your vulnerabilities are to get information about how hackers behave.
• Incident response testing: Setting up a honeypot is a great way to test your IT security team to see how they would react to a breach.
• Easy to use: Honeypots are relatively easy to set up and don’t take many resources to maintain.

Disadvantages

• Static: Honeypots usually don’t interact with hackers, so they can often see that it’s a trap.
• No detection for real systems: Honeypots don’t help you know if a hacker is attacking your legitimate computer systems, only your fake one.
• Not foolproof: More sophisticated hackers can use a process called fingerprinting to help them know when a system is a fake.

A useful cybersecurity tool

Although there are risks and questions of ethics associated with honeypots, they’re ultimately an effective security tool. It’s true that hackers are coming up with ways to know whether they’re inside a honeypot or not. But cybersecurity professionals are also developing methods to counter hackers, such as developing the dynamic HoneyBot.

Even if you’re not a system administrator or IT security analyst, it’s still good to know what a honeypot is and what it’s used for. If you want actionable steps you can take to keep hackers out of your online life, read our guide.