What is a honeypot in cyber security?

Introduction

Cyber security professionals or experts always work to improve the system, network and application security. Going with the trend, they always put up measures dealing with the latest cyber criminals and attacks. The saying "prevention is better than cure" is applicable in cyber security too. By keeping this in mind, experts develop some software to trap cyber-attacks and criminals. Honeypot is one of the latest examples, which is utilized to intrude the cyber criminals. This tool captures the bad actors and gathers information about their data-gathering tools. This valuable information helps them or the organization to improve security measures to fight against future attacks.

Definition

An organization's honeypot helps them access the latest trends in attacks, detect and understand where the cyber-attack arises, and frame the best security policies to mitigate future risks.

Honeypot is a trap for bees and bears in storybooks, but in cyber security, it is a trap for cybercriminals. Honeypot can be intended as bait for cyber attackers because it is a defensive computer system designed to weaken the intruder's courage. When cybercriminals hungrily mine system data and infiltrate the system by using honeypots, cyber security experts waiting behind the smokescreen notice and study the intruder's tools, tactics and procedures.   

Types of honeypots

Some of the complexities of honeypot

• Pure honeypot
  It is a full-scale production mimicking system that runs on various servers. It is full of sensors, including user information and confidential data, so it is difficult and complex to maintain. The data or information provided by them is invaluable.

• High-interaction honeypots
  Designed to interact with the real-world application and system with actual functions, services, and operating systems involve a high level of interactivity but less than pure honeypots. This setting gives extensive details on how payloads are executed and how an attack progresses in a network. It's a complex and resource-intensive process of setting up high interaction honeypots because actual operating systems and services are involved. Still, it also increases the chance of infection where hackers can compromise the honeypots in which they gain access to the organization's real production environment.

• Medium interaction honeypots
  As the name depicts, it falls between high and low interaction honeypots. It includes activities and is designed to give certain responses beyond a low interaction honeypot would give.

• Low-interaction honeypots
  It is called law interaction because operating systems are not involved in this and are easiest to set up and maintain, making it less risky. Organizations use them in production environments as they run limited emulated services with restricted functionality, as a server would typically expect. 

Kinds of honeypots

• Decoy database honeypots
  Network security experts create a decoy database to identify exploits and study flaws in data-driven applications to abolish and prevent such malicious code. Hackers attack the database by using SQL injection code (injection procedure) to attack databases.

• Spider honeypot
  Web crawlers are an issue in cyber security. Therefore security experts use honeypots to trap them by creating fake pages and linking the reachable by crawlers. Due to this detection, security experts can block bot activity that can be harmful.

• Client honeypot
  Client honeypot acts as a server by engaging with malicious servers that attack clients (for listening in for incoming connections). They act as a client to monitor and record any modification in the system.  

• Malware honeypot
  Malware honeypots detect malware based on propagation vectors and replication techniques. It encourages malware attacks, and data from them are used by cyber criminals to develop advanced antivirus software for windows and Mac technology. It is a robust antivirus. It is used in malware detection technology to study malware attack patterns.

• Email traps honeypots
  It acts as a database or a record keeper of all the email addresses used by email service providers to detect spammers. For this purpose, an email account being inactive for a long period is used.

Working of honeypot

Honeypot is not an original operating system, but it looks like a genuine computer, including data and applications used by criminals to identify an ideal target. This system draws the attention of the hacker or attacker by pretending to be a system containing sensitive customer data like personal information of the customer, credit-debit card details etc.

This is decoy information searched, stolen and sold by a hacker in the market without knowing that cyber security experts are observing them.

The IT team observes the hacker's attacking method, technique, and how the system defences hold up or fail. The honeypot method is used to strengthen the overall defences of the system and network used to protect them.

It directly can't prevent the attack. Therefore, it is different from other security measures. Rather, it acts as a refinery to the organizational intrusion detection system (IDS) and threat response to place its security in a better position to manage and prevent the attacks.

The honeypot uses security vulnerabilities to lure in attackers like vulnerable ports as a decoy system.

A Port scanner is used to discover the network's open ports, which may entice an attacker. When an attacker exploits that port, the security team observe how the hacker approaches it (its attack).

According to purpose, honeypots are of two types:

• Research honeypot
  Researchers use these deployed honeypots to understand better the registered attack motivations, techniques, security vulnerabilities and information about malware strains in the wild. This research is also helpful in gaining information and making formal decisions about patching prioritization, defence strategies, identifying & developing new security solutions and future security investment.

• Production honeypot
  Production honeypots are designed and implemented in the organization's internal network with other production servers. These are less complex than research honeypots with lesser data but have the same motive of gaining insight into active attacks on the internal network. It primarily distracts or misdirects hackers from attacking your legitimate servers.

Merits of using honeypot

It doesn't mean that using a honeypot in the network system will replace or fulfil the need of other traditional security controls like IPS (intrusion prevention system), firewall, and IDS (intrusion detection system). Instead, they add an extra privilege to the existing system by providing highly specific information. Some of the benefits are as follows:

1. Honeypot provides great visibility of the happening of the attack.
2. It can distract cyber criminals so that they cannot target legitimate systems.
3. It helps in detecting zero-day vulnerabilities and also monitors attackers' behaviour.
4. It helps in improving the overall security of an organization
5. It tests the organization's incident response capabilities
6. The number and location of threat actors can be determined by using honey potting
7. Honeypots are used in an organization to ascertain the skill level of potential online attacker
8. For a better understanding of the tools, techniques and procedures of attackers

Demerits of using honeypot

1. Cybercriminals can also use honeypot to forward bad intelligence
2. A hacker can use an attack from a decoy system on another system in a network to deal with honeypot
3. When honeypot is the only source of intelligence, then its use can result in myopic vision
4. Honey pot can be spoofed by cybercriminals, which can result in false positive

Conclusion

It is concluded that honeypots are sugar-coated traps for the attackers to analyze their tools, techniques and ways of attack to enhance the security measures. Therefore, honeypots are one of the components of a comprehensive cyber security strategy, but cybercriminals can also use them by providing misinformation to the honeypot. It may hide their identity while confusing the algorithm and machine learning models utilized to analyse activities.

It's difficult for an organization to deploy monitoring, detecting, identifying and remediation tools and preventive measures to protect the organization.

 The honey wall is used to limit the entry & exit points (ports) for all honeypot traffic is an important aspect of honeypot design. To handle the network issues, "honeynet” is designed to contain one or more honeypots. A real network contains multiple systems but is hosted by a single or few servers. Honeynet topology looks like this:

 Honeypot provides some additional benefits such as:

• Ease of analysis
• Internal threat detection
• Ongoing evolution