What is Honeypot | Types of Honeypot | Advantages and Disadvantages of Honeypot | cyber security

What is Honeypot?

Honeypot is a network-attached system that is used to trap hackers and cyber-security attackers to dig out and study the methods and types of attacks used by the attacker. It acts as a potential target on the internet and informs the companies or security department about any unauthorized access to the information system.

Honeypots are mostly used by big organizations and companies involved in cybersecurity. It helps cybersecurity protectors to gain knowledge about the different types of attacks used by hackers. It is suspected that even the hackers use these honeypots to decoy researchers and spread wrong information.

Types of Honeypot:

1)Purpose:

• Research 
• Production  

2)Interaction:

• Low
• Medium
• High  

1)Purpose

• Research Honeypots: The research type of honeypot used by researchers to analyze attackers attacks and provide different ways to prevent these attacks.

• Production honeypots: Production honeypots are developed to deployed in production networks along with the server. These honeypots act as a frontend trap for the hackers/attackers, consisting of wrong information and giving time to the administrators to increase the security and improve any vulnerability in the actual system.

2)Interaction

• Low interaction honeypots: Low interaction honeypots provide very little insight and control to the attacker or hacker about information of the network. It pretends only the services that are frequently requested by hackers or attackers. The main OS(Operating System) is not involved in the low interaction honeypots and therefore low interaction honeypots are less risky. They need very short resources and are easy to deploy. The only disadvantage of low interaction honeypots lies in the fact that experienced hackers can easily track and identify these honeypots and can avoid them.

• Medium Interaction Honeypots: Medium interaction honeypots permit more activities to the cracker/hacker as compared to the low interaction honeypots. Medium Interaction Honeypots can expect certain activities and they are developed to give certain responses beyond what a low-interaction honeypot would give.

• High Interaction honeypots: A high interaction honeypot provides a maximum number of services and activities to the cracker/hacker. In high interaction honeypot wasting the time of the cracker/hackers and trying to get complete information about the hackers. High interaction honeypot involves the real-time OS(Operating System) and if the hacker identifies the honeypot then this is comparatively risky. High interaction honeypots are complex to implement and very costly. But the major benefit is , it provides us with extensively large information about crackers/hackers.

Advantages of honeypot:

1. High Interaction honeypots help to collect real-time data.
2. High Interaction honeypots act as a rich source of information
3. High Interaction honeypots increase security.
4. High Interaction honeypots Identify malicious activity even if encryption is used.
5. High Interaction honeypots Waste hackers’ time and resources.

Disadvantages of honeypot:

1. Require more time to deploy, maintain and analyze
2. Easily detectable by skilled hackers
3. Can only capture known attacks.
4. Very limited logging abilities.