A honeypot is essentially a computer system. In this computer system, there exists some files and directories like any other usual computer system. A honeypot aims to attract an attacker to fall into its trap and investigate his actions and follow his behavior. In fact, a honeypot is not an actual system but an intentionally made fake system.
What are the types of honeypots?
Looking at the aims of honeypots and their levels of interactions, it is possible for us to group them into two main types: Research honeypots and Production honeypots:
Military, research and government organizations mainly depend on these types of honeypots. A huge amount of data is contained in this type of honeypots. These honeypots are familiar with any new threats, and Blackhat motives could easily be recognized through such honeypots. While the main benefit of research honeypots is to understand how a system could become more secure, these types of honeypots cannot give any valuable data about increasing the security of an organization and its vulnerabilities.
These types of honeypots are mainly utilized for the sake of getting an organization to become more protected against any potential attacks. The implementation of such honeypots is performed mainly inside the organization’s production network itself. The aim for them is to help increase the overall security for an organization at the end of the day.
Through such honeypots, a limited amount of data is captured such that honeypots that are lowly interactive are used. In this process, the behavior of an attacker is monitored very carefully by the proper forensics tools, such that any possible risks may be lowered and hence the organization becomes more secure consequently. These types of honeypots are the ones that are mostly used in practice, yet sometimes they may represent a risk for the organization themselves.
One thing that matters about these types of honeypots is where and how they are to be implemented by network administrators. Remember that the implementation of honeypots is essentially within a real network and system. Testing these sorts of honeypots usually yields several unexpected actions or problems.
Consequently, some other systems inside an organization may be put in danger when implementing these honeypots in the network. For an administrator, he should be fully aware that other systems will be possibly misused through the honeypots. As a result of that, he should make sure that all other systems inside the organization are secured enough after deploying the features of the honeypot. Otherwise, some great problem is to be faced by the entire organization eventually.
How to categorize honeypots according to the type of data collection?
There is, in fact, a way to classify honeypots, depending mainly on the type of data that is collected by the honeypot concerning a certain attack. A honeypot can be set up to detect and record one or more types of data: events (things that happen which change something in the honeypot), attacks (attempts by a malicious user to exploit a vulnerability), and intrusions (successful attacks that penetrate the honeypot). There is no judgment over how important a type of data is over another. However, most honeypots can display some information from each data category of the groups as mentioned earlier. In fact, all of these categories are really important for a security administrator to understand an attack and know the vulnerabilities of a system.
Is the usage of honeypots considered legal or not?
There are some legal issues that one should be fully aware of by the time he gets to deploy a honeypot inside an organization network or so. In fact, such legal issues are variant according to the governing rules and according to the country where a honeypot is to be deployed and configured. The regulations determine many different aspects, but mainly they care much about three main aspects which are the security of data, data collection, and the way in which honeypots are used in an organization.
These diverse laws mainly rely heavily on the quality of the data captured by a honeypot and on the person who is implementing and deploying the honeypot inside the network in the first place. The main significant issue when it comes to legalizing the usage of honeypots rely on the type of collected data and the content of it. This makes it harder for someone to determine whether using honeypots is considered a legal aspect. This is because legalizing it or not mainly depends on what the data is intended to be used for after collecting it. This mainly leaves us with several steps that one should carefully consider by the time he deploys a honeypot inside the network.
A lot of questions and approaches should be asked during the experiment as well. Things are no different when it comes to using a honeypot for a company, or for home, yet for a company, there are several other responsibilities that a network administrator should consider and take care of greatly. A network administrator is responsible for both the country laws and the company laws that come next.
It is a must to abide by these laws to remain in legal status. While some companies allow experimenting almost everything inside the company, many more other companies put several restrictions on experimenting such things within the company. By the time a honeypot is deployed, someone has to be sure about the answers of the legality of honeypots inside the company and the country as well. One has to ask the responsible ones to make sure that what he is doing does not violate current rules set by either the country or of course the company. In this regard, there are in fact three main legal issues that should be considered regarding using honeypots. The three are privacy, entrapment and civil liability