Honeypot Basics

HONEYPOTS

HONEYPOTS

BY:-Manoj KumawatR. No. 13075029

HONEYPOTS

• What is honeypot ?

 A honeypot is a computer security mechanism set to detect, deflect or counteract attempts at unauthorized use of information system.

It’s simply a TRAP to attacker.

HONEYPOTS

• How it works ?

A honeypot consists of data that appears to be a legitimate part of the site but is actually isolated and monitored, and that seems to contain information or a resource of value to attackers, which are then blocked. 

HONEYPOTS

HONEYPOTS

Architecture:

•As a bait•Just some regular system•More attractive

HONEYPOTS

HONEYPOTS

• HONEYPOT CLASSIFICATION:By Implementation

• Virtual• Physical

By purpose• Production• Research

By level of interaction• High• Low• Middle?

HONEYPOTS

• IMPLEMENTATION OF HONEYPOT:Physical

• Real machines• Own IP Addresses• Often high-interactive

Virtual• Simulated by other machines that:

– Respond to the traffic sent to the honeypots– May simulate a lot of virtual honeypots at the

same time

HONEYPOTS

• PROPOSE OF HONEYPOT:Research

Complex to deploy and maintain.Captures extensive information.Run by a volunteer(non-profit).Used to research the threats organization face.

ProductionEasy to useCapture only limited informationUsed by companies or corporationsMitigates risks in organization

HONEYPOTS

• INTERACTION LEVEL:• Low Interaction

• High Interaction

HONEYPOTS• LOW INTERACTION VS. HIGH INTERACTION:

HONEYPOTS

• Placement of honeypot

In front of the firewall (Internet)DMZ (De-Militarized Zone)Behind the firewall (intranet)

HONEYPOTS

HONEYPOTS

Honeypot Values:

•Prevention•Detection•Response

HONEYPOTS

Prevention:

•Keeping the burglar out of your house.•Honeypots, in general are not effective prevention mechanisms.

HONEYPOTS

Detection:

•Detecting the burglar when he breaks in.

HONEYPOTS

Response:

•Honeypots can be used to help respond to an incident.

HONEYPOTS