| A honeypot simulates multiple platforms and services used to attract and contain the attackers.
To the attacker, it appears to be part of a production network providing services. A honeypot can be one or more hosts deployed within a DMZ or screened subnet. Honeypots can be used for surveillance, as an early-warning tool, to discover security weaknesses, and to help assess threats. They also will tie up an attacker's resources as they burn time and effort. Honeypots should have no production value, and should not see any legitimate traffic or activity. Whatever they capture is malicious or unauthorized traffic. This requirement is applicable to network devices such as firewalls and is not applicable to the routing function. |
