Honeypots and Honeynets
Another method for protecting the environment involves the use of honeypots: machines that exist on the network but do not contain sensitive or valuable data (a number of machines of this kind, linked together as a network or subnet, are referred to as a "honeynet").
4 slides · 2 min read · Domain 7
Honeypots are meant to distract and occupy malicious or unauthorized intruders as a means of delaying their attempts to access production data/assets.
Honeypots also provide the organization an opportunity to observe the attack as it is happening (without appreciable risk to the organization) so as to better determine the nature of the attack, possibly identify the attacker, and assess the tools and skill of the attacker, as well as gather evidence for use later in legal action or law enforcement response.
Typically, honeypots are placed in the network demilitarized zone (DMZ) and should mimic the architecture of an actual environment, as well as contain simulated assets that mimic the content of a production environment.
The attacker should presume this is a live part of the actual network. Some managed service providers offer entire simulated networks as honeypots with significant breadth (hundreds of simulated devices) and granularity (including fake user accounts and credit card data).
Honeypots and or honeynets are NOT to be considered a means to lure or attract the attention of malicious actors
Even using that language can degrade the organization's ability to successfully prosecute and or litigate: if a device and or application is connected to public-facing infrastructure with the intent to draw someone to it, then, legally, anyone visiting that device and or application will have a strong defense against accusations of illegal incursion.
A simple analogy: you cannot invite someone onto your property and then have them arrested for trespassing.
In almost all jurisdictions, "hackback" (the practice of hacking a malicious attacker who has attacked your organization) is illegal, often with severe penalties (for instance, in the United States, it is simply another form of hacking, which is a felony.
There is often a temptation to use information gleaned from a honeypot to assess the attacker's environment or make contact with the attacker; this is unprofessional, unethical, and usually illegal.