Honeypot
Also known as: honeypots, decoy system
A honeypot is a decoy system, account, file, or service designed to look valuable to attackers but serve no real business purpose.
Since legitimate users have no reason to touch it, any activity is a strong sign of an intruder. Honeypots alert defenders early and reveal attackers' tools and techniques. While honeypots generate very few false alarms, they need careful setup so attackers can't use them as a stepping stone into real systems.
Honeypot, explained at three levels
At home
A honeypot is like leaving a fake wallet as bait to catch a pickpocket. It looks valuable, but it's really a trap that alerts you when someone takes it.
At work
Honeypots give organizations early warning that an attacker is inside the network, with very few false alarms.
At home
Security teams create fake servers, user accounts, or files with tempting names like 'passwords.xlsx.' Nobody legitimate should open them, so any access triggers an alert.
At work
Low-interaction honeypots emulate services for detection; high-interaction honeypots are real systems that capture detailed attacker behaviour. Honeytokens, such as fake credentials or API keys, alert when used anywhere.
At home
Some researchers run honeypots on home internet connections to study attacks. In my opinion, that's a fun learning project, but keep it fully separate from your real devices.
At work
Design honeypots to blend in with real assets, isolate them to prevent pivoting, integrate alerts into the SOC, and review legal considerations for data captured. Decoy credentials planted in memory or directories can catch credential theft and lateral movement early.
Real-world examples
At home
Marcus, a hobbyist in Victoria, set up a simple honeypot on a spare Raspberry Pi. Within hours, it logged hundreds of automated attempts to guess passwords from around the world.
At work
Fatima leads security at a Canadian insurance company. She planted fake admin credentials on servers; when an attacker tried using them, the alert gave her team hours of early warning.
How it compares
| feature | Honeypot | Firewall |
|---|---|---|
| Purpose | Lure and detect attackers | Block unwanted traffic |
| False alarms | Very rare | Not applicable, rule-based |
| Catches insiders | Yes | Rarely |
| Prevents attacks | No, detects them | Yes |
Firewalls keep attackers out. Honeypots catch the ones who got in.
For analysts
I'd consider decoy accounts and files as a low-cost detection layer. Any alert from them is worth investigating immediately, since no legitimate user should ever trigger one.
History & origin
In 1986, astronomer and systems administrator Clifford Stoll at Lawrence Berkeley National Laboratory tracked a hacker by creating fake files about a non-existent military project to keep the intruder online, a story told in his 1989 book 'The Cuckoo's Egg.' Bill Cheswick described luring an attacker into a 'jail' at AT&T Bell Labs in 1991. Lance Spitzner founded the Honeynet Project in 1999 to research attackers using networks of honeypots. Commercial 'deception technology' products spread in the 2010s, deploying decoy credentials, servers, and documents across enterprise networks. Researchers also use internet-wide honeypots to track botnets and new exploits. In my view, honeypots are one of the most cost-effective ways to catch attackers who are already inside.