Honeypot

In short: A honeypot is a decoy system deliberately made to look vulnerable, which attracts attackers so their methods can be observed and alarms raised.

In more detail: Real users have no reason to touch the honeypot, so any access is suspicious. That way attackers are detected early and their tools become known.

In Depth

• Interaction level: From low-interaction (simulates only a few services) to high-interaction (a real system under observation).
• Honeytoken: A decoy record, key or file. When used, an alarm fires.
• Form honeypot: A field invisible to humans. Bots fill it in and give themselves away.
• Caution: A honeypot must be cleanly separated from the real network, otherwise it becomes an entry point.
• Benefit: Early warning, research into attack methods, fewer false alarms than broad rules.

See also: Principle of least privilege