If you’re planning on taking the Security+ exam, you should have a basic understanding of honeypots and honeynets.
For example, can you answer this question?
Q. A security company wants to identify and learn about current and new attack methodologies. Which of the following is the BEST choice to meet this objective?
A. Pen test
B. HIDS
C. Honeypot
D. Firewall logs
More, do you know why the correct answer is correct and the incorrect answers are incorrect?
Answer and explanation at end of this post.
Honeypots
A honeypot is a sweet-looking server—at least it’s intended to look sweet to the attacker, similar to how honey looks sweet to a bear. It’s actually a server that is left open or appears to have been sloppily locked down, allowing an attacker relatively easy access. The intent is for the server to look like an easy target so that the attacker spends his time in the honeypot instead of in a live network. In short, the honeypot diverts the attacker away from the live network.
As an example, a honeypot could be a web server designed to look like a live web server. It would have bogus data such as files and folders containing fabricated credit card transaction data. If an organization suspects it has a problem with a malicious insider, it can create an internal honeypot with bogus information on proprietary projects.
Honeypots typically have minimal protection that an attacker can easily bypass. If administrators don’t use any security, the honeypot may look suspicious to experienced attackers and they may simply avoid it.
Security personnel often use honeypots as a tool to gather intelligence on the attacker. Attackers are constantly modifying their methods to take advantage of different types of attacks. Some sophisticated attackers discover vulnerabilities before a patch is released (also known as a zero-day exploit, or zero-day vulnerability). In some cases, security professionals are able to observe attackers launching zero-day vulnerability attacks against a honeypot.
Honeypots never hold any data that is valuable to the organization. The data may appear to be valuable to an attacker, but its disclosure is harmless. Honeypots have two primary goals:
- Divert attackers from the live network. As long as an attacker is spending time in the honeypot, he is not attacking live resources.
- Allow observation of an attacker. While an attacker is in the honeypot, security professionals are able to observe the attack and learn from the attacker’s methodologies. Honeypots can also help security professionals learn about zero-day exploits, or previously unknown attacks.
The 601 Version of the Study Guide
The CompTIA Security+: Get Certified Get Ahead: SY0-601 Study GuideEach of the eleven chapters presents topics in an easy to understand manner and includes real-world examples of security principles in action.
You’ll understand the important and relevant security topics for the Security+ exam, without being overloaded with unnecessary details. Additionally, each chapter includes a comprehensive review section to help you focus on what’s important.
Over 300 realistic practice test questions with in-depth explanations will help you test your comprehension and readiness for the exam. The book includes:
- A 75 question pre-test
- A 75 question post-test
- Practice test questions at the end of every chapter.
Each practice test question includes a detailed explanation to help you understand the content and the reasoning behind the question. You’ll be ready to take and pass the exam the first time you take it.
If you plan to pursue any of the advanced security certifications, this guide will also help you lay a solid foundation of security knowledge. Learn this material, and you’ll be a step ahead for other exams. This SY0-601 study guide is for any IT or security professional interested in advancing in their field, and a must-read for anyone striving to master the basics of IT security.
Honeynets
A honeynet is a group of virtual servers contained within a single physical server, and the servers within this network are honeypots. The honeynet mimics the functionality of a live network.
As an example, you can use a single powerful server with a significant amount of RAM and processing power. This server could host multiple virtual servers, where each virtual server is running an operating system and applications. A physical server hosting six virtual servers will appear as seven systems on a subnet. An attacker looking in will not be able to determine if the servers are physical or virtual.
The purpose of this virtual network is to attract the attention of an attacker, similar to how a single honeypot tries to attract the attention of an attacker. As long as the attacker is in the honeynet, the live network isn’t being attacked, and administrators can observe the attacker’s actions.
Sun Tzu famously wrote in The Art of War, “All warfare is based on deception,” and “Know your enemies.” Cyberwarfare is occurring daily and security professionals on the front lines of network and system attacks recognize that these attacks mimic warfare in many ways. Honeypots and honeynets provide these professionals with some additional tools to use in this war.
Remember this
Honeypots and honeynets attempt to divert attackers from live networks. They give security personnel an opportunity to observe current methodologies used in attacks, and gather intelligence on these attacks.
Q. A security company wants to identify and learn about current and new attack methodologies. Which of the following is the BEST choice to meet this objective?
A. Pen test
B. HIDS
C. Honeypot
D. Firewall logs
C is correct. A honeypot is a server designed to look valuable to an attacker and can help administrators learn about zero-day exploits, or previously unknown attacks.
Security personnel perform a pen test (or penetration test) to determine if attackers can exploit existing vulnerabilities, but attackers may not try to do so.
A host-based intrusion detection system (HIDS) attempts to detect intrusions on an individual host, but may not catch new methods against the network.
Firewall logs can log connections, but don’t identify new attack methods.
