Types of Honeypots

Interaction levels define the hacker’s degree of interactivity with the systems that they’re attempting to infiltrate. “Pure” honeypots mimic the full-scale production environment and run on servers with live, faux “sensitive” data. They’re the most complex honeypot systems to deploy and are challenging to maintain. Some other options include:

High-Interaction Honeypots

These honeypots imitate real-world systems and applications with actual services, functions, and operating systems involving high levels of interactivity (though less than pure honeypots). Setting up high-interaction honeypots is a complex and resource-intensive process. It gives extensive details about how an attack progresses and how payloads execute in a network. However, since there are actual operating systems and services involved, the chance of infection is higher if the hackers are able to compromise the honeypots and use them gain access to your organization’s real production environment.

Medium-Interaction Honeypots

As the name suggests, medium-interaction honeypots fall between high and low interaction honeypots. They come with expanded capabilities compared to low interaction honeypots but reduced implementation complexities than high interaction honeypots. They imitate the application layer but don’t have their own operating system. Organizations typically deploy these types of honeypots to stall attackers to give them time to respond to attacks.

Low-Interaction Honeypots

Low-interaction honeypots allow partial interaction with systems since they run limited emulated services with restricted functionality as would be typically expected from a server. Though these are the easiest to set up and maintain, they run the risk of coming across as inauthentic targets to potential attackers. These types of honeypots serve as an early detection mechanism, and organizations commonly use them in production environments.