All right, so the honey pot
is not a legitimate resource.
It's a trap.
It's an emulation of production system, but it's not real.
So any interaction with the honey pot
is automatically suspicious because it's not real.
It's set up to attract and trap people who
attempt to penetrate the organization's network.
It emulates legitimate services.
It may monitor an attacker's key strokes,
but it can log port access attempts and so forth.
So you're going to be configuring a utility called Honeybot in the lab.
You get a good feel for how Honeybot works.
Our types of honey pots are based on their design criteria.
Low interaction versus medium interaction versus high interaction.
Limited number of services, more services, and the most services.
Simulate all network services and applications of a target network.
Simulate a real operating system with medium.
Simulate a number of services and application.
Depending on what it emulates, makes it low, medium, or high.
Application, Host, N etwork.
Pure honey pots.
Pure Honeypots will actually...
Pure Honeypots will actually emulate a real production network.
So you can actually do a P2B conversion or V2B conversion of legitimate network
resources and stand up identical clones in a different subnet.
And the whole idea of the honey pot is
that the attackers get drawn to it versus the live system.
And typically you make them look somewhat easy to compromise, maybe.
We'll call them low hanging fruit sometimes, but attackers are drawn to
targets that are least resistant to compromise or exploitation.
So if I was to emulate a design flaw or
something that's easily detected by an attacker, one of the mantra in pen testing
is if it looks too good to be true, it's probably a honey pot.
It's probably exercise caution.
All right, so the honey pot.
The production honey pot is deployed
inside the production network, along with other production servers, and
then research honey pots are put out for research.
Not to just reorder the name.
Deployed by research institutes, governments, or military organizations to
gain detailed knowledge about the actions of an intruder.
We're using them to detect different types of techniques and attacks in the wild.
Pretty cool.
Our honey pot tools, like I said, you're
going to be doing a lab on honey bots in your lab exercises.
That'll give you a pretty good feel for honey pot configuration.