Honeypots: Tracking Hackers

Selecting Locations for Deployment

For a honeypot to be effective, it must be deployed in the correct location. The decision of where to deploy is answered once again by your goals for the honeypot. A production honeypot used for detection may be deployed in one area, while a research honeypot used to learn about attacks may be deployed in another.

Select the architecture that best supports the value you expect your honeypot to return. For example, if your goal is to detect attackers who have penetrated your perimeter, then you would most likely want to place such a honeypot on your internal network behind the perimeter firewalls. However, if your goal is to research how many attack attempts were made against your organization each day (to prove ...