In short
A honeypot is a decoy system set up to attract attackers, so security staff can detect intrusions, study attack methods and divert attackers from real systems.
Key takeaways
- Any activity on a honeypot is suspicious, because legitimate users have no reason to use it.
- It must be isolated so attackers can't use it to reach real systems.
- Honey tokens, such as fake credentials, work on the same principle.
Where it's tested
ISC: Incident Response & Monitoring — study notes, a five-minute revision sheet and practice questions.
Practise: 3 questions
Question 1 of 3 · 0 answered
A company can tolerate losing at most 15 minutes of transaction data in a disaster. Which metric does this define, and what does it drive?