What is a Honeypot?
Honeypots, told as a story about a shiny fake vault that nobody real ever uses.
Thieves wander around looking for treasure.They knock on every door, looking for one that opens.
The watchers' bells ring for cats, too.Cat or thief, someone has to go and look every time. It's what wears the guard room out.
A honeypot is a shiny fake room that nobody real uses.Real people have no reason to go there. If that door opens, it's a thief — no question.
Everything the thief does gets written down.Which tools, which drawer first. That becomes wanted posters and the watchtower friend's notes. And if the fake key is ever used anywhere, another bell rings.
The bait room must be kept apart from the real castle.If the bait room joins the real hallway, you've handed the thief a foothold — split the hallway. And if it's too obvious, no thief comes. It catches; it doesn't block.
A honeypot = a shiny fake room nobody real uses. If its door opens, it's always a thief — and everything the thief does gets written down.
A fake key is a honeytoken; a whole fake castle is a honeynet. The bell almost never lies — that's the point. It's a tool for catching and learning, not for blocking.
When grown-ups say it
- Honeypot
- The fake room. Looks real, but nobody real ever uses it.
- Honeytoken
- The fake key. A fake file like vault-key.txt. Used anywhere, it rings a bell.
- Honeynet
- The fake castle. Not one room — a whole castle as bait.
- Low · high interaction
- Just a door · furnished inside too. A door alone is cheap and safe. Furnish it and you learn more — but risk more.
- Deception technology
- Bait everywhere. Fake rooms, keys and ledgers scattered across the castle.
- No false positives
- Opened means thief. Cats don't visit fake vaults. → the guard room's cat
- TTP collection
- Learning habits. The routine the thief shows in the bait room. → the burglar's habit
- Isolation
- Kept apart from the real castle. No road from the bait room into the real hallway. → the hallway split by ribbons