These days it is possible to feel completely confident about hacker attacks as long as you have the most effective security in place. But what is the most effective security? How do hackers work? How can you feel completely confident?
Wanna know, then read on
To attack a network, a hacker will need to know as much as possible about it, so gathering all the information they can about the network, technical or otherwise is their first step. Any information can be useful, e.g. how many office branches there are or who their partners are. This kind of information can help them gain perspective on the potential defence systems that may be in place.
Technical information may contain IP addresses in use, services available, etc. More services running on servers means more entry points. More entry points make it easier to get access.
Now as an example if you found SERVER-A with only port 80 open and SERVER-B with ports 21, 25, 80, 110, 143, 443 open on target network, where you will start from? Your obvious choice would be SERVER-B as said more services means more entry points, if you can bypass the security of any entry point you get access, while for SERVER-A, you have only one entry point.
But what if server B was just put there to catch your attention, distracting you from something valuable on the other server? You can install fakes servers with lots of open ports for hackers to attack to ensure the safety of your main valuable servers and as soon as they start attacking the decoy, you can analyse their attack plans and work to counter them. This is called the honey pot method.
Basically, what a honey pot is is effectively a trap designed to detect, distract and generally counter attempts to hack into your servers. Usually its in the form of data or a network that appears to be part of your main system and to contain valuable data, but in fact its isolated and monitored.
Honey pots can however carry risks to your network and if they're not properly isolated, hackers can use them to infiltrate your system. There are different types of honey pot and you can differentiate between them simply by the circumstances under which they're used. They can be either:
Production Honey Pots Research Honey Pots
Production Honey Pots: Easy to use, capture limited information, used mainly by corporations and companies.
Research Honey Pots Usually run by voluntary workers or institutions of IT education in order to collect more and more information about the tactics of modern hackers to develop better defence systems.
Wanna know, then read on
To attack a network, a hacker will need to know as much as possible about it, so gathering all the information they can about the network, technical or otherwise is their first step. Any information can be useful, e.g. how many office branches there are or who their partners are. This kind of information can help them gain perspective on the potential defence systems that may be in place.
Technical information may contain IP addresses in use, services available, etc. More services running on servers means more entry points. More entry points make it easier to get access.
Now as an example if you found SERVER-A with only port 80 open and SERVER-B with ports 21, 25, 80, 110, 143, 443 open on target network, where you will start from? Your obvious choice would be SERVER-B as said more services means more entry points, if you can bypass the security of any entry point you get access, while for SERVER-A, you have only one entry point.
But what if server B was just put there to catch your attention, distracting you from something valuable on the other server? You can install fakes servers with lots of open ports for hackers to attack to ensure the safety of your main valuable servers and as soon as they start attacking the decoy, you can analyse their attack plans and work to counter them. This is called the honey pot method.
Basically, what a honey pot is is effectively a trap designed to detect, distract and generally counter attempts to hack into your servers. Usually its in the form of data or a network that appears to be part of your main system and to contain valuable data, but in fact its isolated and monitored.
Honey pots can however carry risks to your network and if they're not properly isolated, hackers can use them to infiltrate your system. There are different types of honey pot and you can differentiate between them simply by the circumstances under which they're used. They can be either:
Production Honey Pots Research Honey Pots
Production Honey Pots: Easy to use, capture limited information, used mainly by corporations and companies.
Research Honey Pots Usually run by voluntary workers or institutions of IT education in order to collect more and more information about the tactics of modern hackers to develop better defence systems.
About the Author:
To learn about great ways to enhance your software security and train to become an expert in their uses, browse through the security boot camp courses on koenig-solutions.com where you'll also find a great range of oracle training courses
