Honeypots¶
Spitzner, L. (2002). Honeypots: Tracking Hackers. Addison-Wesley.
Cited by¶
4 citations across 4 artifacts.
Each citation links to the sentence it supports in the citing article.
Primes¶
- Antagonist
- Security and access control: honeypots and tarpit servers consume attacker connection slots without doing real work; decoy credentials consume attacker attention without yielding anything.
This sourceStandard reference on honeypots and tarpits as systems that consume an attacker's connection slots and attention without performing real work — occupancy-without-activation in a security substrate.
- Security and access control: honeypots and tarpit servers consume attacker connection slots without doing real work; decoy credentials consume attacker attention without yielding anything.
- Deception Blowback
- In cybersecurity, a honeypot or decoy meant to mislead intruders confuses the defender's own incident-response team or future forensics, which is why playbooks warn against decoys without canary tagging.
This sourceFoundational treatment of decoys and honeypots in cyber-defence, including the need to tag and segregate decoy artefacts (honeytokens, planted data) so they do not later confuse the defender's own incident response and forensics.
- In cybersecurity, a honeypot or decoy meant to mislead intruders confuses the defender's own incident-response team or future forensics, which is why playbooks warn against decoys without canary tagging.
Mechanisms¶
- Canary or Tripwire Asset
- Its strength is one of the cleanest signals in all of security — low false-positive by construction
This sourceExplains that honeypots produce few false positives and can detect attackers who have penetrated the perimeter.
- Its strength is one of the cleanest signals in all of security — low false-positive by construction
- Canary Probe
- Its failure mode is coverage: a canary only sees the exact exposure you placed it on, so an intermittent fault or adversary that avoids the baited path is completely invisible to it — and silence is easily misread as safety.
This sourceShows that a deception sensor observes only traffic directed to it and can be bypassed once identified.
- Its failure mode is coverage: a canary only sees the exact exposure you placed it on, so an intermittent fault or adversary that avoids the baited path is completely invisible to it — and silence is easily misread as safety.
Verification¶
This reference passed the adversarial substantiation pipeline: it was checked to exist and to support the claim it is attached to. See how references were verified.
Links previously used in the corpus¶
Before the registry existed this work was also linked 2 other ways.
- https://search.worldcat.org/title/honeypots-tracking-hackers/oclc/50118719 ×1
- https://www.worldcat.org/oclc/50913820 ×1
Registry ID ref:297c5773fe2b · see in the full table