Honeypots¶
Spitzner, L. (2002). Honeypots: Tracking Hackers. Addison-Wesley.
Cited by¶
5 citations across 5 artifacts.
Each citation links to the sentence it supports in the citing article.
Primes¶
- Antagonist
- Security and access control: honeypots and tarpit servers consume attacker connection slots without doing real work; decoy credentials consume attacker attention without yielding anything.
This sourceStandard reference on honeypots and tarpits as systems that consume an attacker's connection slots and attention without performing real work — occupancy-without-activation in a security substrate.
- Security and access control: honeypots and tarpit servers consume attacker connection slots without doing real work; decoy credentials consume attacker attention without yielding anything.
- Deception Blowback
- In cybersecurity, a honeypot or decoy meant to mislead intruders confuses the defender's own incident-response team or future forensics, which is why playbooks warn against decoys without canary tagging.
This sourceFoundational treatment of decoys and honeypots in cyber-defence, including the need to tag and segregate decoy artefacts (honeytokens, planted data) so they do not later confuse the defender's own incident response and forensics.
- In cybersecurity, a honeypot or decoy meant to mislead intruders confuses the defender's own incident-response team or future forensics, which is why playbooks warn against decoys without canary tagging.
Mechanisms¶
- Canary or Tripwire Asset
- Its strength is one of the cleanest signals in all of security — low false-positive by construction
This sourceExplains that honeypots produce few false positives and can detect attackers who have penetrated the perimeter.
- Its strength is one of the cleanest signals in all of security — low false-positive by construction
- Canary Probe
- Its failure mode is coverage: a canary only sees the exact exposure you placed it on, so an intermittent fault or adversary that avoids the baited path is completely invisible to it — and silence is easily misread as safety.
This sourceShows that a deception sensor observes only traffic directed to it and can be bypassed once identified.
- Its failure mode is coverage: a canary only sees the exact exposure you placed it on, so an intermittent fault or adversary that avoids the baited path is completely invisible to it — and silence is easily misread as safety.
- Decoy Sink Endpoint
- Its strength is that it both absorbs and reveals: hostile traffic is diverted from the protected function, and the sink doubles as an early-warning sensor on who is attacking and how.
This sourceDescribes honeypots as decoy resources that divert hostile interaction from production assets while recording attacker activity for detection and analysis.
- Its strength is that it both absorbs and reveals: hostile traffic is diverted from the protected function, and the sink doubles as an early-warning sensor on who is attacking and how.
Verification¶
Does it exist? Not checked yet. This entry carries no identifier to resolve. It was extracted from the citation as written in the article, normalized, and deduplicated against the rest of the registry.
Does it back the claim? Not recorded. Neither this nor any other of the 5 citations of this work carries a recorded support check.
Support is checked per citation rather than per work — the same source can be cited soundly in one article and wrongly in another. Per-citation recording began recently, so a citation with no recorded check is a gap in the record rather than evidence it went unchecked.
See how references were verified.
Links previously used in the corpus¶
Before the registry existed this work was also linked 2 other ways.
- https://search.worldcat.org/title/honeypots-tracking-hackers/oclc/50118719 ×1
- https://www.worldcat.org/oclc/50913820 ×1
Registry ID ref:297c5773fe2b · see in the full table