What is the security purpose of deploying a honeypot inside an ente…

Question

What is the security purpose of deploying a honeypot inside an enterprise network (internal honeypot)?

Accepted Answer

To detect internal threats and lateral movement — any connection to a honeypot indicates suspicious activity since no legitimate traffic should reach it — Here's the deal — b is correct because an internal honeypot is a fake system with no legitimate purpose; any network connection to it indicates either a misconfigured system, a scanning attacker, or lateral movement activity — making it a high-fidelity detection mechanism. A is wrong because internet-facing honeypots study external attackers; internal honeypots are designed to detect internal threats.

Answer

To attract external internet attackers and study their techniques

Answer

To provide an alternative target for DDoS attacks to protect production systems

Answer

To test whether the IDS generates alerts for known attack signatures

What is the security purpose of deploying a honeypot inside an enterprise network (internal honeypot)?

Short Explanation and Infographic

Full Explanation