An organization decided to strengthen the security of its network by studying and analyzing the behavior of attackers. For this purpose, Steven, a…

A honeypot is a security mechanism specifically designed as a decoy to attract and trap malicious actors. It mimics a legitimate target on a network, appearing to contain valuable information or services to "bait" or "lure" attackers. The primary purpose of a honeypot is to be probed, attacked, and compromised in a controlled environment. This allows security professionals to study the attackers' tactics, techniques, and procedures (TTPs), gather intelligence on their tools, and identify their origins without exposing the actual production systems to risk. The scenario describes exactly this function.

A. Intrusion detection system: An IDS is a passive monitoring tool that detects and alerts on suspicious activity; it does not actively lure or bait attackers.
B. Firewall: A firewall is a preventative control that filters network traffic based on a set of security rules to block unauthorized access, not attract it.
D. Router: A router is a core networking device responsible for forwarding data packets between networks; it is not a security decoy system.

1. Provos, N. (2004). A Virtual Honeypot Framework. CITI Technical Report 03-1, University of Michigan. In Section 1 (Introduction), a honeypot is defined as "a resource that is intended to be attacked and compromised to gain information about an adversary." This aligns with the goal of studying attacker behavior.

2. Rowe, N. C., & Rrushi, J. (2016). Introduction to Cyberdeception. In SpringerBriefs in Cybersecurity. Springer, Cham. https://doi.org/10.1007/978-3-319-31615-51. Chapter 1, page 2, states, "Honeypots are fake computer systems or networks put on the Internet to lure and trap hackers." This directly supports the concept of using a device to "lure attackers."

3. Carnegie Mellon University, Software Engineering Institute. (2004). Using Honeynets to Protect a Network. Technical Note CMU/SEI-2004-TN-033. The abstract states, "The purpose of a honeynet is to gain information about the blackhat community," which is consistent with the scenario's objective to study and analyze attacker behavior.