I have a really simple high interaction honeypot and I have just installed a VM as an IPS (suricata) with a transparent bridge between my router and the honeypot. The setup looks something like this: ...
Is a honeypot an IDS or an IPS or something else? Is it an offensive or a defensive technique? Is it still effective?
I'd like to know where a Honeypot falls into the scheme of security, and if it is still an effective tool?
I haven't read much about such a technique, but I'm wondering if there's any sort of best practice around the use of "canaries" to detect certain types of intrusion: Create a bogus account that ...