Security personnel generally have two goals when using a honeypot. A honeypot can deflect or redirect threat actors’ attention away from legitimate servers by encouraging them to spend their time and...

Security personnel generally have two goals when using a honeypot. A honeypot can deflect or redirect threat actors’ attention away from legitimate servers by encouraging them to spend their time and energy on the decoy server, distracting their attention from the data on the actual server. A honeypot can also trick threat actors into revealing their attack techniques. Once these techniques are discovered, it can then be determined if actual production systems could thwart such an attack. However, honeypots can introduce risk. A honeypot, once attacked and compromised, could be used as a launching pad to attack and infiltrate other systems, either those of the organization itself or another organization. Although honeypots should be designed to “capture” the threat actor a misconfiguration could inadvertently give an attacker an actual platform to attack other systems. If a threat actor were able to do this, would the organization that set up the honeypot then be liable?