I'm interested to see if anyone here who administers a large environment (200-500 Servers), and has a very large public customer base (100,000+), has set up (or has at least considered setting up) a honeypot? I'm specially interested for those that provide services to nasty/evil/hostile networks.
If you have set one up, can you elaborate on your experience? In fact, please comment if you don't consider your environment to be large, even a small environment that contains some hostile networks is perfect!
I'm planning to set one up where I work, but naturally that will start with a few battles from management, naturally. There are risks - the biggest risk would be that things are not setup correctly, and your production servers join your honeypot "cluster", or simply that information about your network leaks out (any information is too much information).
A production honeypot is used to assist an organization in protecting its internal IT infrastructure whereas a research honeypot is used to accumulate evidence and information in order to study hackers’ or the blackhat criminal attack patterns and motives.
Production honeypots are valuable to the organization especially commercial, as it helps to reduce or mitigate risk that a specific organization faces. Production honeypots secure the organization by policing its IT environment to identify attacks. These production honeypots are useful in catching hackers with criminal intentions. The implementation and deployment of production honeypots are relatively easier than research honeypots.