{"componentChunkName":"component---src-templates-article-js","path":"/adversarial-thinking-improving-cybersecurity-with-ants-and-barcodes/","result":{"data":{"wordpressPost":{"title":"Improving Cybersecurity With Adversarial Thinking","content":"
\n

People often ask me about ‘adversarial thinking’ — that somewhat amorphous concept that defines security folk with the uncanny ability to mentally model how things can break.

\n

Whenever this conversation comes up, I’m reminded of an anecdote by Bruce Schneier:

\n

Uncle Milton Industries has been selling ant farms to children since 1956. Some years ago, I remember opening one up with a friend. There were no actual ants included in the box. Instead, there was a card that you filled in with your address, and the company would mail you some ants. My friend expressed surprise that you could get ants sent to you in the mail.

\n

I replied: “What’s really interesting is that these people will send a tube of live ants to anyone you tell them to.”

\n

I had a similar epiphany in my childhood with barcodes in supermarkets. After learning how to read them (back then, my reference material was a random ‘zine on a long-defunct BBS), I immediately wrote a program to print my own.

\n
\n
\n
\n
\n
The forgotten skill of BBS ANSI artwork (source: textfiles.com)
\n

My curiosity was to see how the scanners would react, but I quickly realized that you could swap a legitimate barcode for a product with a much cheaper price (like most innovative criminal enterprises, this has already been done).

\n
\n
\n
\n
\n
An ISSN Barcode Explained
\n

‘Adversarial thinking’, the ‘security mindset’, whatever you call it, it’s apparent that some folks are naturally better at breaking things than others. The gulf is vast — professional red-teamers and bug hunters can immediately find glaring vulnerabilities in systems and processes that others have built and used for years without noticing them.

\n

You can’t even ascribe the difference to some sort of training; most hackers never formally ‘learned’ this stuff.

\n

Embracing adversarial thinking is not just a ‘good to have’, but a ‘must-have’. Without it being the foundation of your defense, you’re doomed to failure. This is far more than hiring a couple of pentesters every quarter, you have to have defenders who think this way. It’s more important than any technology you can buy, or process you can document.

\n

Done right, it’s the single greatest way to improve your security.

\n

Dunning-Kruger and the Cybersecurity Defender

\n

Unfortunately, the cybersecurity industry has built stark schisms between the types of people who can break systems, and those that build or defend them.

\n

The difference is represented in our primary color nomenclature — The ‘red team’ versus the ‘blue team’. Many of the people playing team blue don’t come with the adversarial thinking mindset. They may have transitioned into security from an IT operations role, or just don’t have (or tap into) that way of looking at the world. The differences extend beyond color right into the vocabulary they use. Many blue-teams have the equivalent of elementary school security vocabulary.

\n
\n
\n
\n
\n
\n
\n
\n
\n
\n
\n

Worryingly, they don’t ‘see it’, yet they believe they understand it. Their knowledge of how security systems break is superficial, and their confidence in the tenuous defenses they construct is high. They’re at the early phase of a form of security Dunning-Kruger Effect

\n
\n
\n
\n
\n
The Dunning-Kruger Effect
\n

The Dunning-Kruger effect, occurs where people fail to adequately assess their level of competence — or specifically, their incompetence — at a task and thus consider themselves much more competent than everyone else.

\n

This lack of awareness is attributed to their lower level of competence robbing them of the ability to critically analyse their performance, leading to a significant overestimation of themselves.

\n

The breakers, on the other hand, live, breathe, and sleep this stuff. They view even the physical world in terms of postally-delivered insects and in-store label replacement. It’s not a job, it’s a default world view.

\n

For those amongst you who think like this, you’ll find yourself face-palming in frustration when you hear things like:

\n

Nothing to worry about, we’ve blacklisted all the characters that cause SQL injection.

\n

…

\n

Nobody can break into this server, we’ve firewall-ed every port except HTTP!

\n

…

\n

You have to pen-test my environment only through the firewall, don’t spear-phish my staff, and only target this specific IP address. You must break in under 30 minutes, while standing on a donkey, with your dominant hand tied behind your back.

\n

(The last one is from an actual engagement. Promise).

\n
\n
\n
\n
\n
“Though shalt not limit assessment scope”
\n

This schism leads to defenders complaining that red-teams have huge egos (well okay, many do), and all they do is break in, throw down a report, and ride into the sunset. The onus has been placed on offensive teams to learn to couch their language in order to have their findings accepted.

\n

Hacker subculture values intellectual honesty over political correctness and forced authority figures, so you can imagine how well this tends to go with the typical red team personality who (often rightly) wants to call his defender counterpart a negligent <expletive>, but is constrained from doing so.

\n

The Maker / Breaker Myth

\n

As an aside, there’s another falsehood that must be addressed. Some people assume that breakers are only good at tearing things down. This fits nicely into the black and white, good v/s evil narrative that often accompanies hyped cybersecurity headlines in the news.

\n

The reality couldn’t be further from the truth. Most people who excel in adversarial thinking are also great at making things.

\n

This extends far beyond their Github repositories (though there’s plenty of evidence of creation there), they write, the woodwork, they build companies.

\n

Can Adversarial Thinking Be Learned?

\n

Yes.

\n

Now that we’ve broken Betteridge’s law of headlines, the answer is more nuanced. It can be learned, but I don’t believe it can be taught.

\n

For example, a neophyte quality assurance tester (a great place to find budding penetration testers) may come into the job like Neo in The Matrix; never really aware of their latent abilities until their awakening. Over time, they discover ‘the knack’, and before you know it, you have a version of IBM’s infamous “Black Team”.

\n

This bodes badly for the legions of training programs that promise to remold you into some variant of an OCH (Officially Certified Hacker) in five days or your money back (not).

\n

Those certifications either favor the lowest common denominator of tool-teaching over thought-application or if they do have strong practical testing, the people who do well likely already had the mindset in the first place. The course served to teach them the tradecraft, not the art.

\n

There are notable exceptions, such as the excellent Pentester Academy, where the focus is foundational concepts over tools, and the delivery medium requires a personal passion that often (but not always) goes hand-in-hand with the security mindset.

\n

In the spirit of helpful lists, here are some ways to tickle the adversarial thinking funny bone. If you find these fun, you may just ‘have it’:

\n
    \n
  1. Deconstruct something outside of computer security
    \nLook for the postal-mailed ants in the world around you.
    2. \n
  2. Try lock-picking
    \nLet’s see. An exercise in early-stage frustration requires dedication to master, succeeding is it’s own reward, requires black-box reverse engineering skills. Sounds very much like computer security. Look no further than the amazing Deviant Ollam’s books to start.
    3. \n
  3. Play a Strategy Board Game
    \nAs cliched as it may sound, games like chess, Chinese checkers, and go have strong adversarial thinking precepts including ‘if this, then that’ thinking, and pattern identification.
    4. \n
\n
\n
\n
\n
\n
Lock-picking: Adversarial thinking in meatspace. (source: gizmodo.com)
\n

Hiring Adversarial Thinkers

\n

Since certifications are a bad metric for identifying the skill-set, analyzing experience is a better way to look for the right stuff.

\n

This doesn’t mean hire the person who did 6 years of ‘VA/PT’ at $CONSULTING_COMPANY, instead, ask about how he or she got started with security (look for ant-mailer thinking), and transition into the war-stories of their hardest real-life and computer security hacks.

\n

If they enthusiastically delve into the time they had to balance a nutmeg on a data-center door in order to prevent the fire alarm from sounding, you might have the right person.

\n

Bonus Points: If they reveal confidential information like client names, you can stop right there — they may be good, but you don’t want someone who’s a talker.

\n

If you’re hiring fresh off the boat, you can’t count on past experience, so a far less scientific process will have to suffice. Lateral thinking questions (‘list 10 ways to switch off a light bulb without touching the switch’) are alright, but can quickly end up being dubiously effective.

\n

We’ve always favored giving prospects a really difficult practical challenge, well outside of the realm of their existing domain knowledge. The challenge has different levels, ranging from elementary to either unsolvable or with multiple correct answers. Look for those who:

\n
    \n
  1. Take the time to learn the fundamental concepts of the problem
    2. \n
  2. Apply creative solutions, even if they are wrong (much of adversarial thinking involves extensive trial and error).
    3. \n
  3. Talk enthusiastically about the levels they could not solve and how they approached them (as opposed to those who try to downplay the failure).
    4. \n
\n

Adversarial Thinking in Summary

\n\n

Caveats and Clarifications

\n\n
\n","excerpt":"People often ask me about ‘adversarial thinking’ — that somewhat amorphous\nconcept that defines security folk with the uncanny ability to mentally model\nhow things can break. Here’s how you approach it.\n","slug":"adversarial-thinking-improving-cybersecurity-with-ants-and-barcodes","date":"2017-06-04T10:10:10.000Z","modified":"2021-01-24T16:41:15.000Z","status":"publish","featured_media":{"id":"dc204b81-dfa5-5df7-aa16-140453e82d43","source_url":"https://ss-website-content-prod.s3.ap-south-1.amazonaws.com/wp-content/uploads/2017/06/1-R44NpCbrGBxhkiawvPzpew.jpeg","alt_text":"Adversarial Thinking","large":{"childImageSharp":{"fluid":{"base64":"data:image/jpeg;base64,/9j/2wBDABALDA4MChAODQ4SERATGCgaGBYWGDEjJR0oOjM9PDkzODdASFxOQERXRTc4UG1RV19iZ2hnPk1xeXBkeFxlZ2P/2wBDARESEhgVGC8aGi9jQjhCY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2P/wgARCAAMABQDASIAAhEBAxEB/8QAGAAAAgMAAAAAAAAAAAAAAAAAAAUCAwT/xAAUAQEAAAAAAAAAAAAAAAAAAAAA/9oADAMBAAIQAxAAAAHVakmMxOH/xAAYEAEBAQEBAAAAAAAAAAAAAAABAgAhA//aAAgBAQABBQKEqa9Jk44tM8zav//EABQRAQAAAAAAAAAAAAAAAAAAABD/2gAIAQMBAT8BP//EABQRAQAAAAAAAAAAAAAAAAAAABD/2gAIAQIBAT8BP//EABoQAAICAwAAAAAAAAAAAAAAAAABETEQIkH/2gAIAQEABj8C1g4VA0iVeP/EABkQAQEBAQEBAAAAAAAAAAAAAAERACFBYf/aAAgBAQABPyHlQnLN3gnwysr8seyFzs5Rcsrv/9oADAMBAAIAAwAAABAAz//EABQRAQAAAAAAAAAAAAAAAAAAABD/2gAIAQMBAT8QP//EABQRAQAAAAAAAAAAAAAAAAAAABD/2gAIAQIBAT8QP//EAB4QAQADAAICAwAAAAAAAAAAAAEAESExYVFxkaHR/9oACAEBAAE/EGYo96Y7KtY6F1+po3OG2zz1D8J8eIoA5PuNCr7f2f/Z","aspectRatio":1.6666666666666667,"src":"/static/473b37d13c8bf726e6a6d073872a81bf/14b42/1-R44NpCbrGBxhkiawvPzpew.jpg","srcSet":"/static/473b37d13c8bf726e6a6d073872a81bf/f836f/1-R44NpCbrGBxhkiawvPzpew.jpg 200w,\n/static/473b37d13c8bf726e6a6d073872a81bf/2244e/1-R44NpCbrGBxhkiawvPzpew.jpg 400w,\n/static/473b37d13c8bf726e6a6d073872a81bf/14b42/1-R44NpCbrGBxhkiawvPzpew.jpg 800w,\n/static/473b37d13c8bf726e6a6d073872a81bf/47498/1-R44NpCbrGBxhkiawvPzpew.jpg 1200w,\n/static/473b37d13c8bf726e6a6d073872a81bf/0e329/1-R44NpCbrGBxhkiawvPzpew.jpg 1600w","srcWebp":"/static/473b37d13c8bf726e6a6d073872a81bf/58556/1-R44NpCbrGBxhkiawvPzpew.webp","srcSetWebp":"/static/473b37d13c8bf726e6a6d073872a81bf/61e93/1-R44NpCbrGBxhkiawvPzpew.webp 200w,\n/static/473b37d13c8bf726e6a6d073872a81bf/1f5c5/1-R44NpCbrGBxhkiawvPzpew.webp 400w,\n/static/473b37d13c8bf726e6a6d073872a81bf/58556/1-R44NpCbrGBxhkiawvPzpew.webp 800w,\n/static/473b37d13c8bf726e6a6d073872a81bf/99238/1-R44NpCbrGBxhkiawvPzpew.webp 1200w,\n/static/473b37d13c8bf726e6a6d073872a81bf/7c22d/1-R44NpCbrGBxhkiawvPzpew.webp 1600w","sizes":"(max-width: 800px) 100vw, 800px"}}},"medium":{"childImageSharp":{"fluid":{"base64":"data:image/jpeg;base64,/9j/2wBDABALDA4MChAODQ4SERATGCgaGBYWGDEjJR0oOjM9PDkzODdASFxOQERXRTc4UG1RV19iZ2hnPk1xeXBkeFxlZ2P/2wBDARESEhgVGC8aGi9jQjhCY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2P/wgARCAAMABQDASIAAhEBAxEB/8QAGAAAAgMAAAAAAAAAAAAAAAAAAAUCAwT/xAAUAQEAAAAAAAAAAAAAAAAAAAAA/9oADAMBAAIQAxAAAAHVakmMxOH/xAAYEAEBAQEBAAAAAAAAAAAAAAABAgAhA//aAAgBAQABBQKEqa9Jk44tM8zav//EABQRAQAAAAAAAAAAAAAAAAAAABD/2gAIAQMBAT8BP//EABQRAQAAAAAAAAAAAAAAAAAAABD/2gAIAQIBAT8BP//EABoQAAICAwAAAAAAAAAAAAAAAAABETEQIkH/2gAIAQEABj8C1g4VA0iVeP/EABkQAQEBAQEBAAAAAAAAAAAAAAERACFBYf/aAAgBAQABPyHlQnLN3gnwysr8seyFzs5Rcsrv/9oADAMBAAIAAwAAABAAz//EABQRAQAAAAAAAAAAAAAAAAAAABD/2gAIAQMBAT8QP//EABQRAQAAAAAAAAAAAAAAAAAAABD/2gAIAQIBAT8QP//EAB4QAQADAAICAwAAAAAAAAAAAAEAESExYVFxkaHR/9oACAEBAAE/EGYo96Y7KtY6F1+po3OG2zz1D8J8eIoA5PuNCr7f2f/Z","aspectRatio":1.661764705882353,"src":"/static/473b37d13c8bf726e6a6d073872a81bf/32fd5/1-R44NpCbrGBxhkiawvPzpew.jpg","srcSet":"/static/473b37d13c8bf726e6a6d073872a81bf/06e94/1-R44NpCbrGBxhkiawvPzpew.jpg 113w,\n/static/473b37d13c8bf726e6a6d073872a81bf/07ab6/1-R44NpCbrGBxhkiawvPzpew.jpg 225w,\n/static/473b37d13c8bf726e6a6d073872a81bf/32fd5/1-R44NpCbrGBxhkiawvPzpew.jpg 450w,\n/static/473b37d13c8bf726e6a6d073872a81bf/4a838/1-R44NpCbrGBxhkiawvPzpew.jpg 675w,\n/static/473b37d13c8bf726e6a6d073872a81bf/9842e/1-R44NpCbrGBxhkiawvPzpew.jpg 900w,\n/static/473b37d13c8bf726e6a6d073872a81bf/0e329/1-R44NpCbrGBxhkiawvPzpew.jpg 1600w","srcWebp":"/static/473b37d13c8bf726e6a6d073872a81bf/b8a88/1-R44NpCbrGBxhkiawvPzpew.webp","srcSetWebp":"/static/473b37d13c8bf726e6a6d073872a81bf/3a3bf/1-R44NpCbrGBxhkiawvPzpew.webp 113w,\n/static/473b37d13c8bf726e6a6d073872a81bf/975bf/1-R44NpCbrGBxhkiawvPzpew.webp 225w,\n/static/473b37d13c8bf726e6a6d073872a81bf/b8a88/1-R44NpCbrGBxhkiawvPzpew.webp 450w,\n/static/473b37d13c8bf726e6a6d073872a81bf/761da/1-R44NpCbrGBxhkiawvPzpew.webp 675w,\n/static/473b37d13c8bf726e6a6d073872a81bf/210c1/1-R44NpCbrGBxhkiawvPzpew.webp 900w,\n/static/473b37d13c8bf726e6a6d073872a81bf/7c22d/1-R44NpCbrGBxhkiawvPzpew.webp 1600w","sizes":"(max-width: 450px) 100vw, 450px"}}}},"categories":[{"id":"91492045-3e86-5e2f-a34f-b0855c540ccf","slug":"industry","name":"industry"},{"id":"cb312b9c-68d1-53f5-99b1-3127e4bead1c","slug":"philosophy","name":"philosophy"},{"id":"0aaaa4e2-c9fd-5357-95d2-3884b38b33c0","slug":"strategy","name":"strategy"}],"author":{"id":"9257cd1e-ca7f-578b-a2dd-9c2e74282caf","name":"Smokescreen Team"},"yoast_meta":{"yoast_wpseo_twitter_title":"","yoast_wpseo_twitter_description":"","yoast_wpseo_redirect":"","yoast_wpseo_opengraph_title":"","yoast_wpseo_opengraph_description":"","yoast_wpseo_metakeywords":"","yoast_wpseo_metadesc":"A primer exploring adversarial thinking in cybersecurity, whether it can be learned, and some practical tips for hiring adversarial thinkers.","yoast_wpseo_meta_robots_noindex":"","yoast_wpseo_meta_robots_nofollow":"","yoast_wpseo_meta_robots_adv":"","yoast_wpseo_linkdex":"73","yoast_wpseo_focuskw":"Adversarial Thinking","yoast_wpseo_canonical":""}},"relatedPosts":{"edges":[{"node":{"id":"e3cd17da-d028-5fad-bd26-31d9b3a4604d","title":"Using deception to shield the insurance sector","content":"\n

Let’s cut to the chase, insurance companies are under siege from cyberattacks. An Accenture report from 2020 shows that attacks on insurers have more than doubled from 240 to 519, on average. Insurers also sit on top of sensitive customer data and are at risk of losing it – 44% exposed more than 500,000 customer records in 2019 compared to 15% for cross-industry peers.

\n\n\n\n

As more people around the world come under the ambit of insurance policies, the risk to insurers continues to grow. In this post, we take a look at some of the key pieces of an insurer’s infrastructure that adversaries target, why they go after it, and how you can use deception to build active defenses that mitigate the risk of these attacks and put you in a better position to detect and contain these threats,

\n\n\n\n

For a moment, step into the shoes of a malicious entity targeting an insurance company. Your goal is to get $$$. What are your best opportunities?

\n\n\n\n

Opportunity #1 – Compromise the database cluster or core application

\n\n\n\n

The database of all policyholders and their policy details, complete with confidential and protected information is perhaps the most valuable asset of an insurer. This would be the holy grail of compromises. Given that a lot of this information is distributed across many systems (some of them legacy), protecting them is a challenge for the sector. 

\n\n\n\n

Adversary Opportunities

\n\n\n\n

Not only would this data sell for a neat sum on the underground market, but it can also be weaponized in numerous ways, including and not limited to: 

\n\n\n\n\n\n\n\n

Adversary Considerations

\n\n\n\n

To achieve this target, adversaries will have to invest time and money into:

\n\n\n\n\n\n\n\n

Adversary Decision Criteria

\n\n\n\n

Cost-benefit analysis reveals Low to medium risk with an extremely high payout. 

\n\n\n\n

Adversary Profiles

\n\n\n\n

Advanced and organized criminal syndicates.

\n\n\n\n

Opportunity #2 – Deploy Ransomware

\n\n\n\n

Insurance companies deal with lots of files. Lots and lots of files. If an adversary succeeds in encrypting as many files as possible, the payout from this activity can be significant. 

\n\n\n\n

Adversary Opportunities

\n\n\n\n\n\n\n\n

Considerations

\n\n\n\n\n\n\n\n

Adversary Profile 

\n\n\n\n

Ransomware operators of any sophistication. 

\n\n\n\n

Opportunity #3 – Attacking public-facing Direct-to-Consumer applications

\n\n\n\n

Insurance companies worldwide are expected to digitize their interactions with consumers. Everything from pre-sales to claims management is expected to be made available to consumers directly in a bid to simplify the consumer experience. This involves the adoption of cloud services, moving previously internal systems to Internet-facing infrastructure, and spinning up even more infrastructure to support business objectives. Adversaries now have a wider attack surface available to them to exploit. 

\n\n\n\n

Adversary Opportunities

\n\n\n\n\n\n\n\n

Adversary Considerations

\n\n\n\n

Mapping external infrastructure is a trivial task and therefore there are minimal considerations for groups adopting this approach. 

\n\n\n\n

Decision Criteria

\n\n\n\n

Low effort with payout equivalent to the criticality of the infrastructure they compromise.

\n\n\n\n

Adversary Profile

\n\n\n\n

Cybercriminals of any sophistication. 

\n\n\n\n

Your Defense Plan in a nutshell

\n\n\n\n\n\n\n\n

Enter Deception

\n\n\n\n

Deception is about tilting the odds of winning in your favor. It’s about making reasonable judgments about what the adversary might go after and presenting that information to them on a platter. Deception is about abstracting defenses to individual attacker techniques with lesser effort and increased cost to the attacker. 

\n\n\n\n

The core principle of deception is the idea that any interaction with a decoy can be viewed as suspicious and warrants immediate action.  

\n\n\n\n

Using deception to beat adversary motivations

\n\n\n\n

Broadly, the plan is to plant decoys across the network, from perimeter to end-point, to deceive the adversary. At a high-level, the following locations will be configured with decoys:

\n\n\n\n
  1. Decoys in the perimeter.
  2. Decoys in the network.
  3. Decoys on the endpoint.
  4. Decoys in Active Directory.
\n\n\n\n

By spreading decoys across the infrastructure, we maximize our chances of detecting adversaries. Remember, we only need to be able to detect the adversary once. 

\n\n\n\n

The following is a break-down of what this might look like in practice. 

\n\n\n\n

Decoy applications at the perimeter

\n\n\n\n\n\n\n\n

Decoy Systems on the network

\n\n\n\n\n\n\n\n

Decoy core application and database users in Active Directory

\n\n\n\n\n\n\n\n

Decoys on the endpoint

\n\n\n\n\n\n\n\n

What’s the alternative?

\n\n\n\n

Let’s say you don’t want to use deception. The alternative is to understand and defend yourself against every attacker technique. As per MITRE ATT&CK, these are over 100 and this does not account for variations in how these attacks might be executed. 

\n\n\n\n

Deception is grounded in addressing the motivations of the adversary and presenting fake information on a platter that adversaries find attractive. It is technique-agnostic and abstracts away the complexity that arises from blocking individual tools, techniques, and behaviors. 

\n\n\n\n

Deception is a form of Active Defense, where security teams take proactive steps to channel the adversary and make their life difficult. It varies from regular defense where you wait for an existing system to generate an alarm and then react.

\n\n\n\n

MITRE new active defense framework, Shield, is being adopted by CISOs around the world and we see this approach being embraced by more and more security teams at insurance companies.

\n","excerpt":"Insurance companies are under siege from cyberattacks. We take a look at some of the key pieces of an insurer’s infrastructure the adversaries target and how you can use deception to build active defenses.\n","slug":"using-deception-to-shield-the-insurance-sector","date":"2021-01-26T12:23:04.000Z","status":"publish","modified":"2021-02-01T03:41:54.000Z","wordpress_id":18716,"featured_media":{"id":"906d7d6e-966b-59f3-9c9d-9b14d27d8746","source_url":"https://ss-website-content-prod.s3.ap-south-1.amazonaws.com/wp-content/uploads/2021/01/Shield-insurance.png","alt_text":"Active defense and deception for insurance","large":{"childImageSharp":{"fluid":{"base64":"data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAABQAAAALCAYAAAB/Ca1DAAAACXBIWXMAAAsTAAALEwEAmpwYAAACeElEQVQozz1Ta28SQRSdNGm1DaTE0oL0IQgFlncBeSwIC8tLHqUsUIRiRYqV2NZEU6OxNtUPxp99nHs/+OFkdmf2njn33LOiO55gPL+AMZnCrQTgC4URjEbx3OOB3+9HKpVCIpH4D13Xkc1m+czr9SISifB7oVBgiJRWgqpXUKjV4QtHEIrHET46ghIMIiiRy+VQKpVQr9dRqVTQarUQCASwurqKjY0NrK2t4eDgAB4pgFaRyBegxJOIpNLIFDW8UHNIS2QlEamj29PpNPL5PMrlMq+0T8UWiwVbW1sIhULw+XysVmjNFhzuQzj9CjSpcvb+EsbpKbKqimKxiEajgWazye2ocq/T6aDf77PSTCbD6mezGZbLJYbDIcTmUwceWZ7AvG3D400L9MYrLK+uYQwGGEicSvLRaATDMJhoMpGej8c4OztDrVbj58Vigel0ypaI4dsZ8tUaXP4Anh16kXlZQNfoo9PtcgEppBapJWq3Wq1yYTKZZC9dLheDOqAz8fXhF+7//MXHL7e4vfvJLauS1LqzA5PJBJvNxhBCYGVlBU6nkwkVRcHu7i4cDgf29vYQDofZb+GNHsEfi6NYb2Dybo75hyVC0RjcnkOeHKmiD6mILiA1pJymrmkax6jdbrM1ZJGIZFTYXW44fQpyZR0TacF4+gZD6dvx8TEbTxExm82IxWK8RyR0EUWKSGlQNJBerwfx6fsP9CWB3mpjIMPdkf6l5YeqBBWRSorGjrSAgk0k5J/VasX6+jrsdjt7R4rpIvH57h7fHn7j4uoGCzndy+sbTKXK0esxR2J/f5+LaDgnJyeshlTF5Q9AK03//Pwc8/mcU/APvBh2nCQ8QXsAAAAASUVORK5CYII=","aspectRatio":1.9047619047619047,"src":"/static/12a9f2eabb7e883c4f03074601938551/ee604/Shield-insurance.png","srcSet":"/static/12a9f2eabb7e883c4f03074601938551/69585/Shield-insurance.png 200w,\n/static/12a9f2eabb7e883c4f03074601938551/497c6/Shield-insurance.png 400w,\n/static/12a9f2eabb7e883c4f03074601938551/ee604/Shield-insurance.png 800w,\n/static/12a9f2eabb7e883c4f03074601938551/f3583/Shield-insurance.png 1200w,\n/static/12a9f2eabb7e883c4f03074601938551/5707d/Shield-insurance.png 1600w,\n/static/12a9f2eabb7e883c4f03074601938551/0ef64/Shield-insurance.png 2400w","srcWebp":"/static/12a9f2eabb7e883c4f03074601938551/58556/Shield-insurance.webp","srcSetWebp":"/static/12a9f2eabb7e883c4f03074601938551/61e93/Shield-insurance.webp 200w,\n/static/12a9f2eabb7e883c4f03074601938551/1f5c5/Shield-insurance.webp 400w,\n/static/12a9f2eabb7e883c4f03074601938551/58556/Shield-insurance.webp 800w,\n/static/12a9f2eabb7e883c4f03074601938551/99238/Shield-insurance.webp 1200w,\n/static/12a9f2eabb7e883c4f03074601938551/7c22d/Shield-insurance.webp 1600w,\n/static/12a9f2eabb7e883c4f03074601938551/f1e40/Shield-insurance.webp 2400w","sizes":"(max-width: 800px) 100vw, 800px"}}},"medium":{"childImageSharp":{"fluid":{"base64":"data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAABQAAAAKCAYAAAC0VX7mAAAACXBIWXMAAAsTAAALEwEAmpwYAAACR0lEQVQozy2S608aURDFrx8LiFjaqOWVKiCPFVjCc3mW54IgKPIuYgFtSU2NNa1pq239y0/vTPrhZncne39z5pwRWqWGcquNQk2HVzlCMKJCCYfh8XoRjUaRzWZRqVRQKpXQaDSQy+VgNBr5GAwGuFwuBAIB7O/v8xGqloVPjUJNaYhpGcQ1DfFUGslUColEAplMBpqslctlFAoFfifI1tYWzGYzDg4OGOTz+biZKDSasLk98IbC0E86uFiuUNUbSKXTrKperzMsJRvQs9vtotVqIZlMMnw8HmO1WqHX63FDsf3GjhfbVhheWmF+9Rr98QTL64/oyIvD4RD9fh+DwQCdTgfT6RSj0Qiz2QzNZhNnZ2cMm8/nqFar3FAMLhfISB/dSgjugIJSrY6u7KZLv+gn6krjhKWvdIFqaane7/fD7Xbz+KSU6vl8HuLu1xMe/jzj5v4bvj8+YfR+Bl8wiM1Nszyb7A8FIISAyWRin+LxOBwOB5xOJwNDoRBbcnh4COH0+fE2EES6WMLk8gMmF3OEZboBCaVQCEAKrVYrbDYbK278V1+r1dBut9lHsoIsENlqnYGeoxAqzWMMJlP0BkOcyIDo4u7uLjY2NmC32/mbQqJAVFVFLBaDruscFIHJZ3H/+BszGcJx7xzTxRKt01Nkcnm8kwnTHhJoZ2cHkUiEV4hgVKMd3Nvb4x2l1EkxBSVuf/zEw99nrO++4tOXW1x/vsFcgs9lugSxWCw8+mKx4LFITbFYxKlsTOleXV1hvV7zRiiKgn/xCVdoxa/hfwAAAABJRU5ErkJggg==","aspectRatio":1.9152542372881356,"src":"/static/12a9f2eabb7e883c4f03074601938551/62b1f/Shield-insurance.png","srcSet":"/static/12a9f2eabb7e883c4f03074601938551/e7519/Shield-insurance.png 113w,\n/static/12a9f2eabb7e883c4f03074601938551/7e7e9/Shield-insurance.png 225w,\n/static/12a9f2eabb7e883c4f03074601938551/62b1f/Shield-insurance.png 450w,\n/static/12a9f2eabb7e883c4f03074601938551/e2e7f/Shield-insurance.png 675w,\n/static/12a9f2eabb7e883c4f03074601938551/db955/Shield-insurance.png 900w,\n/static/12a9f2eabb7e883c4f03074601938551/0ef64/Shield-insurance.png 2400w","srcWebp":"/static/12a9f2eabb7e883c4f03074601938551/b8a88/Shield-insurance.webp","srcSetWebp":"/static/12a9f2eabb7e883c4f03074601938551/3a3bf/Shield-insurance.webp 113w,\n/static/12a9f2eabb7e883c4f03074601938551/975bf/Shield-insurance.webp 225w,\n/static/12a9f2eabb7e883c4f03074601938551/b8a88/Shield-insurance.webp 450w,\n/static/12a9f2eabb7e883c4f03074601938551/761da/Shield-insurance.webp 675w,\n/static/12a9f2eabb7e883c4f03074601938551/210c1/Shield-insurance.webp 900w,\n/static/12a9f2eabb7e883c4f03074601938551/f1e40/Shield-insurance.webp 2400w","sizes":"(max-width: 450px) 100vw, 450px"}}}},"author":{"id":"765e8417-7ed6-55b7-95a7-1d561141e760","name":"Sudarshan Pisupati"}}},{"node":{"id":"ea4f620c-95dd-5361-8f79-ff8b1fa8ff02","title":"7 Ways to Fail At Implementing Deception Technology","content":"

Distributed Deception Platforms are a hot topic today. Most CISOs are thinking of implementing deception technology or road-mapping it into their evaluations and budgets. The promises sound great:

\n\n

Unfortunately, due to the unique secretive nature of deception (after all, you may not want people to know about it), there’s precious little information on how a security team can implement deception tecnology successfully and make it useful.

\n

If you’re being pushed to power-up a sleek appliance and kiss your cybersecurity woes goodbye, don’t believe the marketing hype — that’s not going to happen.

\n

After implementing deception technology campaigns for the better part of a decade, we’ve compiled a list of the 7 deadly sins that will guarantee that your deception investment will disappoint you. Here we go:

\n

1. You’re Not Sure What You’re Protecting

\n

It’s quite obvious that for a deception technology deployment to be successful, you need an objective and a strategy. At a minimum, make sure you know what assets you’re trying to protect (they’re not all equal to the hacker). The best deception campaigns are extremely goal-oriented (e.g.: “Catch targeted attacks against my SWIFT servers, especially focused on breaches from third-party networks.”).

\n

The Fix: Make a list of your top 3 nightmare scenarios, and identify the assets (endpoints / servers / people / credentials / network zones) that are a part of those nightmares.

\n

 

\n

2. You Don’t Know Your Enemy

\n

There’s a reason some of the best deception specialists moonlight as threat hunters or red-teamers. Deception is an ‘active defence‘ capability — where deep knowledge of the attacker’s modus operandi is crucial. Knowing the critical paths an attacker will follow will massively boost the effectiveness of your deception capabilities.

\n

The Fix: Have your in-house / external red-team build attack trees to the assets you’ve identified at risk. Train your blue-team on how to think adversarially.

\n

 

\n

3. You’re Not Prepared for Deception Alerts

\n

One of the best things about deception technology is that the alerts are low false positive and real-time. That’s great, but when the metaphorical (or literal) phone rings, do you have a plan for how to respond? The attacker is very likely still ‘live and squirming’ on your infrastructure. This leads to interesting new opportunities and questions:

\n\n

The Fix: Have a specific set of incident response play-books for responding to deception alerts. War-game the scenarios end-to-end, ideally without your DFIR / blue-team being aware. Start basic and build a roadmap to advanced deception use cases.

\n

 

\n

4. You Haven’t Tested Your Deception Strategy

\n

Confident and experienced deception specialists will encourage (even insist) that you test the deception realism in your environment after you implement it. Not only does this validate that the deception is ‘working’ to meet your business objectives, but it will give you useful metrics like time-to-decieve, deception engagement time, coverage, and kill-chain hit ratios.

\n

The Fix: Blind test the strategy underlying your deception technology deployment. See how ‘real’ your simulated adversary believes the decoys are. Did you miss something? This is worth doing regularly.

\n

 

\n

5. Your Deception is Not Customised

\n

The best way to increase deception engagement time is to customise the decoys to your environment. There are a number of nifty tricks here (our MirageMaker feature does a lot of this for you), but never underestimate the power of human ingenuity.

\n

The Fix: Find the most devious folks in your infosec team and brainstorm how you can decieve, degrade, deny, disrupt, and dazzle an attacker even better. You want your deception to maximise the economic burden to the attacker in terms of time, effort, and cognitive load.

\n

 

\n

6. You Don’t Know the ‘Deception Trifecta’

\n

Well planned deception systems unify three perspectives to quickly arrive at the root cause of an incident:

\n
    \n
  1. What is happening? (decoy telemetry)
    2. \n
  2. How is it happening? (endpoint forensics)
    3. \n
  3. Where else is it happening? (estate integrations / correlation)
    4. \n
\n

We call this the ‘deception trifecta’, and your entire strategy must be built around it.

\n

The Fix: Study the deception trifecta and determine how weak or strong you are on each side. Improve visibility, collection, and analysis speed for each perspective. Ensure supporting systems can flesh out context when deception systems alert you (e.g. do you have an updated asset inventory?)

\n

 

\n

7. Your Deception Provider Doesn’t ‘Get’ Strategy

\n

Remember IDS? DLP? NAC? cough SIEM cough?

\n

The success of cybersecurity technologies is pretty binary: Either they’re well implemented by people who knew how to do it right, or far more often, they’re a mess of false promises and mismatched expectations. If you’re just being sold a box, AMC, and product training, there’s a lot missing. Sure, you might make it work, but the onus should be on the vendor to ensure you operationalise deception capabilities and see success for stuff that matters to you (we do this for every customer, big or small).

\n

The Fix: Talk to your provider to understand the depth of their knowledge on deception technology deployments, adversarial thinking, and most importantly, how they’ll make it all work for you. Get into specifics. Speak to their people. Hint: if their title says ‘Sales’… well… caveat emptor 🙂

\n

 

\n

In Summary – How To Get It Right

\n
\n
    \n
  1. Identify what will hurt you, and where those assets reside
    2. \n
  2. Know how your enemy will likely traverse your environment
    3. \n
  3. Create a tactical plan for handling deception alerts
    4. \n
  4. Blind test your deception strategy regularly
    5. \n
  5. Customise your deception environment ‘by hand’
    6. \n
  6. Know the ‘Deception Trifecta’ and improve how you use it
    7. \n
  7. Choose a provider who will build a capability, not sell a box
    8. \n
\n

Deception technology is more than just a new way to detect lateral movement, privilege escalation, ransomware, data-theft or solve any other current cybersecurity woes. It’s a fundamentally different way of thinking about how you defend your organisation, irrespective of shiny boxes (ours or anybody else’s)!

\n

Avoid the mistakes above, and your security team will really see the benefits behind the hype. We have customers that now use deception as their ‘concertmaster‘ — the single most important pillar in their security stack, with everything else supporting it.

\n

At Smokescreen, we believe we’ve solved these problems through our technology, support, and experience. If you’d like to learn more about how we think it should be done, get in touch for a chat with our specialists!

\n

If you’re in the process of evaluating deception technology vendors, read our blog post on 10 questions you need to ask them or download our guide that dives deep into capabilities that make for a great deception solution.

\n\n\n

\n","excerpt":"Since there’s precious little information on how security teams can make deception implementations successful (some folks like to keep it a secret), there’s plenty that can go wrong. Here are 7 ways to completely botch your deployment of deception technology.\n","slug":"7-deadly-sins-how-to-fail-at-implementing-deception-technology","date":"2017-09-18T14:01:05.000Z","status":"publish","modified":"2020-01-05T09:25:57.000Z","wordpress_id":16912,"featured_media":{"id":"940f3e3f-92f9-56f6-91a1-525330dda41c","source_url":"https://ss-website-content-prod.s3.ap-south-1.amazonaws.com/wp-content/uploads/2017/09/failwin.png","alt_text":"Fail At Deception Technology","large":{"childImageSharp":{"fluid":{"base64":"data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAABQAAAAMCAIAAADtbgqsAAAACXBIWXMAABYlAAAWJQFJUiTwAAABqklEQVQoz41SW0sCURCeWf9E1FMEvUWa1/VumpnXzdveLFN3VZDKCsmgf9BT4ENkQUpBUA/9xObsLrpUD8HHYc4538x85zsD6OL/hZ0gW52BZeziwbrb9lsXtFL8M9k4pBx3yCD7bMlOP4ZSkKuDoEJOxEjaKmSCYiePyQKWj6DWQqGB8axJAFaSNrLmkHWOoOgo65jML/sTL1uDRp/OHQZQ7WNaIAKgN0r1QNLgsAl5iaF6AvU2+mPGE3wY3gOlB5VjdpUTGSpNkLvIJ4CL7lO0UpJOr8bth1lnMl3rXVA5LpFjzT0RzItI5dpD9/3z5XQ+eJytdoeMkCoCF8tQ8kZJap2Puk+vN/P3zbMxNedIOTnE76KgctSqf+2bvNx9fN2+fa4PRoyQFgB9MRIJogZlki1DQWayRQ0DcSZ7y4tUXe0xqUUFCgYoVrrMY2Y1CVB0TtIYZJ1dkB8Lw6l/SaVno9gxOUCG0VucAbD8jB1ASYFqk35r8RNLt91hpI8UOyC2mZeZsnluGxJarRn4NSTm5HgjGEyiJ2wQArYJc9mmzxX8e0LNEjZR32MQjkf1g0MQAAAAAElFTkSuQmCC","aspectRatio":1.680672268907563,"src":"/static/741aacdb6ba2e8df1b88b93b521715a6/ee604/failwin.png","srcSet":"/static/741aacdb6ba2e8df1b88b93b521715a6/69585/failwin.png 200w,\n/static/741aacdb6ba2e8df1b88b93b521715a6/497c6/failwin.png 400w,\n/static/741aacdb6ba2e8df1b88b93b521715a6/ee604/failwin.png 800w,\n/static/741aacdb6ba2e8df1b88b93b521715a6/a8378/failwin.png 1024w","srcWebp":"/static/741aacdb6ba2e8df1b88b93b521715a6/58556/failwin.webp","srcSetWebp":"/static/741aacdb6ba2e8df1b88b93b521715a6/61e93/failwin.webp 200w,\n/static/741aacdb6ba2e8df1b88b93b521715a6/1f5c5/failwin.webp 400w,\n/static/741aacdb6ba2e8df1b88b93b521715a6/58556/failwin.webp 800w,\n/static/741aacdb6ba2e8df1b88b93b521715a6/cc834/failwin.webp 1024w","sizes":"(max-width: 800px) 100vw, 800px"}}},"medium":{"childImageSharp":{"fluid":{"base64":"data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAABQAAAAMCAIAAADtbgqsAAAACXBIWXMAABYlAAAWJQFJUiTwAAABqklEQVQoz41SW0sCURCeWf9E1FMEvUWa1/VumpnXzdveLFN3VZDKCsmgf9BT4ENkQUpBUA/9xObsLrpUD8HHYc4538x85zsD6OL/hZ0gW52BZeziwbrb9lsXtFL8M9k4pBx3yCD7bMlOP4ZSkKuDoEJOxEjaKmSCYiePyQKWj6DWQqGB8axJAFaSNrLmkHWOoOgo65jML/sTL1uDRp/OHQZQ7WNaIAKgN0r1QNLgsAl5iaF6AvU2+mPGE3wY3gOlB5VjdpUTGSpNkLvIJ4CL7lO0UpJOr8bth1lnMl3rXVA5LpFjzT0RzItI5dpD9/3z5XQ+eJytdoeMkCoCF8tQ8kZJap2Puk+vN/P3zbMxNedIOTnE76KgctSqf+2bvNx9fN2+fa4PRoyQFgB9MRIJogZlki1DQWayRQ0DcSZ7y4tUXe0xqUUFCgYoVrrMY2Y1CVB0TtIYZJ1dkB8Lw6l/SaVno9gxOUCG0VucAbD8jB1ASYFqk35r8RNLt91hpI8UOyC2mZeZsnluGxJarRn4NSTm5HgjGEyiJ2wQArYJc9mmzxX8e0LNEjZR32MQjkf1g0MQAAAAAElFTkSuQmCC","aspectRatio":1.6865671641791045,"src":"/static/741aacdb6ba2e8df1b88b93b521715a6/62b1f/failwin.png","srcSet":"/static/741aacdb6ba2e8df1b88b93b521715a6/e7519/failwin.png 113w,\n/static/741aacdb6ba2e8df1b88b93b521715a6/7e7e9/failwin.png 225w,\n/static/741aacdb6ba2e8df1b88b93b521715a6/62b1f/failwin.png 450w,\n/static/741aacdb6ba2e8df1b88b93b521715a6/e2e7f/failwin.png 675w,\n/static/741aacdb6ba2e8df1b88b93b521715a6/db955/failwin.png 900w,\n/static/741aacdb6ba2e8df1b88b93b521715a6/a8378/failwin.png 1024w","srcWebp":"/static/741aacdb6ba2e8df1b88b93b521715a6/b8a88/failwin.webp","srcSetWebp":"/static/741aacdb6ba2e8df1b88b93b521715a6/3a3bf/failwin.webp 113w,\n/static/741aacdb6ba2e8df1b88b93b521715a6/975bf/failwin.webp 225w,\n/static/741aacdb6ba2e8df1b88b93b521715a6/b8a88/failwin.webp 450w,\n/static/741aacdb6ba2e8df1b88b93b521715a6/761da/failwin.webp 675w,\n/static/741aacdb6ba2e8df1b88b93b521715a6/210c1/failwin.webp 900w,\n/static/741aacdb6ba2e8df1b88b93b521715a6/cc834/failwin.webp 1024w","sizes":"(max-width: 450px) 100vw, 450px"}}}},"author":{"id":"9257cd1e-ca7f-578b-a2dd-9c2e74282caf","name":"Smokescreen Team"}}},{"node":{"id":"faa742a1-4c12-586e-9304-8a6f65d02427","title":"10 Questions To Ask Deception Technology Vendors","content":"

In order for you to cut through the marketing hype, here’s a set of evaluation questions to ask deception technology vendors that will help you better understand disparate offerings.

\n
    \n
  1. Are their decoys individually unique?
    \nWhile this seems like a no-brainer, there are many deception technology vendors that don’t actually have solutions with the ability to run individually unique application services. In other words, if you deploy 100 FTP decoys, they’re all really pointing to the same FTP servers over and over again! Not very realistic is it? A modern platform will use advances in virtualisation technology to create unique, real decoy services that can be customised individually. Some providers rely on emulations (not the real thing!) in order for them to scale. They then ‘hand off’ the attacker’s interaction to a real virtual machine. Why compromise with emulations when the capability to offer real services at scale exists?
    2. \n
  2. How do they create fake content in their decoys?
    \nIt’s great to see a couple of perfectly configured decoys in a proof-of-concept, but how do different deception technology vendors create fake content and realistic application layer data for hundreds or thousands of decoys? If you try to configure these many systems by hand, you’ll either take forever, or will have mediocre deception realism. Human’s (especially short-staffed security teams) aren’t good at creating mass fake, believable content, and attackers are great at identifying stuff that’s poorly created.
    3. \n
  3. What parts of the kill-chain do they really cover?
    \nKill-chain coverage is an often touted feature, but you need to dig a bit deeper to understand what’s really going on. A good platform will do everything from recon phase, front-of-firewall decoys (that don’t trigger on every random Internet probe), to fake personas (email addresses), and fake data. Deception is far more than a few network decoys and breadcrumbs, so make sure the deception technology vendor you select is truly full-stack.
    4. \n
  4. How do they deploy deception at scale, such as in multi-geography environments?
    \nDo you need a large number of appliances to cover different branches, or do you have to modify your network to create GRE tunnels / VPNs? Some deception technology vendors avoid the multi-location problem altogether by claiming endpoint lures are sufficient (they’re not). A good platform will allow you to deploy decoy network services in remote locations without any of these hassles.
    5. \n
  5. Do they require agents or administrative rights?
    \nDo you need to run agents on all or most of your endpoint fleet in order to benefit from many of the features? Additionally, do you have to have administrative rights to deploy endpoint features? None of these are required for effective deception.
    6. \n
  6. How real are their decoys?
    \nIf it isn’t fooling you, it isn’t fooling the bad-guy. The decoys should be so real that your in-house red-team should fall for them. In fact, we encourage you to do exactly that when comparing solutions — have your own folks rate how ‘real’ the deception looks. This also means that there should be high-interaction environments like RDP and SSH, where a human attacker (not just commodity malware) can run whatever code they like, while you have full telemetry and visibility into their actions.
    7. \n
  7. What is their experience running actual deception campaigns?
    \nNo matter what anyone tells you, deception is more than just the technology. This is actually just common sense; the technology exists to implement a believable deception strategy and overall campaign. Speak to your provider to evaluate their experience with planning, setting up, and managing these campaigns. Good providers will have the expertise and experience of what works in the real world, and what doesn’t. If you plug a deception platform into any reasonably large network, you’ll get hits from commodity infections such as legacy worms scanning subnets and so on. This sounds great, but it’s not really what you’re trying to stop. Ask them about the heritage of their platform. Where has it succeeded for other people?
    8. \n
  8. How good is their offensive R&D?
    \nIt’s no surprise that most deception technology proponents come from either a red team or threat hunting background. The technology is the red teamer’s answer to ‘what would work best against you?’. An active red team practice means that the provider is up to date with (or even inventing) what the bad guy does next, and their ability to ‘think adversarially’ is the difference between deploying deception that doesn’t really hurt the bad guys, versus dirty tricks that really cause them pain.
    9. \n
  9. How good is the security of their deception platform?
    \nWhen an attacker moves laterally and attacks a decoy system, you want them to be successful so that you can collect threat intelligence and indicators of compromise. What you don’t want them to do is to exploit the decoys to target other systems. This means platform security of the deception solution is extremely important. The architecture of some providers even ends up routing VLANs, meaning an attacker can bypass your access control through the decoy! You also must evaluate the base operating platform security to ensure the attacker cannot compromise the decoy host appliance. Container virtualisation is often used to create decoys insecurely, this can lead to the attacker escalating privileges out of the decoy and onto the deception appliance.
    10. \n
  10. What do they do to contain and remediate?
    \nSo now you’re getting meaningful alerts with low false positives. What’s the logical next step? You want to investigate the root-cause of the alert through digital forensics, and likely move to containment. Does the deception platform you’re evaluating only support forensics and containment through third-party products? If so, you’ll need to purchase another tool just to respond to the alerts. Do they offer quality DFIR capabilities for your endpoints out of the box?
    11. \n
  11. [Bonus!] How will they help you build a deception capability, not just implement a technology?
    \nDeception is very similar to threat-hunting; the technology exists to automate and help implement decoys, traps, lures, bait and honeypots, but if you’re not planning your overall strategy around deception, then you’re investing in a box, not a capability. A truly effective deception capability covers the technology, risk-modelling, deception story-building, and post-deception alert management. Make sure you’re not just buying a technology, but are building a fundamentally new capability in your security team.
    12. \n
\n

If you’re currently evaluating deception technology vendors, we’ve written a guide that goes deeper into some of the questions that we’ve listed above. You can download it here.

\n","excerpt":"Deception technology is a major buzzword today. In order for you to cut through the marketing hype, here’s a set of evaluation questions that will help you better understand disparate deception offerings and identify vendors that know what they’re doing.\n","slug":"10-questions-to-ask-your-deception-technology-provider","date":"2017-09-18T12:58:47.000Z","status":"publish","modified":"2020-01-05T09:26:06.000Z","wordpress_id":16901,"featured_media":{"id":"cbfa76e5-6c88-57a7-a370-c16bd4df05ad","source_url":"https://ss-website-content-prod.s3.ap-south-1.amazonaws.com/wp-content/uploads/2017/09/10questions-1.png","alt_text":"Deception technology vendors","large":{"childImageSharp":{"fluid":{"base64":"data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAABQAAAANCAYAAACpUE5eAAAACXBIWXMAABYlAAAWJQFJUiTwAAACrklEQVQ4y51TS0+TURCdyyNpXBjUoEaNJG40UWIiMcbyKPZNH7bFttDSUqSFlvKwhdIGKOVRKUVolYiiGNSNG1f+w+NMrzFx62Lud7/7nTnfnZlzqPOJCWS0gIacIIsXZA+AXCGQNwLyT4ACcdDopA7Z+/jMO64xguUcJblPzTBwUKeRl0E7lNkDJQB3mJOimiD0EjSWAo3P6JC9nMk3wQiWcyRXOAwDNibkRQ2PgKw+0EgQ9DyqbxJOgqKzoNgcRxYU55jIaGL5JhjB8k2Vzdeq0DDkALUP8mLyot3Jt/NwKb6YToww2eQCKJkHpVdBMyugWX6mlvW3aFqTCqFUxmF45gJddVqxWX2AlZ1HCBcGQFPLUNvvQOUjULEGanwF1T6BDs9Bm0293zkGrR2Att7ys65xi2UYzG5Qx7ALx427OPt4j0n7QEuboPoZqPkdtM/J57/0e+Mb6OALkzZApz9BpX1+5/P3PzSuuAeDjwfZZnLhTsgO27wZvSmecjjTuqFa2dU3qjShqh84TqA2DqFyW/zTMmj1NVSmCMW9VckcaDoHg3OUhyJ1W3lj5f65uSfBKT3NCR7GtPSvCJrf4FjXPZSz+LzuY4Cn7R4D2fygYTf3kEvu5An3z+XRl83DW6nhYW4dxnINpt0Gest12Juf8XjvGP31E9iOTmE/OEFvqQrL9hsYSzsYLFTgWa/ifmIOFywsnw6e8iVPGN3BBG7FM7gSS+PiZBY9CyV0pQu4vrSBa6/K6Clso2e5gpuLa7icyqMrkUU342/EZnE7kmxxGER+okMS6Yg4W8LmEvzijoTWXITlEc3okDJFg0EWtz+msZIjpQ7YtQ61UxzaKY5RKFa/YheoFwkodoXifiomboXsQ9NQ7JQWRrCOANrEsn+d8sfL6n+9bP7Xy78B/QzPO9OV/CAAAAAASUVORK5CYII=","aspectRatio":1.5267175572519085,"src":"/static/b18c94100d3b034bc59158680ab07e07/ee604/10questions-1.png","srcSet":"/static/b18c94100d3b034bc59158680ab07e07/69585/10questions-1.png 200w,\n/static/b18c94100d3b034bc59158680ab07e07/497c6/10questions-1.png 400w,\n/static/b18c94100d3b034bc59158680ab07e07/ee604/10questions-1.png 800w,\n/static/b18c94100d3b034bc59158680ab07e07/a8378/10questions-1.png 1024w","srcWebp":"/static/b18c94100d3b034bc59158680ab07e07/58556/10questions-1.webp","srcSetWebp":"/static/b18c94100d3b034bc59158680ab07e07/61e93/10questions-1.webp 200w,\n/static/b18c94100d3b034bc59158680ab07e07/1f5c5/10questions-1.webp 400w,\n/static/b18c94100d3b034bc59158680ab07e07/58556/10questions-1.webp 800w,\n/static/b18c94100d3b034bc59158680ab07e07/cc834/10questions-1.webp 1024w","sizes":"(max-width: 800px) 100vw, 800px"}}},"medium":{"childImageSharp":{"fluid":{"base64":"data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAABQAAAANCAYAAACpUE5eAAAACXBIWXMAABYlAAAWJQFJUiTwAAACrklEQVQ4y51TS0+TURCdyyNpXBjUoEaNJG40UWIiMcbyKPZNH7bFttDSUqSFlvKwhdIGKOVRKUVolYiiGNSNG1f+w+NMrzFx62Lud7/7nTnfnZlzqPOJCWS0gIacIIsXZA+AXCGQNwLyT4ACcdDopA7Z+/jMO64xguUcJblPzTBwUKeRl0E7lNkDJQB3mJOimiD0EjSWAo3P6JC9nMk3wQiWcyRXOAwDNibkRQ2PgKw+0EgQ9DyqbxJOgqKzoNgcRxYU55jIaGL5JhjB8k2Vzdeq0DDkALUP8mLyot3Jt/NwKb6YToww2eQCKJkHpVdBMyugWX6mlvW3aFqTCqFUxmF45gJddVqxWX2AlZ1HCBcGQFPLUNvvQOUjULEGanwF1T6BDs9Bm0293zkGrR2Att7ys65xi2UYzG5Qx7ALx427OPt4j0n7QEuboPoZqPkdtM/J57/0e+Mb6OALkzZApz9BpX1+5/P3PzSuuAeDjwfZZnLhTsgO27wZvSmecjjTuqFa2dU3qjShqh84TqA2DqFyW/zTMmj1NVSmCMW9VckcaDoHg3OUhyJ1W3lj5f65uSfBKT3NCR7GtPSvCJrf4FjXPZSz+LzuY4Cn7R4D2fygYTf3kEvu5An3z+XRl83DW6nhYW4dxnINpt0Gest12Juf8XjvGP31E9iOTmE/OEFvqQrL9hsYSzsYLFTgWa/ifmIOFywsnw6e8iVPGN3BBG7FM7gSS+PiZBY9CyV0pQu4vrSBa6/K6Clso2e5gpuLa7icyqMrkUU342/EZnE7kmxxGER+okMS6Yg4W8LmEvzijoTWXITlEc3okDJFg0EWtz+msZIjpQ7YtQ61UxzaKY5RKFa/YheoFwkodoXifiomboXsQ9NQ7JQWRrCOANrEsn+d8sfL6n+9bP7Xy78B/QzPO9OV/CAAAAAASUVORK5CYII=","aspectRatio":1.527027027027027,"src":"/static/b18c94100d3b034bc59158680ab07e07/62b1f/10questions-1.png","srcSet":"/static/b18c94100d3b034bc59158680ab07e07/e7519/10questions-1.png 113w,\n/static/b18c94100d3b034bc59158680ab07e07/7e7e9/10questions-1.png 225w,\n/static/b18c94100d3b034bc59158680ab07e07/62b1f/10questions-1.png 450w,\n/static/b18c94100d3b034bc59158680ab07e07/e2e7f/10questions-1.png 675w,\n/static/b18c94100d3b034bc59158680ab07e07/db955/10questions-1.png 900w,\n/static/b18c94100d3b034bc59158680ab07e07/a8378/10questions-1.png 1024w","srcWebp":"/static/b18c94100d3b034bc59158680ab07e07/b8a88/10questions-1.webp","srcSetWebp":"/static/b18c94100d3b034bc59158680ab07e07/3a3bf/10questions-1.webp 113w,\n/static/b18c94100d3b034bc59158680ab07e07/975bf/10questions-1.webp 225w,\n/static/b18c94100d3b034bc59158680ab07e07/b8a88/10questions-1.webp 450w,\n/static/b18c94100d3b034bc59158680ab07e07/761da/10questions-1.webp 675w,\n/static/b18c94100d3b034bc59158680ab07e07/210c1/10questions-1.webp 900w,\n/static/b18c94100d3b034bc59158680ab07e07/cc834/10questions-1.webp 1024w","sizes":"(max-width: 450px) 100vw, 450px"}}}},"author":{"id":"9257cd1e-ca7f-578b-a2dd-9c2e74282caf","name":"Smokescreen Team"}}},{"node":{"id":"f97c1999-2d51-531f-96b6-fb52e7dd7acc","title":"In Defence of Signatures – They Don’t Suck","content":"

You’ve heard it before — Signatures suck.

\n

This trope is so common that you even have RFPs specifically banishing signatures as if they’re some shameful pariah step-child.

\n

It’s a Friday evening, so we’ve decided to step up and defend the undefended. As is typical in our hype-fuelled industry, there’s more to be explored and understood here.

\n

Detection v/s Identification

\n

It’s a matter of language. You see, signatures are far from bad. Their miserable reputation stems from the company they kept in school — that nasty second word, ‘detection’.

\n

Let’s get this out of the way — ‘detecting’ stuff with static signatures is usually, always A Bad Thing (™), but ‘identifying’ stuff with signatures actually rocks. Very hard.

\n

Here’s an experiment. You’ve been given a 10 GB PCAP. There are (at least) three attacks going on. How are you going to identify what they are?

\n

Go on… dice that baby like Martin Yan with Wireshark… whip out your hex-editor, conjure up your disassembler, use Solarized as a colorscheme if you’re getting really hardcore. Time yourself, you maestro of packets…

\n

Now go: snort -r foo.pcap

\n

In this case, you’re detecting AND identifying the bad stuff with signatures. A small modification to the attack would obviously mean you miss detecting it (very bad).

\n

However, if you have an alternate detection approach (e.g. behaviour, deception, anomaly detection, in this case, perhaps Bro-IDS), then signatures become very useful for the ‘identification‘ part. They let you very quickly pull out things that we already know are bad.

\n

You don’t see DFIR folks hating on Yara do you? Of course not… it’s using signatures to identify what we already know is bad (if you’re using it for detection, that’s a problem).

\n

So signatures rock. That’s right, we said it. They’re like selfie sticks — to be used at an appropriate time.

\n

But My bandwidth!

\n

Okay, so besides hating on the brittle-ness of detection, what else do people dislike about signatures?

\n

There’s that old antivirus bug-bear of ‘updates’ — thousands of endpoints slavishly pulling down the latest sigs. Very 90’s.

\n

Once again, this doesn’t matter if you’re doing centralised identification. You’ve got (probably) a single system pulling down a daily update, or some solution up in the cloud. As long as it’s not pushing stuff to your nodes and chewing bandwidth, why do you care?

\n

That signature update is going to take the hard work off your analysts to instantly identify stuff that we already know how to deal with. Suddenly sounds like a winning proposition.

\n

Hello Pot, Meet Kettle…

\n

Ask your DFIR rockstar what’s the first place she goes with a shiny new malware sample. Chances are, you’ll hear VirusTotal (yeah, yeah, caveats of non-sharing samples, and in-house analysis platforms aside).

\n

Sure, there’s a lot of heuristics and fancy detection mechanisms on there now, but often she’s just looking for that quick flag on ‘Riskware/PsExec’. What’s wrong with that?

\n

Fun thought: Why do so many vendors that claims behavioural / ML / what-have-you approaches finally plug into everyone’s favourite multi-AV scanner? Beyond the marketing hype, there’s definitely signatures involved.

\n

Make Signatures Great Again

\n

So somewhat tongue-in-cheek, let’s all promise to insist that solutions use signatures for identification, and restore them to their rightful place in the cybersecurity pantheon.

\n

To all the IDS and malware analysts sweating away over unique byte sequences — we salute you!

\n

Next week: We defend MD5 and PERL scripts /sarcasm.

\n

Disclosure #1: Smokescreen only ever detects stuff with deception because that’s just how we like to roll; but of course we love using signatures to identify naughty things. Ignoring them would be plain stupid. We do, however, really enjoy arguing against conventional wisdom.

\n

Disclosure #2: Smokescreen doesn’t actually believe there’s ever an appropriate time for selfie sticks. Unfortunately, our head of engineering disagrees.

\n","excerpt":"Signatures take a beating in most conversations in security. What, if anything, are they actually good for, then? Team Smokescreen stands up for the rights of the humble signature, explaining why they’re misapplied and how to better use them for defence\n","slug":"signatures-rock-defending-a-cybersecurity-whipping-boy","date":"2017-09-15T19:09:27.000Z","status":"publish","modified":"2020-12-29T04:54:10.000Z","wordpress_id":16920,"featured_media":{"id":"d1c3c2bb-1c00-5605-a9e9-1f37683e94bc","source_url":"https://ss-website-content-prod.s3.ap-south-1.amazonaws.com/wp-content/uploads/2017/09/fingerprint.jpg","alt_text":"Signatures can be extremely useful when used right.","large":{"childImageSharp":{"fluid":{"base64":"data:image/jpeg;base64,/9j/2wBDABALDA4MChAODQ4SERATGCgaGBYWGDEjJR0oOjM9PDkzODdASFxOQERXRTc4UG1RV19iZ2hnPk1xeXBkeFxlZ2P/2wBDARESEhgVGC8aGi9jQjhCY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2P/wgARCAANABQDASIAAhEBAxEB/8QAFgABAQEAAAAAAAAAAAAAAAAAAAUE/8QAFQEBAQAAAAAAAAAAAAAAAAAAAQP/2gAMAwEAAhADEAAAAYVCdoZZQV//xAAZEAADAQEBAAAAAAAAAAAAAAABAgMAERL/2gAIAQEAAQUCVfRpILPKeF6lxv/EABgRAAIDAAAAAAAAAAAAAAAAAAECEBEh/9oACAEDAQE/AWDXkf/EABURAQEAAAAAAAAAAAAAAAAAAAEQ/9oACAECAQE/ASf/xAAXEAADAQAAAAAAAAAAAAAAAAAAEBEB/9oACAEBAAY/AnSav//EABoQAQACAwEAAAAAAAAAAAAAAAEAEBEhMUH/2gAIAQEAAT8hYAi9xs9pDHSY46r/2gAMAwEAAgADAAAAEL/P/8QAFhEBAQEAAAAAAAAAAAAAAAAAARBB/9oACAEDAQE/EGHE/8QAFxEBAAMAAAAAAAAAAAAAAAAAARARIf/aAAgBAgEBPxBFbH//xAAbEAEAAgIDAAAAAAAAAAAAAAABABEhMUFRYf/aAAgBAQABPxAu7VqpUw1e1juYxUsg0GXDWe47n//Z","aspectRatio":1.5384615384615385,"src":"/static/1e9030bcb015fe2dbbc34531d6dbe086/14b42/fingerprint.jpg","srcSet":"/static/1e9030bcb015fe2dbbc34531d6dbe086/f836f/fingerprint.jpg 200w,\n/static/1e9030bcb015fe2dbbc34531d6dbe086/2244e/fingerprint.jpg 400w,\n/static/1e9030bcb015fe2dbbc34531d6dbe086/14b42/fingerprint.jpg 800w,\n/static/1e9030bcb015fe2dbbc34531d6dbe086/32a41/fingerprint.jpg 923w","srcWebp":"/static/1e9030bcb015fe2dbbc34531d6dbe086/58556/fingerprint.webp","srcSetWebp":"/static/1e9030bcb015fe2dbbc34531d6dbe086/61e93/fingerprint.webp 200w,\n/static/1e9030bcb015fe2dbbc34531d6dbe086/1f5c5/fingerprint.webp 400w,\n/static/1e9030bcb015fe2dbbc34531d6dbe086/58556/fingerprint.webp 800w,\n/static/1e9030bcb015fe2dbbc34531d6dbe086/cddad/fingerprint.webp 923w","sizes":"(max-width: 800px) 100vw, 800px"}}},"medium":{"childImageSharp":{"fluid":{"base64":"data:image/jpeg;base64,/9j/2wBDABALDA4MChAODQ4SERATGCgaGBYWGDEjJR0oOjM9PDkzODdASFxOQERXRTc4UG1RV19iZ2hnPk1xeXBkeFxlZ2P/2wBDARESEhgVGC8aGi9jQjhCY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2P/wgARCAANABQDASIAAhEBAxEB/8QAFgABAQEAAAAAAAAAAAAAAAAAAAUE/8QAFQEBAQAAAAAAAAAAAAAAAAAAAQP/2gAMAwEAAhADEAAAAYVCdoZZQV//xAAZEAADAQEBAAAAAAAAAAAAAAABAgMAERL/2gAIAQEAAQUCVfRpILPKeF6lxv/EABgRAAIDAAAAAAAAAAAAAAAAAAECEBEh/9oACAEDAQE/AWDXkf/EABURAQEAAAAAAAAAAAAAAAAAAAEQ/9oACAECAQE/ASf/xAAXEAADAQAAAAAAAAAAAAAAAAAAEBEB/9oACAEBAAY/AnSav//EABoQAQACAwEAAAAAAAAAAAAAAAEAEBEhMUH/2gAIAQEAAT8hYAi9xs9pDHSY46r/2gAMAwEAAgADAAAAEL/P/8QAFhEBAQEAAAAAAAAAAAAAAAAAARBB/9oACAEDAQE/EGHE/8QAFxEBAAMAAAAAAAAAAAAAAAAAARARIf/aAAgBAgEBPxBFbH//xAAbEAEAAgIDAAAAAAAAAAAAAAABABEhMUFRYf/aAAgBAQABPxAu7VqpUw1e1juYxUsg0GXDWe47n//Z","aspectRatio":1.547945205479452,"src":"/static/1e9030bcb015fe2dbbc34531d6dbe086/32fd5/fingerprint.jpg","srcSet":"/static/1e9030bcb015fe2dbbc34531d6dbe086/06e94/fingerprint.jpg 113w,\n/static/1e9030bcb015fe2dbbc34531d6dbe086/07ab6/fingerprint.jpg 225w,\n/static/1e9030bcb015fe2dbbc34531d6dbe086/32fd5/fingerprint.jpg 450w,\n/static/1e9030bcb015fe2dbbc34531d6dbe086/4a838/fingerprint.jpg 675w,\n/static/1e9030bcb015fe2dbbc34531d6dbe086/9842e/fingerprint.jpg 900w,\n/static/1e9030bcb015fe2dbbc34531d6dbe086/32a41/fingerprint.jpg 923w","srcWebp":"/static/1e9030bcb015fe2dbbc34531d6dbe086/b8a88/fingerprint.webp","srcSetWebp":"/static/1e9030bcb015fe2dbbc34531d6dbe086/3a3bf/fingerprint.webp 113w,\n/static/1e9030bcb015fe2dbbc34531d6dbe086/975bf/fingerprint.webp 225w,\n/static/1e9030bcb015fe2dbbc34531d6dbe086/b8a88/fingerprint.webp 450w,\n/static/1e9030bcb015fe2dbbc34531d6dbe086/761da/fingerprint.webp 675w,\n/static/1e9030bcb015fe2dbbc34531d6dbe086/210c1/fingerprint.webp 900w,\n/static/1e9030bcb015fe2dbbc34531d6dbe086/cddad/fingerprint.webp 923w","sizes":"(max-width: 450px) 100vw, 450px"}}}},"author":{"id":"9257cd1e-ca7f-578b-a2dd-9c2e74282caf","name":"Smokescreen Team"}}},{"node":{"id":"0b6fe724-d0b1-5b1a-a31b-daeeb17e0310","title":"Deception and Kerckhoffs’s Cryptographic Principle","content":"

Conceptually, deception is an incredibly intuitive approach to cybersecurity. The parallels between deception in the real-world, and deception in cyberspace are clear and easy to understand. However, in the digital battlefield it’s far more nuanced — it’s easy to do it badly, and far harder to get it right. Which makes it rather similar to a more traditional security practice — cryptography.

\n

Cryptographers are familiar with a well-known axiom called Kerckhoff’s principle, which states:

\n

A cryptosystem should be secure even if everything about the system, except the key, is public knowledge.

\n

This was famously paraphrased by Claude Shannon in what is known as Shannon’s Maxim:

\n

“The enemy knows the system“, i.e., “one ought to design systems under the assumption that the enemy will immediately gain full familiarity with them“

\n

The applicability to deception is immediately apparent. It should remain effective, even when an attacker:

\n\n

However, the exact map of the minefield — the specific placement of decoys, their running services, and their content is not known. This deception map is the equivalent of the secret key in a crypto-system. As long as the map is not known to the attacker, the illusion should still remain extremely effective, despite the attacker having complete visibility into the rest of the system.

\n

At Smokescreen, we are laser focused on making sure deception is ‘done right’ — with the necessary rigour and formal reasoning to hold up in real-world conditions. How do we do this? Our depth of experience in related cybersecurity disciplines is our secret weapon. We apply hard earned knowledge from red-teaming, asymmetric thinking, threat hunting, cryptography and incident response to build the most formidable and effective deception system available.

\n","excerpt":"The parallels between deception in the real-world, and deception in cyberspace are clear and easy to understand. However, deception in the digital battlefield is far more nuanced — it’s easy to do it badly, and far harder to get it right. Which makes it rather similar to a more traditional security practice — cryptography.\n","slug":"deception-and-kerckhoffss-cryptographic-principle","date":"2017-02-16T10:50:52.000Z","status":"publish","modified":"2020-01-06T07:05:07.000Z","wordpress_id":16772,"featured_media":{"id":"c7ca7a31-c5f1-5880-8111-9cbfd1198f24","source_url":"https://ss-website-content-prod.s3.ap-south-1.amazonaws.com/wp-content/uploads/2017/02/Enigma-plugboard.jpg","alt_text":"Deception","large":{"childImageSharp":{"fluid":{"base64":"data:image/jpeg;base64,/9j/2wBDABALDA4MChAODQ4SERATGCgaGBYWGDEjJR0oOjM9PDkzODdASFxOQERXRTc4UG1RV19iZ2hnPk1xeXBkeFxlZ2P/2wBDARESEhgVGC8aGi9jQjhCY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2P/wgARCAAOABQDASIAAhEBAxEB/8QAFwAAAwEAAAAAAAAAAAAAAAAAAAMEBf/EABYBAQEBAAAAAAAAAAAAAAAAAAIAAf/aAAwDAQACEAMQAAABQ6NgWaUG3//EABoQAAIDAQEAAAAAAAAAAAAAAAECAAMRBBL/2gAIAQEAAQUC5l8LaodDWwK7DsKHf//EABURAQEAAAAAAAAAAAAAAAAAAAAR/9oACAEDAQE/AUf/xAAVEQEBAAAAAAAAAAAAAAAAAAAAEf/aAAgBAgEBPwFX/8QAGRABAAIDAAAAAAAAAAAAAAAAAQAhAhIg/9oACAEBAAY/AryLibnP/8QAGhABAAMBAQEAAAAAAAAAAAAAAQARITFBYf/aAAgBAQABPyEVqOqJ0KesQFX9GbGx0OTQKn//2gAMAwEAAgADAAAAEDzP/8QAFREBAQAAAAAAAAAAAAAAAAAAARD/2gAIAQMBAT8QCf/EABURAQEAAAAAAAAAAAAAAAAAAAEQ/9oACAECAQE/EFn/xAAbEAEBAAMBAQEAAAAAAAAAAAABEQAhMcFxkf/aAAgBAQABPxAAdtioQ7gVpEDn5kg4eBH5gNDyQ5wxJMSOmeY1IR3LfM//2Q==","aspectRatio":1.4705882352941178,"src":"/static/33488cec05051fdb0cde315fb03b25b1/14b42/Enigma-plugboard.jpg","srcSet":"/static/33488cec05051fdb0cde315fb03b25b1/f836f/Enigma-plugboard.jpg 200w,\n/static/33488cec05051fdb0cde315fb03b25b1/2244e/Enigma-plugboard.jpg 400w,\n/static/33488cec05051fdb0cde315fb03b25b1/14b42/Enigma-plugboard.jpg 800w,\n/static/33488cec05051fdb0cde315fb03b25b1/a1fc1/Enigma-plugboard.jpg 921w","srcWebp":"/static/33488cec05051fdb0cde315fb03b25b1/58556/Enigma-plugboard.webp","srcSetWebp":"/static/33488cec05051fdb0cde315fb03b25b1/61e93/Enigma-plugboard.webp 200w,\n/static/33488cec05051fdb0cde315fb03b25b1/1f5c5/Enigma-plugboard.webp 400w,\n/static/33488cec05051fdb0cde315fb03b25b1/58556/Enigma-plugboard.webp 800w,\n/static/33488cec05051fdb0cde315fb03b25b1/147d5/Enigma-plugboard.webp 921w","sizes":"(max-width: 800px) 100vw, 800px"}}},"medium":{"childImageSharp":{"fluid":{"base64":"data:image/jpeg;base64,/9j/2wBDABALDA4MChAODQ4SERATGCgaGBYWGDEjJR0oOjM9PDkzODdASFxOQERXRTc4UG1RV19iZ2hnPk1xeXBkeFxlZ2P/2wBDARESEhgVGC8aGi9jQjhCY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2P/wgARCAAOABQDASIAAhEBAxEB/8QAFwAAAwEAAAAAAAAAAAAAAAAAAAMEBf/EABYBAQEBAAAAAAAAAAAAAAAAAAIAAf/aAAwDAQACEAMQAAABQ6NgWaUG3//EABoQAAIDAQEAAAAAAAAAAAAAAAECAAMRBBL/2gAIAQEAAQUC5l8LaodDWwK7DsKHf//EABURAQEAAAAAAAAAAAAAAAAAAAAR/9oACAEDAQE/AUf/xAAVEQEBAAAAAAAAAAAAAAAAAAAAEf/aAAgBAgEBPwFX/8QAGRABAAIDAAAAAAAAAAAAAAAAAQAhAhIg/9oACAEBAAY/AryLibnP/8QAGhABAAMBAQEAAAAAAAAAAAAAAQARITFBYf/aAAgBAQABPyEVqOqJ0KesQFX9GbGx0OTQKn//2gAMAwEAAgADAAAAEDzP/8QAFREBAQAAAAAAAAAAAAAAAAAAARD/2gAIAQMBAT8QCf/EABURAQEAAAAAAAAAAAAAAAAAAAEQ/9oACAECAQE/EFn/xAAbEAEBAAMBAQEAAAAAAAAAAAABEQAhMcFxkf/aAAgBAQABPxAAdtioQ7gVpEDn5kg4eBH5gNDyQ5wxJMSOmeY1IR3LfM//2Q==","aspectRatio":1.4675324675324675,"src":"/static/33488cec05051fdb0cde315fb03b25b1/32fd5/Enigma-plugboard.jpg","srcSet":"/static/33488cec05051fdb0cde315fb03b25b1/06e94/Enigma-plugboard.jpg 113w,\n/static/33488cec05051fdb0cde315fb03b25b1/07ab6/Enigma-plugboard.jpg 225w,\n/static/33488cec05051fdb0cde315fb03b25b1/32fd5/Enigma-plugboard.jpg 450w,\n/static/33488cec05051fdb0cde315fb03b25b1/4a838/Enigma-plugboard.jpg 675w,\n/static/33488cec05051fdb0cde315fb03b25b1/9842e/Enigma-plugboard.jpg 900w,\n/static/33488cec05051fdb0cde315fb03b25b1/a1fc1/Enigma-plugboard.jpg 921w","srcWebp":"/static/33488cec05051fdb0cde315fb03b25b1/b8a88/Enigma-plugboard.webp","srcSetWebp":"/static/33488cec05051fdb0cde315fb03b25b1/3a3bf/Enigma-plugboard.webp 113w,\n/static/33488cec05051fdb0cde315fb03b25b1/975bf/Enigma-plugboard.webp 225w,\n/static/33488cec05051fdb0cde315fb03b25b1/b8a88/Enigma-plugboard.webp 450w,\n/static/33488cec05051fdb0cde315fb03b25b1/761da/Enigma-plugboard.webp 675w,\n/static/33488cec05051fdb0cde315fb03b25b1/210c1/Enigma-plugboard.webp 900w,\n/static/33488cec05051fdb0cde315fb03b25b1/147d5/Enigma-plugboard.webp 921w","sizes":"(max-width: 450px) 100vw, 450px"}}}},"author":{"id":"9257cd1e-ca7f-578b-a2dd-9c2e74282caf","name":"Smokescreen Team"}}}]},"costSectionImage":{"childImageSharp":{"fluid":{"base64":"data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAABQAAAANCAYAAACpUE5eAAAACXBIWXMAAAsTAAALEwEAmpwYAAADUklEQVQ4yzWSW2gcZRzFzzcze02y273OfWdnZ3dmr9mmSUsiaaJtV+0lNppaGmukTcEHgygWtS8iKAUFRSEvggj6JoJPPha1j74IfREUBC+ICIKgD2K7mfn7n10dOAzfzHy/Od/5H4xGDVzb6aPSaeeyhl2ZdepW2qx5Sd3qirK2JKnWCaHb56HZO9DMZ4Rm3YBm3YRq7kuq8aFQjU8yVv3LGct5F4AEuVyBVCofl8rqT6xfpKr+h6Sa/0iaSUK3SJgOgSVbdUrbLgmjRtBtYiihqk9VqvLa/A7HH/aAQinWCyiWCWV+UeYPVIM3WRFsNxQ1L4TjhTPNzkGx1T3g9QFDxwwdJwx7LFT9LooVgt34Gucv98ELBpbfQ4kfVrS7SaMWJq16lPH8SHJakahPJTfaLD8SthvBqEXsOso5XsTRhBOH9dbneHzXgmyYMfRWDEzxH3Nei3LNNhUGC5T1+wTXJ+EGJPFdbgTEQJIdj7IshaEczRTY7H6KK88VIfKVOT7u95wd5erNcC4IorQXUL6/QIeGiyS1eiS8DkN9Uvgu1RoTKXG2GsdS1SOUVULn8Pt45Z00RKHiMnCc4CHkXT+aZRfJoEf5zgLlh0skMxDsMHYn11sTh1LskqGp+Oj/AwdHb+LWN0qc3ygeiKyaYY6zyrd7UX7+MBXmj9CMP5g44wxJZqjitlj+ZOoZBiZjYEXj7PV7WFi+LhFxcw4Vn50ORL2Xc1vhXKcb5oJeWOwNo1SzG8FpRiJWrRGBh8XZRXIM0u2I2zB1pxp/4djaVcSXUlE/Ev9VRqgWZdwmzbTapLADxL2zG7HiqYYwWLodcnYhqgZLG087aP2G1dEmllaBREV9OuF4d9Kdwbey3/0x3Rv+qjSD36WG/2cq6P2d6Q7HuaMrlPK7pDiNScEli4tu2qRw7txhLrv9Mx58dA3nLgGnYpubO6s4e2kDDz22JU5uXBHrp/dw36mXxfIDr8srJ96SV+7fTyyvf5BcXPlYHix+JnXmv1Da/a+yQf9Ooub+kPL7t3Hm4hE8chkozWUFntwD1jeQeXVf4MbbCl58IyleejOD51+bxe71Ap7Y07B1zcGFXR9bV+ex+dQx3ryGje0Rzm2fwekL2+yuibMX8S+BMBcPGVLWLQAAAABJRU5ErkJggg==","aspectRatio":1.528735632183908,"src":"/static/739e365bb81f8bf83185927701d2793f/651c0/cost-image-2x.png","srcSet":"/static/739e365bb81f8bf83185927701d2793f/e223a/cost-image-2x.png 133w,\n/static/739e365bb81f8bf83185927701d2793f/66882/cost-image-2x.png 265w,\n/static/739e365bb81f8bf83185927701d2793f/651c0/cost-image-2x.png 530w,\n/static/739e365bb81f8bf83185927701d2793f/a384c/cost-image-2x.png 795w,\n/static/739e365bb81f8bf83185927701d2793f/c884a/cost-image-2x.png 1056w","srcWebp":"/static/739e365bb81f8bf83185927701d2793f/46494/cost-image-2x.webp","srcSetWebp":"/static/739e365bb81f8bf83185927701d2793f/a5ef1/cost-image-2x.webp 133w,\n/static/739e365bb81f8bf83185927701d2793f/4dc00/cost-image-2x.webp 265w,\n/static/739e365bb81f8bf83185927701d2793f/46494/cost-image-2x.webp 530w,\n/static/739e365bb81f8bf83185927701d2793f/5b747/cost-image-2x.webp 795w,\n/static/739e365bb81f8bf83185927701d2793f/950f5/cost-image-2x.webp 1056w","sizes":"(max-width: 530px) 100vw, 530px"}}}},"pageContext":{"id":"fc7069d9-c995-5ef5-8b85-8a6eef403d37","relatedPostsIDs":[16912,16772,18716,16901,16920]}},"staticQueryHashes":["1478079672"]}