![\"\"](\"https://internal-wp.smokescreen.io/wp-content/uploads/2021/05/Screenshot-2021-05-18-at-8.30.58-PM-813x1024.png\")
By now, you’ve probably been bulldozed with solution briefings, white papers, vendor pitches, and webinar invitations to discuss how this ransomware could have been stopped.
\n\n\n\nWe’ll do things a little differently. We’ll of course include our resources at the end of this post, because obviously we don’t want to be left behind. But we’ll first take you through what we’ve been saying about ransomware these last couple of months. I think it’ll help you understand where we’re coming from and why we recommend dealing with ransomware with a different mindset.
\n\n\n\nAs a company, we have been vocal about the threat of ransomware for a long time. We’ve seen it singularly wreak more havoc on organizations compared to any other single threat. So we decided to use our social platform to educate the infosec community about ransomware and how to defend against it.
\n\n\n\nHere’s us predicting the weaponisation of the Exchange vulnerabilities for ransomware ⏱
\n\n\n\n\n\n\n\nWe even launched a course focussed exclusively on ransomware 🎓
\n\n\n\n\n\n\n\nAnd then we said some more stuff about the impact of ransomware 🎯
\n\n\n\n\n\n\n\nWe even had a slide just about the consequences of ransomware 💣
\n\n\n\n![\"\"](\"https://internal-wp.smokescreen.io/wp-content/uploads/2021/05/Smokescreen-Consequences-of-ransomware.png\")
And then we wrote a paper on how to defend against it 📝
\n\n\n\n\n\n\n\nAnd made it publically accessible 📖
\n\n\n\n\n\n\n\nAnd then we said this about DARKSIDE 👇🏼
\n\n\n\n\n\n\n\nLet me clarify something here – This is not a ‘I told you so’ post. We are not oracles predicting the future. We have been on this trajectory of ransomware making front page news for years now, starting with Wannacry.
\n\n\n\nBut it’s not all doom and gloom.
\n\n\n\nThe DARKSIDE ransomware did not do anything radically different that can catch the security community off-guard.
\n\n\n\nWe know how most ransomware operates. Download the paper here.
\n\n\n\nWe know what we must do to defend against it.
\n\n\n\nWe simply need to start doing it.
\n\n\n\nHere are three things:
\n\n\n\nWhen analyzing attacker tactics and techniques, ask “Why?”. When you ask “Why?”, it opens up new avenues for guerilla-warfare-style defenses to combat ransomware.
\n\n\n\nI’ve enumerated over 40 approaches in the paper on messing with ransomware. Use deception to disrupt what the ransomware is trying to achieve, rather than trying to stop the usage of a specific tool. It’s easy to setup, doesn’t generate too much data, and has a much faster time to value. This statement may look like a vendor marketing plug but it’s not. If you check out MITRE Shield, you will see that the adoption of deception is vital to active defense against a use case like Ransomware.
\n\n\n\nReduce reliance on detection in only one part of the network, for example, stacking all the controls on the endpoint. Notice how many EDRs are now talking about XDR? It’s likely because it’s impossible to stop threats meaningfully only in one part of your environment. You need defenses across your environment. Active Defense-based deception does this already.
\n\n\n\nIrrespective of how you choose to tackle ransomware, here’s the one advise I’ll leave you with 🙏🏼
\n\n\n\n\n","excerpt":"By now, you’ve probably been bulldozed with solution briefings, white papers, vendor pitches, and webinar invitations to discuss how this ransomware could have been stopped. We’ll do things a little differently. We’ll of course include our resources at the end of this post, because obviously we don’t want to be left behind. But we’ll first […]\n","slug":"the-bright-side-of-the-darkside-ransomware","date":"2021-05-18T16:01:29.000Z","status":"publish","modified":"2021-05-18T16:19:33.000Z","wordpress_id":18782,"featured_media":{"id":"6a62504d-2791-5a4b-ad8a-4d13b155ef9f","source_url":"https://ss-website-content-prod.s3.ap-south-1.amazonaws.com/wp-content/uploads/2021/05/Smokescreen-Darkside-Ransomware.png","alt_text":"Smokescreen-Darkside-Ransomware","large":{"childImageSharp":{"fluid":{"base64":"data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAABQAAAALCAYAAAB/Ca1DAAAACXBIWXMAAAsTAAALEwEAmpwYAAACqklEQVQoz3WTvU9TURiHz72UQhTKrdzbW4EoUSwBtbQUKC2lYL+gUBFKKSDgB35C1Bi/aowmJhrjYGLUxcTBwcHBODg4uLkYYxyN0cF/wMXEhKgBuY+nxYFBh1/eM/1yznmeV1jW6jIg82v5/YsLy9dnKlev5gWFcdW6OCasQs7GsaFqIl6NBpeG7tRwav+PsCxKfS8fTjIVFCS9gkxAtQZ9ChMhheEOuyxzkug0CLTobK0z2GwauIx/R8g268ub+1Y+KKzjyXLr8pjNOrxHJdupWhGPYvU32wlscxBorqXPb+Bv1ql367h0HWN9ZFlxCmtliQ9PwtycVTg1VMaVMRuLKZWTMvt7VA5E7cwnmwi1NhAL6KTDDWzfYlLnNjFdLjbL6TbN0u2KU/z+/pnbBzdwqF+Q71EY71YYaFOJ7VYY8iuMyCcfTTcS3V1HZ7NGPt3O6HCCZCLOeDZLtLeXvZkM/X19dAQCiB9f33F+tIzFtMKl8XJm+1Rmogr5kHx2l8J0pIJMsIauFoPIrk0cmUowncswmZ9gIpcjI8visRhzc3Mk4nHEz2+feLCwkYdnqnhacHAipbAwaONaVqWQUbk8Uclgl5PQLjf7ovWcPZJiLhejNxKhJxwmHArh9/lKZe1+fxHKEs9ueMl3C+4cc3B3vpzH58q5NVvGtKSc8kkoHo3gTkOSNhnprafdU42zxoHD4aBGpqhLdVXVmjZFaT6+vsdMSHD3RCUXxso4mhRMyv8MNglJ2I53u0bbDr1EuUOq42mUMEwXLgmlCKYIxPx7/uvhCq8eTZVKU22CbLfK8QFF/qdgoN0ub6TR4zXweQwa6w0a3EVF1vmnr2lU8lBuCqVOfvH2+XkKuQoW0oLTGQkpK1gctjETrybYquGu1TBlauW2aP/ZlD8604JDURmM0wAAAABJRU5ErkJggg==","aspectRatio":1.9047619047619047,"src":"/static/a72a3afeb6a8b47ebe9708c9950bb690/ee604/Smokescreen-Darkside-Ransomware.png","srcSet":"/static/a72a3afeb6a8b47ebe9708c9950bb690/69585/Smokescreen-Darkside-Ransomware.png 200w,\n/static/a72a3afeb6a8b47ebe9708c9950bb690/497c6/Smokescreen-Darkside-Ransomware.png 400w,\n/static/a72a3afeb6a8b47ebe9708c9950bb690/ee604/Smokescreen-Darkside-Ransomware.png 800w,\n/static/a72a3afeb6a8b47ebe9708c9950bb690/f3583/Smokescreen-Darkside-Ransomware.png 1200w,\n/static/a72a3afeb6a8b47ebe9708c9950bb690/5707d/Smokescreen-Darkside-Ransomware.png 1600w,\n/static/a72a3afeb6a8b47ebe9708c9950bb690/0ef64/Smokescreen-Darkside-Ransomware.png 2400w","srcWebp":"/static/a72a3afeb6a8b47ebe9708c9950bb690/58556/Smokescreen-Darkside-Ransomware.webp","srcSetWebp":"/static/a72a3afeb6a8b47ebe9708c9950bb690/61e93/Smokescreen-Darkside-Ransomware.webp 200w,\n/static/a72a3afeb6a8b47ebe9708c9950bb690/1f5c5/Smokescreen-Darkside-Ransomware.webp 400w,\n/static/a72a3afeb6a8b47ebe9708c9950bb690/58556/Smokescreen-Darkside-Ransomware.webp 800w,\n/static/a72a3afeb6a8b47ebe9708c9950bb690/99238/Smokescreen-Darkside-Ransomware.webp 1200w,\n/static/a72a3afeb6a8b47ebe9708c9950bb690/7c22d/Smokescreen-Darkside-Ransomware.webp 1600w,\n/static/a72a3afeb6a8b47ebe9708c9950bb690/f1e40/Smokescreen-Darkside-Ransomware.webp 2400w","sizes":"(max-width: 800px) 100vw, 800px"}}},"medium":{"childImageSharp":{"fluid":{"base64":"data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAABQAAAAKCAYAAAC0VX7mAAAACXBIWXMAAAsTAAALEwEAmpwYAAACXUlEQVQoz32S3UtTcRjHzzlagtNtZ+ecmRoYvpG6mnM7brbNuaa5F9+ma+YLlWkqpYFgodVN1h8QUVR0IV32D3QXSHSfBP4D3UYXQoQSO59+Mywi6eLL7+G5+PD8ns8jWVZhz4I9RLbfru9vTCmFh9MyaznZupeXuT9RxmjUTn2tA83pQHU4cNjt/0b0K2w2JEvQoMC719eYjkiMdMpkg4qV65KZjsn0B8rpMzUiXp1TtTo1bh1DPzpOAZUEzdrZemzlApK10FdqLV4osXIhheRZ2Yo2K4Sby/E2qES9BiFPEWpQZRi4j4jqdArgj10+bpqsjkjcyZayNlzCckphLqGQC8rMxFUGgg2YpzUGI9V4Gg2qxZS69vd0v4H7X7d5NHWc2YTEaEhmVEDibTJpv0zSK3G1V2Osux5/k0oqXM/48HnisW4GBwaI9/SQTqXoEW/A70dzuZB2P2+xnJFZGVJYzR5jMiozFS1OpzAmcilqI+JxEWpRGU/5mJkYJDs8xNTkJJl0mmQyST6fpycWw15ZifT9yyeeLJTxasXOy6UKFvsVbouvP8gprI+UMJ+pxGwx6DWrmL3YyfWJGJEuk1AwhBkI0OHzEQ6H8Xd0HEr5xubdVsa7JJ7ddPB0vpTnS6XcEntMehXOtdjwNetCik4mXEPMp1FtFE/FgUtVD/ZWBB3WRcvsvH/BXExiY7qEy3FZRCIjdhhslGlvsOFp0IRhg2CbTlOdQW21W0hw/7Ht/lUfAAsHdwgf3ixzRUDTHUWgwo2UMJyQSbSXEz6jYbbq1NXonDwhjP7nDn8CrvNYN+AFX20AAAAASUVORK5CYII=","aspectRatio":1.9152542372881356,"src":"/static/a72a3afeb6a8b47ebe9708c9950bb690/62b1f/Smokescreen-Darkside-Ransomware.png","srcSet":"/static/a72a3afeb6a8b47ebe9708c9950bb690/e7519/Smokescreen-Darkside-Ransomware.png 113w,\n/static/a72a3afeb6a8b47ebe9708c9950bb690/7e7e9/Smokescreen-Darkside-Ransomware.png 225w,\n/static/a72a3afeb6a8b47ebe9708c9950bb690/62b1f/Smokescreen-Darkside-Ransomware.png 450w,\n/static/a72a3afeb6a8b47ebe9708c9950bb690/e2e7f/Smokescreen-Darkside-Ransomware.png 675w,\n/static/a72a3afeb6a8b47ebe9708c9950bb690/db955/Smokescreen-Darkside-Ransomware.png 900w,\n/static/a72a3afeb6a8b47ebe9708c9950bb690/0ef64/Smokescreen-Darkside-Ransomware.png 2400w","srcWebp":"/static/a72a3afeb6a8b47ebe9708c9950bb690/b8a88/Smokescreen-Darkside-Ransomware.webp","srcSetWebp":"/static/a72a3afeb6a8b47ebe9708c9950bb690/3a3bf/Smokescreen-Darkside-Ransomware.webp 113w,\n/static/a72a3afeb6a8b47ebe9708c9950bb690/975bf/Smokescreen-Darkside-Ransomware.webp 225w,\n/static/a72a3afeb6a8b47ebe9708c9950bb690/b8a88/Smokescreen-Darkside-Ransomware.webp 450w,\n/static/a72a3afeb6a8b47ebe9708c9950bb690/761da/Smokescreen-Darkside-Ransomware.webp 675w,\n/static/a72a3afeb6a8b47ebe9708c9950bb690/210c1/Smokescreen-Darkside-Ransomware.webp 900w,\n/static/a72a3afeb6a8b47ebe9708c9950bb690/f1e40/Smokescreen-Darkside-Ransomware.webp 2400w","sizes":"(max-width: 450px) 100vw, 450px"}}}},"author":{"id":"765e8417-7ed6-55b7-95a7-1d561141e760","name":"Sudarshan Pisupati"}}},{"node":{"id":"26a6fa99-a7a6-5ae1-835e-ae5c2183236e","title":"Ransomware, the limits of prevention, and active defense","content":"\nWe’re almost halfway through 2021, and there seems to be a ransomware resurgence.
\n\n\n\nOr that’s what the headlines will have you believe.
\n\n\n\nOn the contrary, the opposite might be true.
\n\n\n\nAccording to a Sophos survey, ransomware attacks seem to have gone down in 2021. Only 37% of the organizations surveyed have said they experienced a ransomware attack in 2021 compared to 51% in 2020.
\n\n\n\nSo why does it feel like ransomware attacks have gone through the roof? The answer emerges when you look at the victims – high-profile targets.
\n\n\n\nHere are some headlines from the last couple of months:
\n\n\n\nIreland’s Health Services hit with $20 million ransomware demand
\n\n\n\nThe Conti ransomware gang attacked Ireland’s publicly funded healthcare system. The Irish Health Service had to shut down all of its IT systems. The attack disrupted COVID-19 testing, crippled diagnostic services, and forced hospitals to cancel appointments.
\n\n\n\nRansomware attack leads to shutdown of major U.S. pipeline system
\n\n\n\nColonial Pipeline, one of the biggest fuel pipeline operators in the US, had to shut down its entire network following an attack by the DarkSide ransomware group. The attack resulted in gas price increases, panic buying, and supply shortages. The company paid a 75 bitcoin ransom which was worth $5 million when we wrote this.
\n\n\n\nAxa division in Asia hit by ransomware cyber attack
\n\n\n\nOne of Axa’s businesses in Asia got hit by Avaddon ransomware. 3TB of sensitive data was stolen, including customer medical reports (exposing their sexual health diagnosis), copies of ID cards, bank account statements, claim forms, payment records, contracts, and more. The attack impacted IT operations in Thailand, Malaysia, Hong Kong, and the Philippines.
\n\n\n\nToshiba subsidiary confirms ransomware attack
\n\n\n\nA European subsidiary of Toshiba was the victim of a ransomware attack. Sources inside the company believe DarkSide is behind it, but there was no confirmation when this post was published. 740 GB of data, including passports and other PII, was stolen. The company had to sever network connections between Japan and Europe to stop the spread of ransomware.
\n\n\n\nUS cyber insurance major CNA Financial hit with ransomware
\n\n\n\nOne of the biggest players in the cyber insurance space (yeah, we see the irony) suffered a ransomware attack that affected operations for three days. The company was forced to shut down parts of the network to limit the spread and contain the damage. Although the company did not disclose if data was stolen, it’s a pretty big deal. A compromise could potentially help adversaries determine which companies had applied for or acquired cyber insurance, the scope of coverage, and the limits of deductibles.
\n\n\n\nAcer hit with $50 million ransomware demand
\n\n\n\nRansomware operation REvil breached computer giant Acer resulting in the largest known ransomware demand. Images leaked by the ransomware operators revealed that they had access to some of the company’s financial spreadsheets, bank balances, and bank communication.
\n\n\n\nRansomware gangs are now going after meaty targets. After all, why rob a person when you can rob a bank where everyone keeps their money?
\n\n\n\nIt’s no surprise then that the financial impact of ransomware has more than doubled from US$761,106 in 2020 to US$1.85 million in 2021.
\n\n\n\nAccording to Coveware, ransomware demands are up 43% so far in 2021.
\n\n\n\nSo aside from being meaty targets, what else is common between ransomware victims these days? They all make significant investments in cybersecurity.
\n\n\n\nLook at the scale of these companies. They have large security teams, a bevy of infosec consultants at their disposal, and all the cool tools to defend – endpoint detection and response, DLPs, SIEMs, cloud SIEMs, SIEMs that are also UEBA. You get the drift.
\n\n\n\nDifferent folks will give different answers to these questions. Media outlets will not move beyond the sensational headlines, consultants will say there aren’t enough skilled folks in the company, EDRs will say there’s not enough endpoint coverage, SIEMs will say data ingestion from critical segments might be missing, the OT folks will say it’s hard to defend non-IT assets, deception vendors will say there are no decoys/honeypots!
\n\n\n\nEssentially, anyone who has a horse in the race is going to give one-dimensional answers.
\n\n\n\nHere’s the thing though; the companies that suffer these breaches are pretty good at cybersecurity. More often than not, they operate at the cutting edge.
\n\n\n\nThe answer to why they get hit by ransomware is more nuanced. It’s because there are limits to prevention.
\n\n\n\nIf you happen to be one of the most frequently targeted companies, it’s only a matter of time before you’ll get breached despite having the best preventive controls in place.
\n\n\n\nWhy? Because anything preventive assumes the threat to be static. With ransomware, the threat is evolving. The boring bits of ransomware have been automated, there are dedicated ransomware services (REvil allegedly made $100 million in 2020), and there are human adversaries behind the ransomware that are constantly cooking up new and novel ways of compromising their targets.
\n\n\n\nFurther, most solutions to security problems take a siloed approach. Want to defend endpoints? Cover them with an EDR. More visibility? NTA. Malicious behavior? UEBA. Ransomware doesn’t discriminate. It doesn’t just go after your endpoint or server zone. Once it gets in, it just goes after everything.
\n\n\n\nPrevention doesn’t always work because ransomware is a moving target.
\n\n\n\nBusinesses need a different approach for dealing with it – Active defense.
\n\n\n\nRansomware is capable of interacting with all parts of your IT environment. Focussing your efforts on just one part of it will have diminishing returns. Dealing with something like ransomware demands a holistic approach. Your strategy needs to cover critical areas of the environment to be effective.
\n\n\n\n‘Active Defense‘ helps you do that. The approach is use case-driven and balanced in its outcome. You can pick the use case (in this instance, ransomware) and focus on where you want to be most effective (e.g. DMZ, Active Directory, critical server segments, privileged user accounts, privileges workstations, etc.)
\n\n\n\nWhat we’re recommending isn’t something experimental. Forward-thinking security teams are building dedicated deception-based active defense programs, in some cases around specific risks like ransomware.
\n\n\n\nWe have an insurance customer that has done this. They already had a firewall, network segmentation, anti-virus, EDR, and SIEM when they deployed Smokescreen. They were concerned about ransomware (rightly so).
\n\n\n\nThe idea of planting decoy file shares in key segments was adopted as the primary strategy to detect ransomware in the lateral movement phase. In the event of a detection, the organization’s internal incident response process would kick in.
\n\n\n\nThe goal was to detect ransomware spreading on the network, quickly understand the nature of ransomware, and allow established incident response processes to contain the threat.
\n\n\n\nThe security team planted network decoys in the DMZ and DC. The hypothesis behind this decision was that assets in the DMZ were at a high risk of infection and lateral movement activity would likely be recorded in those segments.
\n\n\n\nThe decoys themselves were projecting a diverse set of network services ranging from decoy SMB file shares to FTP servers to SSH servers and decoy applications.
\n\n\n\nSure enough, the company was hit by a ransomware attack. The incident started a little after midnight and a minute later, Smokescreen had raised a detection. Smokescreen was the first security control to raise an alarm.
\n\n\n\nInvestigation revealed that all decoys masquerading as file shares had been encrypted within the DMZ segment. The decoy files hosted on these file shares had been encrypted and renamed, which allowed for easy identification of the ransomware strain.
\n\n\n\nRoot cause analysis further revealed that the lateral movement phase of the ransomware attack was detected by Smokescreen less than a minute after it began encrypting assets.
\n\n\n\nWhy do you think the security team at this insurance company was able to avert a ransomware breach? Sure they had our active defense solution, but more importantly, they had the foresight to think what an attacker would possibly do and then build defenses that would intercept those attacks.
\n\n\n\nThat’s Active Defense in action.
\n\n\n\nBuilding a dedicated defense strategy around ransomware is a worthy goal to have in 2021.
\n\n\n\nRansomware is industry-agnostic and affects all parts of your network. Today, it is the one singular threat that can completely disrupt operations and bring business to a grinding halt.
\n\n\n\nHaving the ability to detect ransomware early in the attack lifecycle can be instrumental in limiting its spread and impact.
\n\n\n\nActive defense gives you the ability to do this without investing in expensive tooling, adding headcount, or making changes to your network.
\n\n\n\nWe’re going to leave you with a playbook of active defense strategies that can help you detect over 40 ransomware techniques.
\n\n\n\nPlaybook – The Top 40 Ransomware Techniques and How to Mess With Them
\n\n\n\nRemember, you don’t have to implement everything. But implementing even some of it can help you control and reduce the attack surface available to ransomware.
\n\n\n\n\n","excerpt":"We’re almost halfway through 2021, and there seems to be a ransomware resurgence. Or that’s what the headlines will have you believe. On the contrary, the opposite might be true. According to a Sophos survey, ransomware attacks seem to have gone down in 2021. Only 37% of the organizations surveyed have said they experienced a […]\n","slug":"ransomware-the-limits-of-prevention-and-active-defense","date":"2021-05-17T12:15:38.000Z","status":"publish","modified":"2021-05-18T16:18:54.000Z","wordpress_id":18779,"featured_media":{"id":"8fcb1a39-fe2c-5560-b945-364105ce2807","source_url":"https://ss-website-content-prod.s3.ap-south-1.amazonaws.com/wp-content/uploads/2021/05/Smokescreen-Ransomware-Defense.png","alt_text":"Smokescreen Ransomware Defense","large":{"childImageSharp":{"fluid":{"base64":"data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAABQAAAALCAYAAAB/Ca1DAAAACXBIWXMAAAsTAAALEwEAmpwYAAADL0lEQVQozx2SfUzUdRzHv56HbVrTBGGWcnLe/e5O7g4fjgfdBbgT4ZCmqeMo5gNuJpXxkCeZwo2HKCFDzafTlWaWOZSgjhPHcSBwZxRu6mCtWmtraU8qsYGICXv1rb8/+7w+n/eDUFlslLi3c7v1Xe4FvdRUlqI2WZlisBJhtKJWzExT4pmmN6HWGlDHKYjYhWiXWgmcrWYoeJwHoYs0HisnUqtBnNyTy1DnIR4Phnl4o4fhq0fxHS5k9hIbaoOFqfp4xHwJeVaHKk7PVAmcpVPwV+Ux1H2Cf/o7Gelt5n7wIP2nixFtpav55kQZPza+za9fVTF6/VMme+vQ25dLiEKE/HTrpiwKNjuJ0C1CRGuYazTwZXEmfUfe4MapIu74q5gYuMhE735EUW46weotBMqcjLR54Psmmo6WMMOcQFq2nH1SycTXn8O3fjo+riJ9VQqq+VrynSm0ludzdW8Okz11/BU+g3t7DkJYElmR5aB+22paG3bg2uZCGBKYLn1s92zgbuAII31+7nacYTTs5U7LPiKNJkRMLJp4E+6Ndmp2riPWIq15cjZCZV6GWGDB7EglKSsVMVePUKzMtCRwrnAVofoddNfl85uvAn5o4e9ALVEmIyLyGcSceeRkLyc1bQlihoQ9HY2ISl5B+d5Cfva9x5+XT3GgtoyYZfKI3ozNnoS3NJdg2RoeBqrpb25gzVqH9DaOlPQkfN63GA+f5fF1P5817MZkleFdqHAx0tXA5EAP49cuMx7y0ne6hGhbImKhlKE1krkykbyNDqZodFKqhkhFoaPGxXD3ccZudTMcbmI0dIyfGt9E+IoyCB0q5uZHu/ilpUJW5wKToXp0/6U8TyFqaTLu117A/eoGohbbJHABMQaFS69nEnp/J9cObuV3fyV818RYVy3ipbVptHo20e528uCKh0c3z3O4+mWeWJTAi3lZDDbvh1t+uRBi4It68nMdqOSnGek2zu920bknh0dd7zDo/wDX+pUy5XgbWvtzeLZkcK62gOTns6VUC0+ZF9O+bx23fQe433uJPwInGev7kKG2SuaYzf9LnykL/sp6OyUFTqbHSTtmxfAvXln2Qtw0IX8AAAAASUVORK5CYII=","aspectRatio":1.7699115044247788,"src":"/static/6a39ebe40d3a52b97b478c8ce0551c02/ee604/Smokescreen-Ransomware-Defense.png","srcSet":"/static/6a39ebe40d3a52b97b478c8ce0551c02/69585/Smokescreen-Ransomware-Defense.png 200w,\n/static/6a39ebe40d3a52b97b478c8ce0551c02/497c6/Smokescreen-Ransomware-Defense.png 400w,\n/static/6a39ebe40d3a52b97b478c8ce0551c02/ee604/Smokescreen-Ransomware-Defense.png 800w,\n/static/6a39ebe40d3a52b97b478c8ce0551c02/f3583/Smokescreen-Ransomware-Defense.png 1200w,\n/static/6a39ebe40d3a52b97b478c8ce0551c02/5707d/Smokescreen-Ransomware-Defense.png 1600w,\n/static/6a39ebe40d3a52b97b478c8ce0551c02/2685c/Smokescreen-Ransomware-Defense.png 2560w","srcWebp":"/static/6a39ebe40d3a52b97b478c8ce0551c02/58556/Smokescreen-Ransomware-Defense.webp","srcSetWebp":"/static/6a39ebe40d3a52b97b478c8ce0551c02/61e93/Smokescreen-Ransomware-Defense.webp 200w,\n/static/6a39ebe40d3a52b97b478c8ce0551c02/1f5c5/Smokescreen-Ransomware-Defense.webp 400w,\n/static/6a39ebe40d3a52b97b478c8ce0551c02/58556/Smokescreen-Ransomware-Defense.webp 800w,\n/static/6a39ebe40d3a52b97b478c8ce0551c02/99238/Smokescreen-Ransomware-Defense.webp 1200w,\n/static/6a39ebe40d3a52b97b478c8ce0551c02/7c22d/Smokescreen-Ransomware-Defense.webp 1600w,\n/static/6a39ebe40d3a52b97b478c8ce0551c02/ab8d3/Smokescreen-Ransomware-Defense.webp 2560w","sizes":"(max-width: 800px) 100vw, 800px"}}},"medium":{"childImageSharp":{"fluid":{"base64":"data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAABQAAAALCAYAAAB/Ca1DAAAACXBIWXMAAAsTAAALEwEAmpwYAAADL0lEQVQozx2SfUzUdRzHv56HbVrTBGGWcnLe/e5O7g4fjgfdBbgT4ZCmqeMo5gNuJpXxkCeZwo2HKCFDzafTlWaWOZSgjhPHcSBwZxRu6mCtWmtraU8qsYGICXv1rb8/+7w+n/eDUFlslLi3c7v1Xe4FvdRUlqI2WZlisBJhtKJWzExT4pmmN6HWGlDHKYjYhWiXWgmcrWYoeJwHoYs0HisnUqtBnNyTy1DnIR4Phnl4o4fhq0fxHS5k9hIbaoOFqfp4xHwJeVaHKk7PVAmcpVPwV+Ux1H2Cf/o7Gelt5n7wIP2nixFtpav55kQZPza+za9fVTF6/VMme+vQ25dLiEKE/HTrpiwKNjuJ0C1CRGuYazTwZXEmfUfe4MapIu74q5gYuMhE735EUW46weotBMqcjLR54Psmmo6WMMOcQFq2nH1SycTXn8O3fjo+riJ9VQqq+VrynSm0ludzdW8Okz11/BU+g3t7DkJYElmR5aB+22paG3bg2uZCGBKYLn1s92zgbuAII31+7nacYTTs5U7LPiKNJkRMLJp4E+6Ndmp2riPWIq15cjZCZV6GWGDB7EglKSsVMVePUKzMtCRwrnAVofoddNfl85uvAn5o4e9ALVEmIyLyGcSceeRkLyc1bQlihoQ9HY2ISl5B+d5Cfva9x5+XT3GgtoyYZfKI3ozNnoS3NJdg2RoeBqrpb25gzVqH9DaOlPQkfN63GA+f5fF1P5817MZkleFdqHAx0tXA5EAP49cuMx7y0ne6hGhbImKhlKE1krkykbyNDqZodFKqhkhFoaPGxXD3ccZudTMcbmI0dIyfGt9E+IoyCB0q5uZHu/ilpUJW5wKToXp0/6U8TyFqaTLu117A/eoGohbbJHABMQaFS69nEnp/J9cObuV3fyV818RYVy3ipbVptHo20e528uCKh0c3z3O4+mWeWJTAi3lZDDbvh1t+uRBi4It68nMdqOSnGek2zu920bknh0dd7zDo/wDX+pUy5XgbWvtzeLZkcK62gOTns6VUC0+ZF9O+bx23fQe433uJPwInGev7kKG2SuaYzf9LnykL/sp6OyUFTqbHSTtmxfAvXln2Qtw0IX8AAAAASUVORK5CYII=","aspectRatio":1.765625,"src":"/static/6a39ebe40d3a52b97b478c8ce0551c02/62b1f/Smokescreen-Ransomware-Defense.png","srcSet":"/static/6a39ebe40d3a52b97b478c8ce0551c02/e7519/Smokescreen-Ransomware-Defense.png 113w,\n/static/6a39ebe40d3a52b97b478c8ce0551c02/7e7e9/Smokescreen-Ransomware-Defense.png 225w,\n/static/6a39ebe40d3a52b97b478c8ce0551c02/62b1f/Smokescreen-Ransomware-Defense.png 450w,\n/static/6a39ebe40d3a52b97b478c8ce0551c02/e2e7f/Smokescreen-Ransomware-Defense.png 675w,\n/static/6a39ebe40d3a52b97b478c8ce0551c02/db955/Smokescreen-Ransomware-Defense.png 900w,\n/static/6a39ebe40d3a52b97b478c8ce0551c02/2685c/Smokescreen-Ransomware-Defense.png 2560w","srcWebp":"/static/6a39ebe40d3a52b97b478c8ce0551c02/b8a88/Smokescreen-Ransomware-Defense.webp","srcSetWebp":"/static/6a39ebe40d3a52b97b478c8ce0551c02/3a3bf/Smokescreen-Ransomware-Defense.webp 113w,\n/static/6a39ebe40d3a52b97b478c8ce0551c02/975bf/Smokescreen-Ransomware-Defense.webp 225w,\n/static/6a39ebe40d3a52b97b478c8ce0551c02/b8a88/Smokescreen-Ransomware-Defense.webp 450w,\n/static/6a39ebe40d3a52b97b478c8ce0551c02/761da/Smokescreen-Ransomware-Defense.webp 675w,\n/static/6a39ebe40d3a52b97b478c8ce0551c02/210c1/Smokescreen-Ransomware-Defense.webp 900w,\n/static/6a39ebe40d3a52b97b478c8ce0551c02/ab8d3/Smokescreen-Ransomware-Defense.webp 2560w","sizes":"(max-width: 450px) 100vw, 450px"}}}},"author":{"id":"34627d50-53e7-5dda-bb36-6ab2c0cf489d","name":"Amir Moin"}}},{"node":{"id":"ea0aa0bf-7d16-5925-b1f2-594f99da9771","title":"6 takeaways from GOV.UK’s 2021 cybersecurity breaches survey","content":"\nUK’s Department for Digital, Culture, Media and Sports has published the 6th edition of its annual cybersecurity breaches survey on GOV.UK.
\n\n\n\nWe sifted through this year’s report to compile the top 6 takeaways. Let’s go.
\n\n\n\nFewer businesses are now deploying security monitoring tools (35% vs. 40% last year) or undertaking any form of user monitoring (32% vs. 38%).
\n\n\n\nCompared to 46% of businesses in 2017, only 39% said that they detected any breach or attack. This can be attributed to fewer organizations deploying security controls and their limited ability to monitor remote employees.
\n\n\n\n83% of attacks on businesses and 79% on charities were in the form of phishing. These are consistent with the attack vectors reported in 2019 and 2020.
\n\n\n\n4 in 10 businesses and 1 in 4 charities were hit by a security breach/attack in the last 12 months.
\n\n\n\nOf the businesses and charities that reported a security breach/attack, a quarter of them were hit at least once a week,
\n\n\n\nThe data from this survey reinforces what we’re seeing globally:
\n\n\n\nYou can read the full report here.
\n\n\n\nThere’s no silver bullet. We can recommend four easy-to-implement active defense strategies that address security challenges around phishing and remote work access. These deception-based active defense recommendations are easy to implement, do not require complex tooling, and detect threats early.
\n\n\n\nEmail decoys are fake email accounts that intercept attackers attempting to mount social-engineering/spear-phishing attacks on high-value personnel.
\n\n\n\nSeed these decoys on social media and other Internet-facing assets where attackers scour for spear-phishing targets. These email decoys are enumerated by hackers and added to their target lists for sending spear-phishing emails. There is no reason for anyone to send any emails to the decoy email addresses. Therefore, any email sent to these addresses is a high-fidelity indication of an attack.
\n\n\n\nYou can integrate these with your SIEM to find other targets. Additionally, you can integrate with proxies to block access to spear-phishing domains.
\n\n\n\nEnabling employees to work from anywhere requires security teams to use VPNs, Citrix servers, and expose applications to the Internet.
\n\n\n\nAttackers target vulnerabilities in these remote access services to get into your network. Use that against them.
\n\n\n\nDeploy Internet-facing decoys that resemble vulnerable applications, databases, and servers. E.g., you can easily set up decoys that have the recent Citrix and ManageEngine vulnerabilities, making them attractive targets for the attackers.
\n\n\n\nAttackers looking for these assets during recon will discover and engage with the decoys as well. Any attempt to seek out these assets will alert you of incoming threats with low alert volume.
\n\n\n\nAttackers use credential stuffing and stolen credentials to break into organizations. These are hard to detect because the activity seems legitimate. You have two simple active defense plays here:
\n\n\n\nAs you’ve seen in the survey finding, fewer organizations have visibility into endpoints because now they are outside the perimeter. Consider using endpoint deception to build this visibility, detect attacks early, and stop lateral movement.
\n\n\n\nPlant endpoint decoys like fake files, processes, passwords, and cookies on the work machines of all your remote employees.
\n\n\n\nAn attacker on your employees’ machines will encounter these decoys and will be caught.
\n\n\n\nEndpoint deception follows the end-user, so even when they’re working from home, your ability to detect threats is not diminished. You gain visibility into home networks that are compromised without having to deploy appliances or network traffic monitoring choke-points.
\n\n\n\nActive defense is emerging as a viable approach to dealing with advanced attacks. MITRE has a new knowledge base dedicated to active defense. If you want to understand why this approach is gaining prominence in infosec circles, read this.
\n\n\n\nFor more on using active defense and deception for remote work security, check out the white paper.
Deception technology provides a unique approach to detecting adversary activity in a network. Compared to other detection controls, it’s easier to deploy, gives you greater visibility, and solves your false positives problem.
\n\n\n\nLet’s cut to the chase, shall we? Of course, I’m going to say this. I work for a company that sells a deception solution. I’m quite sure that if you’ve ever spoken to a deception vendor, you would have heard a similar pitch. If you haven’t talked to one, well, that’s more or less what you’re going to hear in a nutshell.
\n\n\n\nWhile what I’ve stated above is accurate, there are nuances to every approach. As they say, when it comes to cybersecurity, there are no silver bullets. I’m writing this post because when you’re evaluating technology or deploying it, you must understand the conditions under which it can be effective. It allows you to be pragmatic and set realistic expectations.
\n\n\n\nIn the next couple of paragraphs, I’m going to delve into nuances of deception technology that often don’t make it to marketing materials.
\n\n\n\nAs with any security control, there are several components that come together to make deception effective. For now, I’m going to focus on the three most important properties that can make or break a deception technology deployment. These are:
\n\n\n\nIn an ideal world, every deceptive component should exhibit all three properties in totality. The reality, however, is different.
\n\n\n\nSome decoys will be visible to folks inside your company but will be a popular target for attackers. Some will have limited realism but will not be fingeprintable. The point is, when you’re deploying deception in a living, breathing network, trade-offs have to be made – sometimes because of internal limitations, and other times because that’s the best strategy.
\n\n\n\nIn my experience, an understanding of these three properties helps in deciding what trade-offs to make and what you can expect. Let’s break them down one by one.
\n\n\n\nVisibility is an important consideration when deploying deceptive components. In organizations, highly visible decoys will lead to false positives and noise. However, the decoys themselves may be the only effective way to detect an adversary. Being aware of different deceptive components and their visibility property can help inform your thinking about what to do. Here’s a handy table.
\n\n\n\n| Component | Visibility to regular users |
| Private Threat Intelligence (Internet-facing decoys) | Not visible |
| Internal network decoys | Not visible |
| Active Directory decoys | Not visible |
| MiTM Deception | Not visible |
| Endpoint Deception – File Decoys | * Invisible unless the user chooses the option to show hidden files. * The Endpoint deception policy allows file decoys to be hidden to make them invisible to regular users. |
| Endpoint Deception – Browser Lures | * Cookies are invisible to the user. * Credentials may be viewed if the user browses to the Saved Password page. * Browser Favorites will be visible to the user. |
| Endpoint Deception – Session Lures | * Network Shares and Windows Credentials are placed in Credential Manager and rarely accessed by regular users and are therefore effectively invisible. * Session Lures created for software like PuTTY and WinSCP will be visible in the panel of saved sessions. |
| Endpoint Deception – Privilege Escalation | Not visible |
| Endpoint Deception – Defense Evasion | Effectively invisible. Fake Processes are visible in Task Manager but they masquerade as a real process and hide in plain sight. |
If an adversary can fingerprint your deceptive assets, she will be able to avoid them altogether. That can’t be good, can it? Here are a couple of things to consider when looking at deception solutions to figure out if they’re fingerprintable.
\n\n\n\nWhat are the characteristics of the decoys?
\n\n\n\nFor decoys deployed to the network, network characteristics can result in fingerprinting. While it’s relatively easy to fake characteristics like MAC addresses, Hostnames, and IP addresses, NetBIOS names are harder to spoof as they are tied to the machine itself.
\n\n\n\nAre they high interaction?
\n\n\n\nAll deception components have a limitation to the extent to which they fool an adversary. However, it’s important to test whether interacting with a deception component gives away large portions of your deployment. If decoys are created using multiple virtual network adapters from a single machine, it is likely that once you login to a decoy and run “ipconfig / ifconfig”, you will be able to figure out all the decoys projected from that host.
\n\n\n\nTest open-source fingerprinting tools
\n\n\n\nOpen-source fingerprinting tools like HoneypotBuster, attempt to fingerprint deception in active directory and fake credentials in memory. We recommend testing these tools, especially on computer objects in Active Directory as they contain properties that cannot be easily modified in a deception scenario. Also, tools like HoneypotBuster check only the domain from which the tool is run and will not check domains that are trusted in any way. Ensure that you run the tool against the domain where the deception has been configured in Active Directory.
\n\n\n\nThe realism of a deception component is critical to keeping an attacker engaged. Ideally, the component should be real enough that it allows the adversary to reveal tools, tactics, and techniques that are being used in your environment. It should also provide you with enough telemetry to determine what the next steps should be.
\n\n\n\nThe overarching goal here is to make the deception component real enough to engage the adversary for long enough so that you can respond to the event.
\n\n\n\nHere is some guidance for ensuring that the deception technology components you opt for meet the realism criteria:
\n\n\n\nWhen evaluating deception technology, visibility, realism, and fingerprinting should be some of the key components that you should closely look at to figure how the solution will play out in your network.
\n","excerpt":"When evaluating deception technology, look at three key components of the solution to ascertain how effective it will be in your environment – visibility, realism, and fingerprintability.\n","slug":"the-pragmatic-security-leaders-guide-to-deception-technology","date":"2021-02-01T04:04:10.000Z","status":"publish","modified":"2021-02-01T12:39:33.000Z","wordpress_id":18727,"featured_media":{"id":"2a4ed0d8-6b54-5c32-b562-d58644b889bc","source_url":"https://ss-website-content-prod.s3.ap-south-1.amazonaws.com/wp-content/uploads/2021/02/Maze.jpeg","alt_text":"deception technology","large":{"childImageSharp":{"fluid":{"base64":"data:image/jpeg;base64,/9j/2wBDABALDA4MChAODQ4SERATGCgaGBYWGDEjJR0oOjM9PDkzODdASFxOQERXRTc4UG1RV19iZ2hnPk1xeXBkeFxlZ2P/2wBDARESEhgVGC8aGi9jQjhCY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2P/wgARCAANABQDASIAAhEBAxEB/8QAFwABAQEBAAAAAAAAAAAAAAAAAAUCBP/EABYBAQEBAAAAAAAAAAAAAAAAAAABAv/aAAwDAQACEAMQAAAB6EXObaQR/8QAGxAAAgMAAwAAAAAAAAAAAAAAAAMBAhMREjL/2gAIAQEAAQUC1WbLNaC/Kp5O81P/xAAUEQEAAAAAAAAAAAAAAAAAAAAQ/9oACAEDAQE/AT//xAAUEQEAAAAAAAAAAAAAAAAAAAAQ/9oACAECAQE/AT//xAAaEAACAgMAAAAAAAAAAAAAAAAAAQIxEBFR/9oACAEBAAY/ArLxJse+DR//xAAcEAACAgIDAAAAAAAAAAAAAAAAAREhYZExUfH/2gAIAQEAAT8hXkMzRJMN6LW3NDsaj6E0hzDP/9oADAMBAAIAAwAAABAP/wD/xAAVEQEBAAAAAAAAAAAAAAAAAAAAIf/aAAgBAwEBPxBH/8QAFxEBAAMAAAAAAAAAAAAAAAAAAAERIf/aAAgBAgEBPxC5a//EAB0QAAIDAAIDAAAAAAAAAAAAAAERACExUaFBYZH/2gAIAQEAAT8QCDJ0VveITtcW4CWCKPtC86gnxhX31DgsS5l2VfYJIzZGz//Z","aspectRatio":1.5037593984962405,"src":"/static/bb6b3e0811f2e1fac8c855c6c38b11f2/14b42/Maze.jpg","srcSet":"/static/bb6b3e0811f2e1fac8c855c6c38b11f2/f836f/Maze.jpg 200w,\n/static/bb6b3e0811f2e1fac8c855c6c38b11f2/2244e/Maze.jpg 400w,\n/static/bb6b3e0811f2e1fac8c855c6c38b11f2/14b42/Maze.jpg 800w,\n/static/bb6b3e0811f2e1fac8c855c6c38b11f2/47498/Maze.jpg 1200w,\n/static/bb6b3e0811f2e1fac8c855c6c38b11f2/0e329/Maze.jpg 1600w,\n/static/bb6b3e0811f2e1fac8c855c6c38b11f2/42f14/Maze.jpg 1651w","srcWebp":"/static/bb6b3e0811f2e1fac8c855c6c38b11f2/58556/Maze.webp","srcSetWebp":"/static/bb6b3e0811f2e1fac8c855c6c38b11f2/61e93/Maze.webp 200w,\n/static/bb6b3e0811f2e1fac8c855c6c38b11f2/1f5c5/Maze.webp 400w,\n/static/bb6b3e0811f2e1fac8c855c6c38b11f2/58556/Maze.webp 800w,\n/static/bb6b3e0811f2e1fac8c855c6c38b11f2/99238/Maze.webp 1200w,\n/static/bb6b3e0811f2e1fac8c855c6c38b11f2/7c22d/Maze.webp 1600w,\n/static/bb6b3e0811f2e1fac8c855c6c38b11f2/34b00/Maze.webp 1651w","sizes":"(max-width: 800px) 100vw, 800px"}}},"medium":{"childImageSharp":{"fluid":{"base64":"data:image/jpeg;base64,/9j/2wBDABALDA4MChAODQ4SERATGCgaGBYWGDEjJR0oOjM9PDkzODdASFxOQERXRTc4UG1RV19iZ2hnPk1xeXBkeFxlZ2P/2wBDARESEhgVGC8aGi9jQjhCY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2P/wgARCAANABQDASIAAhEBAxEB/8QAFwABAQEBAAAAAAAAAAAAAAAAAAUCBP/EABYBAQEBAAAAAAAAAAAAAAAAAAABAv/aAAwDAQACEAMQAAAB6EXObaQR/8QAGxAAAgMAAwAAAAAAAAAAAAAAAAMBAhMREjL/2gAIAQEAAQUC1WbLNaC/Kp5O81P/xAAUEQEAAAAAAAAAAAAAAAAAAAAQ/9oACAEDAQE/AT//xAAUEQEAAAAAAAAAAAAAAAAAAAAQ/9oACAECAQE/AT//xAAaEAACAgMAAAAAAAAAAAAAAAAAAQIxEBFR/9oACAEBAAY/ArLxJse+DR//xAAcEAACAgIDAAAAAAAAAAAAAAAAAREhYZExUfH/2gAIAQEAAT8hXkMzRJMN6LW3NDsaj6E0hzDP/9oADAMBAAIAAwAAABAP/wD/xAAVEQEBAAAAAAAAAAAAAAAAAAAAIf/aAAgBAwEBPxBH/8QAFxEBAAMAAAAAAAAAAAAAAAAAAAERIf/aAAgBAgEBPxC5a//EAB0QAAIDAAIDAAAAAAAAAAAAAAERACExUaFBYZH/2gAIAQEAAT8QCDJ0VveITtcW4CWCKPtC86gnxhX31DgsS5l2VfYJIzZGz//Z","aspectRatio":1.5066666666666666,"src":"/static/bb6b3e0811f2e1fac8c855c6c38b11f2/32fd5/Maze.jpg","srcSet":"/static/bb6b3e0811f2e1fac8c855c6c38b11f2/06e94/Maze.jpg 113w,\n/static/bb6b3e0811f2e1fac8c855c6c38b11f2/07ab6/Maze.jpg 225w,\n/static/bb6b3e0811f2e1fac8c855c6c38b11f2/32fd5/Maze.jpg 450w,\n/static/bb6b3e0811f2e1fac8c855c6c38b11f2/4a838/Maze.jpg 675w,\n/static/bb6b3e0811f2e1fac8c855c6c38b11f2/9842e/Maze.jpg 900w,\n/static/bb6b3e0811f2e1fac8c855c6c38b11f2/42f14/Maze.jpg 1651w","srcWebp":"/static/bb6b3e0811f2e1fac8c855c6c38b11f2/b8a88/Maze.webp","srcSetWebp":"/static/bb6b3e0811f2e1fac8c855c6c38b11f2/3a3bf/Maze.webp 113w,\n/static/bb6b3e0811f2e1fac8c855c6c38b11f2/975bf/Maze.webp 225w,\n/static/bb6b3e0811f2e1fac8c855c6c38b11f2/b8a88/Maze.webp 450w,\n/static/bb6b3e0811f2e1fac8c855c6c38b11f2/761da/Maze.webp 675w,\n/static/bb6b3e0811f2e1fac8c855c6c38b11f2/210c1/Maze.webp 900w,\n/static/bb6b3e0811f2e1fac8c855c6c38b11f2/34b00/Maze.webp 1651w","sizes":"(max-width: 450px) 100vw, 450px"}}}},"author":{"id":"765e8417-7ed6-55b7-95a7-1d561141e760","name":"Sudarshan Pisupati"}}},{"node":{"id":"e3cd17da-d028-5fad-bd26-31d9b3a4604d","title":"Using deception to shield the insurance sector","content":"\nLet’s cut to the chase, insurance companies are under siege from cyberattacks. An Accenture report from 2020 shows that attacks on insurers have more than doubled from 240 to 519, on average. Insurers also sit on top of sensitive customer data and are at risk of losing it – 44% exposed more than 500,000 customer records in 2019 compared to 15% for cross-industry peers.
\n\n\n\nAs more people around the world come under the ambit of insurance policies, the risk to insurers continues to grow. In this post, we take a look at some of the key pieces of an insurer’s infrastructure that adversaries target, why they go after it, and how you can use deception to build active defenses that mitigate the risk of these attacks and put you in a better position to detect and contain these threats,
\n\n\n\nFor a moment, step into the shoes of a malicious entity targeting an insurance company. Your goal is to get $$$. What are your best opportunities?
\n\n\n\nThe database of all policyholders and their policy details, complete with confidential and protected information is perhaps the most valuable asset of an insurer. This would be the holy grail of compromises. Given that a lot of this information is distributed across many systems (some of them legacy), protecting them is a challenge for the sector.
\n\n\n\nNot only would this data sell for a neat sum on the underground market, but it can also be weaponized in numerous ways, including and not limited to:
\n\n\n\nTo achieve this target, adversaries will have to invest time and money into:
\n\n\n\nCost-benefit analysis reveals Low to medium risk with an extremely high payout.
\n\n\n\nAdvanced and organized criminal syndicates.
\n\n\n\nInsurance companies deal with lots of files. Lots and lots of files. If an adversary succeeds in encrypting as many files as possible, the payout from this activity can be significant.
\n\n\n\nRansomware operators of any sophistication.
\n\n\n\nInsurance companies worldwide are expected to digitize their interactions with consumers. Everything from pre-sales to claims management is expected to be made available to consumers directly in a bid to simplify the consumer experience. This involves the adoption of cloud services, moving previously internal systems to Internet-facing infrastructure, and spinning up even more infrastructure to support business objectives. Adversaries now have a wider attack surface available to them to exploit.
\n\n\n\nMapping external infrastructure is a trivial task and therefore there are minimal considerations for groups adopting this approach.
\n\n\n\nLow effort with payout equivalent to the criticality of the infrastructure they compromise.
\n\n\n\nCybercriminals of any sophistication.
\n\n\n\nDeception is about tilting the odds of winning in your favor. It’s about making reasonable judgments about what the adversary might go after and presenting that information to them on a platter. Deception is about abstracting defenses to individual attacker techniques with lesser effort and increased cost to the attacker.
\n\n\n\nThe core principle of deception is the idea that any interaction with a decoy can be viewed as suspicious and warrants immediate action.
\n\n\n\nBroadly, the plan is to plant decoys across the network, from perimeter to end-point, to deceive the adversary. At a high-level, the following locations will be configured with decoys:
\n\n\n\nBy spreading decoys across the infrastructure, we maximize our chances of detecting adversaries. Remember, we only need to be able to detect the adversary once.
\n\n\n\nThe following is a break-down of what this might look like in practice.
\n\n\n\nLet’s say you don’t want to use deception. The alternative is to understand and defend yourself against every attacker technique. As per MITRE ATT&CK, these are over 100 and this does not account for variations in how these attacks might be executed.
\n\n\n\nDeception is grounded in addressing the motivations of the adversary and presenting fake information on a platter that adversaries find attractive. It is technique-agnostic and abstracts away the complexity that arises from blocking individual tools, techniques, and behaviors.
\n\n\n\nDeception is a form of Active Defense, where security teams take proactive steps to channel the adversary and make their life difficult. It varies from regular defense where you wait for an existing system to generate an alarm and then react.
\n\n\n\nMITRE new active defense framework, Shield, is being adopted by CISOs around the world and we see this approach being embraced by more and more security teams at insurance companies.
Pentest reports tell a story. The story of how the team managed to break into your environment. In my experience, a critical component usually missing from these reports is the rationale behind the choices made by the pentesters who ran the assessment.
\n\n\n\nAsking why allows you to deconstruct choices that real threat actors might make in your environment. Having a sense of those choices will give you some active defense opportunities.
\n\n\n\nLet me demonstrate this with a little thought experiment. Let’s consider a pentest where the objective was to demonstrate access to the customer database. Here’s what the pentesters broadly did:
\n\n\n\nIn each of these steps, the pentesters made some choices. As you’ll now see, deconstructing these choices can help build better defenses.
\n\n\n\nThe Active Defense matrix was released by MITRE to provide a framework for identifying opportunities where adversary behavior can be influenced to enable defenders to easily spot threats.
\n\n\n\nThe foundation of the Active Defense approach rests on three principles:
\n\n\n\nSo let’s begin by deconstructing each of the 7 steps in the report to identify Active Defense opportunities
\n\n\n\nBlock PowerShell to force the adversary to use non-PowerShell options.
\n\n\n\nSince PowerShell usage for C2 is fairly common, it reduces the risk of being hit with commodity malware that uses PowerShell even today.
\n\n\n\nMITRE Shield Technique: Security Controls
\n\n\n\nSetup attractive decoy accounts, assign attractive privileges, and setup attribute level auditing on description, SPN, etc. to monitor enumeration attempts. This has the added advantage of detecting password spraying regardless of intensity and staggering strategies.
\n\n\n\nGain insight into enumeration activities being conducted against the domain from a user perspective.
\n\n\n\n(Note: Don’t ever use these accounts for any operations. There are ways to make this opsec safe)
\n\n\n\nMITRE Shield Technique: Decoy Account
\n\n\n\nSetup decoy computers, assign attractive hostnames to databases, and setup attribute level auditing on description, SPN, etc. to monitor enumeration attempts.
\n\n\n\nGain insight into enumeration activities being conducted against the domain from a computer perspective.
\n\n\n\nMITRE Shield Technique: Decoy System
\n\n\n\nLet’s assume that Kerberoasting was the privilege escalation technique that worked. In this case, let’s also assume that the service account was a domain admin.
\n\n\n\nMakes the adversary believe they have obtained hashes to the customer database SQL service account while at the same time removing the risk of kerberoasting a real domain admin account.
\n\n\n\nA similar approach can be used for other popular privilege escalation techniques.
\n\n\n\nThere are many techniques available for privilege escalation, and some of them lend themselves well to an Active Defense approach. However, in cases where that doesn’t work, focus on what the adversary intends to accomplish with those privileged credentials.
\n\n\n\nMITRE Shield Technique: Decoy Account, Decoy System, Security Controls
\n\n\n\nEven a single port query against the decoy SQL server system is worth investigating while complicating access to the real customer database.
\n\n\n\nMITRE Shield Technique: Network Diversity, Decoy Diversity, Network Manipulation
\n\n\n\nEven a single port query against the decoy SQL server system is worth investigating while complicating access to the real customer database
\n\n\n\nMITRE Shield Technique: Standard Operating Procedure, Decoy Credentials
\n\n\n\nUnfortunately, if the adversary has reached this point, detection difficulty increases. This is because, from an analytics perspective, you are looking for a legitimate account, logging into a legitimate database, and running possibly legitimate queries. However, there are still things we can do.
\n\n\n\nMITRE Shield Technique: Hunting, System Activity Monitoring
\n\n\n\nI present an abstracted approach to applying Active Defense use cases. It has 4 pieces:
\n\n\n\nYou can use the above as a combination to assess a use case beyond just analyzing pentest reports. The pentest report was just a means for me to present my idea.
\n\n\n\nI would like you to note a few things.
\n\n\n\nFor free, of course.
\n\n\n\nAt this point, I’m positive that you’ve heard of MITRE Shield. It’s a new active defense knowledge base released by MITRE – stuff they’ve been implementing for over a decade to engage adversaries and derail attacks. They’ve opened it up to everyone, and for the first time perhaps, the infosec community has a shared vocabulary and framework for actively defending against attacks instead of reacting to them.
\n\n\n\nI’ve been having conversations about MITRE Shield and Active Defense with CISOs and customers. While some of the conversations are basic and around what is active defense and why does it matter, what I consistently hear from across the board is – “how do we even begin to implement this stuff?” That’s a fair question, but it’s only one part. What more folks aren’t asking is, where do we implement active defenses for the most impact.
\n\n\n\nI’ve zeroed down on four active defense techniques from the MITRE Shield matrix that address both the questions – how do I get started with this and where should I be building active defenses first. Think of this as a soft launch guide for your Active Defense journey.
\n\n\n\nI’ve selected techniques based on two factors:
\n\n\n\nAs a result, all four defenses are Active Directory exclusive. Active Directory has become an adversary favorite attack vector. By deploying active defenses in Active Directory, you’ll be able to make great strides in disrupting adversary actions.
\n\n\n\nOnly two:
\n\n\n\nLet’s dive right in.
\n\n\n\nMITRE Shield Procedure – DPR002
\n\n\n\nPlant decoy accounts in your Active Directory. Any interaction with these accounts is a high-confidence indicator of compromise. These accounts will also help you study the adversary’s actions, mislead attackers by putting these accounts in their path during enumeration, and use them to influence the attacker’s actions and next steps.
\n\n\n\nSet up a decoy account and give it “Domain Admin” privileges. This will make the account interesting to the adversary.
\n\n\n\nIn this video, we focus on detecting the operation. We show how to setup Windows Auditing so that we can capture the appropriate log. We also demonstrate an attack to test if the logs are captured appropriately.
\n\n\n\nPsuedo-code for detection rule:
\n\n\n\nIf login_activity observed for decoy_account then raise a high priority alert.\n\n\n\n
MITRE Shield Procedures – DPR0022 and DPR0033
\n\n\n\nDecoy systems are an excellent active defense tool because they act as a target to lure away attackers from legitimate assets. Decoy content could be anything ranging from fake files to browser shortcuts that act as breadcrumbs to point adversaries to decoy systems.
\n\n\n\nIn this video, we set up a webserver on our test machine to channel an adversary towards interacting with it. We create a browser shortcut and place it in a publically accessible location on the Active Directory Server to make it easier for the adversary to discover.
\n\n\n\nWe ensure that our web server is logging connections. If an adversary attempts to conduct reconnaissance against this webserver, we should see a logline in the webserver log.
\n\n\n\nPsuedo-code for detection rule:
\n\n\n\nIf REQUEST observed for /admin then raise a high priority alert.\n\n\n\n
MITRE Shield Procedure – DPR0024
\n\n\n\nDecoy credentials are fake usernames and passwords that can be planted in a variety of places including in the Active Directory. They act as silent alarms when interacted with and also as a means to delay the attacker.
\n\n\n\nIn this video, we create a batch file planted with fake credentials and store it in a publically accessible location on the Active Directory Server to make it easier for the adversary to discover.
\n\n\n\nIn this video, we show how to set up auditing on your test machine to capture attempts to use the credentials against your test machine.
\n\n\n\nPsuedo-code for detection rule:
\n\n\n\nIf login_event is 4625 AND username is admin\n\n\n\n
Then raise a high priority alert.
MITRE Shield Procedure – DPR0052
\n\n\n\nPocket litter is an active defense technique used to mislead attackers into thinking that the system and user they’re exploiting are legit. You plant fake documents, browser history, browser sessions, etc. to give adversaries the confidence that they are on the right track.
\n\n\n\nIn this video, we will set up a file share on the test machine. We will plant a shortcut to this file share in a publically accessible location on the Active Directory Server to make it easier for the adversary to discover.
\n\n\n\nIn this video, we show how to set up file share auditing on your test machine to capture attempts to access the file share on your machine.
\n\n\n\nPsuedo-code for detection rule:
\n\n\n\nIf login_event is 5140 AND share_name contains shared_folder_name\nThen raise a high priority alert.\n\n\n\n
These folders are accessible to all users within your environment. Over time, these folders accrue a lot of files and scripts that are interesting to adversaries. We wish to use these folders to misdirect the attacker, should the attacker go browsing through these folders. It is also uncommon for regular users to require to browse through this folder.
\n\n\n\nThe focus of this guide was to get your mind thinking about active defense. If there’s one thing I’d like you to walk away with, it’s that if any of these defenses trigger an alarm you will have discovered malicious activity for a couple of hours of effort. And it cost you nothing.
\n\n\n\nAt Smokescreen, we’ve been implementing active defense programs since before it was a thing. No wonder then that Smokescreen covered 95% of MITRE Shield when it launched in Sep 2020. If you’d like to see how we can help, hit us up. Here’s a mapping of Smokescreen to MITRE Shield if it’s helpful.
\n\n\n\nWe’re also running active defense workshops where we deconstruct MITRE Shield and talk about how you can implement it. Feel free to sign up.
\n","excerpt":"For free, of course. At this point, I’m positive that you’ve heard of MITRE Shield. It’s a new active defense knowledge base released by MITRE – stuff they’ve been implementing for over a decade to engage adversaries and derail attacks. They’ve opened it up to everyone, and for the first time perhaps, the infosec community […]\n","slug":"four-mitre-shield-techniques-you-can-implement-in-2021","date":"2020-12-30T16:48:39.000Z","status":"publish","modified":"2021-02-03T07:14:04.000Z","wordpress_id":18652,"featured_media":{"id":"3b48d9b0-598d-52ec-92d7-1eef58be5ea8","source_url":"https://ss-website-content-prod.s3.ap-south-1.amazonaws.com/wp-content/uploads/2020/12/Smokescreen-MITRE-Shield-Techniques.png","alt_text":"Smokescreen-MITRE-Shield-Techniques","large":{"childImageSharp":{"fluid":{"base64":"data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAABQAAAALCAYAAAB/Ca1DAAAACXBIWXMAAAsTAAALEwEAmpwYAAACQklEQVQoz0WSSW8TQRCF84s5IXFBHJEQ4g9wQggOkbhEBEEIS4xDMkZeEhzH8SITJ+N4tu4Zz+6xncerceIcamq6W/11Vb23ZU8mULYN33UxUx5mWsHXGjPfRxgECGezh+Ba9gOea8+Dchy4lgXn5gbCsUwTW/IZXHTR6w/RG11jMrV5mRcJiKIIcRw/BNdRGJZggfpKbaAboDkew6hWcWg0YHRGuDQtFFmKPMuQpSmSJEHKSEooH4jC8sHAlypdeLZF4HRT5ZbFn9HlGOOrK5gTEybXJl+8NDkK7SPP8xKWpMzZkrlgXjBWPFshZQ7DpISWwBuWuf3lKz7sf8f23jd8rBxit/obe8c1NLoXmOcZUsLiyIY3rUG755z5KbRlINZt5MEJVrkFz9UEmmvgzo8D7Faq2Cdk5+AXPlWPcNg6RWc4YtsJsjmQWAfQJ0/gd1/Bbz+D138L3XkO1XyE1PoJpWICr9ctN9pnaHXOcdYfoHXRw1/m7ugfivmcs0yR5bdInD8I2k+he68RCHT4Dqr3Brr1GJl7TGC0BopCmkoFVEwsEVNFmVnKEKWlwpSzy/0zJP0XSNw6YqeBePIZyfg90sFLFH4DygvvKmTL1UoFNcPA8dERDOZms4l6vY4Jh1wqTfi8KLBY3qIo5igWQLFkyN5ixVhQbXstijOlOgyXG4rmLk19Z+gsE0HW1pFqg4CmZhc+za/EMuzMEQ+KZe5tI/4Rujg/uIOJee/NLLCNFxmyJ+ez0tyKqrvlfeFIt/8BWgssJrC5KxYAAAAASUVORK5CYII=","aspectRatio":1.9047619047619047,"src":"/static/edada2176ce537fff9fc98c912eee812/ee604/Smokescreen-MITRE-Shield-Techniques.png","srcSet":"/static/edada2176ce537fff9fc98c912eee812/69585/Smokescreen-MITRE-Shield-Techniques.png 200w,\n/static/edada2176ce537fff9fc98c912eee812/497c6/Smokescreen-MITRE-Shield-Techniques.png 400w,\n/static/edada2176ce537fff9fc98c912eee812/ee604/Smokescreen-MITRE-Shield-Techniques.png 800w,\n/static/edada2176ce537fff9fc98c912eee812/f3583/Smokescreen-MITRE-Shield-Techniques.png 1200w,\n/static/edada2176ce537fff9fc98c912eee812/5707d/Smokescreen-MITRE-Shield-Techniques.png 1600w,\n/static/edada2176ce537fff9fc98c912eee812/0ef64/Smokescreen-MITRE-Shield-Techniques.png 2400w","srcWebp":"/static/edada2176ce537fff9fc98c912eee812/58556/Smokescreen-MITRE-Shield-Techniques.webp","srcSetWebp":"/static/edada2176ce537fff9fc98c912eee812/61e93/Smokescreen-MITRE-Shield-Techniques.webp 200w,\n/static/edada2176ce537fff9fc98c912eee812/1f5c5/Smokescreen-MITRE-Shield-Techniques.webp 400w,\n/static/edada2176ce537fff9fc98c912eee812/58556/Smokescreen-MITRE-Shield-Techniques.webp 800w,\n/static/edada2176ce537fff9fc98c912eee812/99238/Smokescreen-MITRE-Shield-Techniques.webp 1200w,\n/static/edada2176ce537fff9fc98c912eee812/7c22d/Smokescreen-MITRE-Shield-Techniques.webp 1600w,\n/static/edada2176ce537fff9fc98c912eee812/f1e40/Smokescreen-MITRE-Shield-Techniques.webp 2400w","sizes":"(max-width: 800px) 100vw, 800px"}}},"medium":{"childImageSharp":{"fluid":{"base64":"data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAABQAAAAKCAYAAAC0VX7mAAAACXBIWXMAAAsTAAALEwEAmpwYAAACFUlEQVQoz02SS0/bQBSF83f7A7rprpt22S5bqbtu6KpqEaiKUAuEgAgJIQhC0jyI4zi249f4NbZj0OkZJ0pZXM3Ynvl87rmnZhsGTF2HNp1iPtehGyZc10UoBKIwRBzHSLal9lEUVd+E7yPgOW+1gmNZUBxrsUBttVxWsItGA832LVr9R9iOhyKTyLMMaZruSqYx0oTwKEQkAgSeQ6BFoAnFUdBapZA1nkwxnc0w518WpgndtFgmshfQKF0jTApWDhGvkcgSMnumarlTWXN5aULY96Pf+PHnBAeNJg7OznHcucb+aRO261FpjlSmEF4fwh2w3TGE00UiBpDiDqVcwuM522DLLskTtvztVx37x6c4JHCvfoTD5gXOuj2sFDAv2K5AeP8Wwd17iNs38AafETx8QNB5BWn8hO/HBOobDy3W/fAvxjMNY22O4eMMQ+59mv/8VFJdhkxyIA/v4PUJGX5CMPiIYPQVfvc1pH0C34s2CiszWYamwaR/yk/XtuFzgg4nGIaCPuasFIWxh8w6QhbNkdgt7uvItS8oRYfAcAukhwvCri4vcd1u46rVQu/mBr1eD6PRqIqKlLIaSlECWfGELC+54v+areFQxG7KDqEqU2EQIGbO0iRhi5vYKJgkLOG7iGqVYhGoyDCDzqqKjL3tsgKqMKoHNXYV0sDzqgtVqAlXoJdZVM/qfbQNt7JGWVTNgqx/v9rh65njvVwAAAAASUVORK5CYII=","aspectRatio":1.9152542372881356,"src":"/static/edada2176ce537fff9fc98c912eee812/62b1f/Smokescreen-MITRE-Shield-Techniques.png","srcSet":"/static/edada2176ce537fff9fc98c912eee812/e7519/Smokescreen-MITRE-Shield-Techniques.png 113w,\n/static/edada2176ce537fff9fc98c912eee812/7e7e9/Smokescreen-MITRE-Shield-Techniques.png 225w,\n/static/edada2176ce537fff9fc98c912eee812/62b1f/Smokescreen-MITRE-Shield-Techniques.png 450w,\n/static/edada2176ce537fff9fc98c912eee812/e2e7f/Smokescreen-MITRE-Shield-Techniques.png 675w,\n/static/edada2176ce537fff9fc98c912eee812/db955/Smokescreen-MITRE-Shield-Techniques.png 900w,\n/static/edada2176ce537fff9fc98c912eee812/0ef64/Smokescreen-MITRE-Shield-Techniques.png 2400w","srcWebp":"/static/edada2176ce537fff9fc98c912eee812/b8a88/Smokescreen-MITRE-Shield-Techniques.webp","srcSetWebp":"/static/edada2176ce537fff9fc98c912eee812/3a3bf/Smokescreen-MITRE-Shield-Techniques.webp 113w,\n/static/edada2176ce537fff9fc98c912eee812/975bf/Smokescreen-MITRE-Shield-Techniques.webp 225w,\n/static/edada2176ce537fff9fc98c912eee812/b8a88/Smokescreen-MITRE-Shield-Techniques.webp 450w,\n/static/edada2176ce537fff9fc98c912eee812/761da/Smokescreen-MITRE-Shield-Techniques.webp 675w,\n/static/edada2176ce537fff9fc98c912eee812/210c1/Smokescreen-MITRE-Shield-Techniques.webp 900w,\n/static/edada2176ce537fff9fc98c912eee812/f1e40/Smokescreen-MITRE-Shield-Techniques.webp 2400w","sizes":"(max-width: 450px) 100vw, 450px"}}}},"author":{"id":"765e8417-7ed6-55b7-95a7-1d561141e760","name":"Sudarshan Pisupati"}}},{"node":{"id":"9d8a2f78-f1ee-581e-957c-2092fc5a0b66","title":"Active Defense – Incident Response’s New Best Friend","content":"\nOn Sep 14, 2020, MITRE, the federally funded R&D organization perhaps best known for its popular ATT&CK framework, announced Shield – an Active Defense knowledge base developed to arm cybersecurity defenders with a framework for actively dealing with threats instead of passively reacting to them. As MITRE puts it, Shield has been “derived from over 10 years of adversary engagement experience. It spans the range from high level, CISO ready considerations of opportunities and objectives, to practitioner friendly discussions of the TTPs available to defenders.”
\n\n\n\nAs an industry armed with protecting networks and IT infrastructures, we have been overly reliant on passive defenses. Given the rapid pace of technology development, shortage of skilled cybersecurity professionals, and the vendor community’s ‘assume breach’ schtick, we have become accustomed to dealing with threats on our turf, on the adversary’s terms, instead of actively smoking out the threat. We’re always reacting after the fact. Which is why Shield couldn’t have arrived sooner.
\n\n\n\nSince then, I’ve had countless conversations with CISOs attempting to understand how Shield can inform their security posture and incident handlers/practitioners on what they can do today that might have an outsized impact on their ability to defend. I’ve also realized that there’s a fundamental conversation to be had about what ‘active defense’ in cybersecurity means, and why teams must adopt it as an integral part of their security program and best practices.
\n\n\n\nOver the last 10 years, I have been a part of multiple incident response projects. The story usually unfolds in a similar fashion – evidence of compromise is on the network. Jump to the ‘Cotton Eye Joe’ problem – where did it come from, where does it go. And of course, what did it damage.
\n\n\n\nPerhaps the most high-pressure scenarios are those where the threat is not just active but is actively moving around the network, say something like ransomware. Machine after machine is getting infected, and there is nothing you can do to stop it.
\n\n\n\nConsider this nightmare scenario for a moment. You work security for a business with 1000 employees. You don’t have an anti-virus (AV) installed (hypothetical). You have been infected by ransomware. You immediately take a call to purchase an AV, the budget gets freed up, and you go to procure it. But it takes days, even weeks if not months to procure it and push it out to every single workstation and server. Your AV has now future proof-ed you in some way, but the adversary has already finished her attack. You are recovering from the disaster in some form. Maybe you are restoring backups. Maybe you just paid up the ransom. The response was required in minutes and hours. That battle was lost.
\n\n\n\nThe fallouts of such incidents can be brutal. There is intense pressure on security teams, and they carry heavy burdens. I have seen security folks stay up 96 hours at a stretch, trying to squeeze in a couple of minutes of sleep in offices amid thousands of messages, texts, and calls. I have seen top management in companies get involved and ask tough questions to which there are no good answers.
\n\n\n\nIf you are involved in any security function in your organization, at any level, this should be relatable. To some, something like this might have happened recently. For some, it’s been a while. And if it hasn’t happened to you yet, chances are, it will happen at some point – sooner rather than later.
\n\n\n\nAnd then let’s talk money. It costs a lot of money. I’m talking serious cash. In the order of hundreds of thousands of dollars. All being spent in a matter of days. You are paying your vendors, service providers, advisors, and implementers. You are paying by the hour for everyone involved in the response, IT teams, security teams, and active directory teams. And then people wonder why cybersecurity is a $123 billion industry.
\n\n\n\nIt gets chaotic.
\n\n\n\nIn my experience, you can contain that chaos with an Active Defense mindset.
\n\n\n\nActive defense isn’t really a new concept. For example, the armed forces and police have active defense protocols. If intelligence picks up an impending threat, the machinery kicks in to reflect the seriousness of the threat. Intensified checking at posts, barricades across high-value locations and roads, enhanced protective measures for ministers and other high-value targets, orders to restrict the movement of people and goods, frequent patrolling – you get the drift.
\n\n\n\nNow notice this strategy for a moment. It includes a lot of tough calls because the threat has a material impact on the life of civilians. There’s a protocol in place. Also, notice that the strategy doesn’t involve waiting for the bad guy to move around as he pleases. It actively tries to smoke the threat out. The alternative is to play catch up. Always one step behind the threat. Ring any bells? Of course, it does because that’s exactly what we do in cybersecurity.
\n\n\n\nWhat I’m getting to is that when you are in the midst of an incident, you have ways to try to smoke out the threat, make life difficult for the adversary, and minimize the impact of the breach. One that can be measured in days (if not hours), will not be as costly and will reign in panic.
\n\n\n\nIt involves barricades, restriction of movement, enhanced patrolling, and of course, protecting the crown jewels.
\n\n\n\nHere’s how it might look like in a real-life ‘incident’:
\n\n\n\nThis is, of course, a non-exhaustive list but all of these can be really quick to do! The biggest impediment is usually taking the tough calls as this may temporarily and disrupt services. It also happens because of poor team communication across the board. It is because of this that we forgo a defensive advantage and chase the threat for days and months on end.
\n\n\n\nBut hey, if you drill this out before things go wrong, you will already know and understand what the impact is going to be.
\n\n\n\nThink about it this way. You have an existing set of software defenses. That should make life difficult for the software tactics of the threat. Active defense is you putting additional software defenses to attack the human behind the threat.
\n\n\n\nThis brings me back to why MITRE Shield couldn’t have come sooner. For the first time, defenders have a shared vocabulary and framework for what they can proactively do to defend their networks. It even maps out to MITRE ATT&CK, telling you exactly which defense can disrupt an attack tactic. I strongly urge you to check out Shield.
\n\n\n\nIf you need help with understanding this more, we are running 30 mins workshops to deconstruct MITRE Shield and breakdown how you can get started with active defense. Feel free to sign up here.
\n\n\n\nWe have also released our mapping to MITRE Shield. With Smokescreen, you can achieve 95% coverage of all the active defense techniques included in the framework. You can get the mapping from here. And if you want to see all of this in action, you can always ask for a demo.
\n\n\n\nI’m very excited about all the conversations that are happening around MITRE Shield. As we help our customers implement Shield and achieve more active defense coverage, I will be sharing what I learn. Feel free to hit me up on LinkedIn or Twitter.
\n","excerpt":"Active defense provides defenders with a shared vocabulary and framework for actively dealing with threats instead of passively reacting to them.\n","slug":"active-defense-for-incident-responders","date":"2020-12-29T01:34:46.000Z","status":"publish","modified":"2021-01-24T16:42:40.000Z","wordpress_id":18639,"featured_media":{"id":"b7c5bd0f-1190-59a5-8777-52cae2404171","source_url":"https://ss-website-content-prod.s3.ap-south-1.amazonaws.com/wp-content/uploads/2020/12/Smokescreen-Active-defense-blog-post-scaled.jpeg","alt_text":"Active defense","large":{"childImageSharp":{"fluid":{"base64":"data:image/jpeg;base64,/9j/2wBDABALDA4MChAODQ4SERATGCgaGBYWGDEjJR0oOjM9PDkzODdASFxOQERXRTc4UG1RV19iZ2hnPk1xeXBkeFxlZ2P/2wBDARESEhgVGC8aGi9jQjhCY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2P/wgARCAAeABQDASIAAhEBAxEB/8QAGAAAAwEBAAAAAAAAAAAAAAAAAAMEBQL/xAAXAQEBAQEAAAAAAAAAAAAAAAAAAQID/9oADAMBAAIQAxAAAAHhjmc9wlhS3Z1SVGcH/8QAHBAAAgICAwAAAAAAAAAAAAAAAAECEhETITFB/9oACAEBAAEFAoRNaKEevMF1Y4Fhu5sP/8QAFBEBAAAAAAAAAAAAAAAAAAAAIP/aAAgBAwEBPwEf/8QAFBEBAAAAAAAAAAAAAAAAAAAAIP/aAAgBAgEBPwEf/8QAGhAAAQUBAAAAAAAAAAAAAAAAEAABERIgIf/aAAgBAQAGPwLUDrqx/8QAHBABAQEAAgMBAAAAAAAAAAAAAQARITFBUWHh/9oACAEBAAE/ITMnIySLEeluZy5+yTG+W8Q46l+yCjkukofy/9oADAMBAAIAAwAAABCYLEP/xAAVEQEBAAAAAAAAAAAAAAAAAAAgIf/aAAgBAwEBPxCD/8QAFhEBAQEAAAAAAAAAAAAAAAAAEBFB/9oACAECAQE/EKaf/8QAHhABAAICAgMBAAAAAAAAAAAAAQARITFBYVGBkeH/2gAIAQEAAT8QGCBw41FZqumrH9hlpvRdSkYcahaBVVt47I2YepIiqF88TCrrUCEM6mvuO7dUFejqPTcf/9k=","aspectRatio":0.6644518272425249,"src":"/static/4cdd14b89e9545a1913f042df0c033ec/14b42/Smokescreen-Active-defense-blog-post-scaled.jpg","srcSet":"/static/4cdd14b89e9545a1913f042df0c033ec/f836f/Smokescreen-Active-defense-blog-post-scaled.jpg 200w,\n/static/4cdd14b89e9545a1913f042df0c033ec/2244e/Smokescreen-Active-defense-blog-post-scaled.jpg 400w,\n/static/4cdd14b89e9545a1913f042df0c033ec/14b42/Smokescreen-Active-defense-blog-post-scaled.jpg 800w,\n/static/4cdd14b89e9545a1913f042df0c033ec/47498/Smokescreen-Active-defense-blog-post-scaled.jpg 1200w,\n/static/4cdd14b89e9545a1913f042df0c033ec/0e329/Smokescreen-Active-defense-blog-post-scaled.jpg 1600w,\n/static/4cdd14b89e9545a1913f042df0c033ec/4f4f6/Smokescreen-Active-defense-blog-post-scaled.jpg 1700w","srcWebp":"/static/4cdd14b89e9545a1913f042df0c033ec/58556/Smokescreen-Active-defense-blog-post-scaled.webp","srcSetWebp":"/static/4cdd14b89e9545a1913f042df0c033ec/61e93/Smokescreen-Active-defense-blog-post-scaled.webp 200w,\n/static/4cdd14b89e9545a1913f042df0c033ec/1f5c5/Smokescreen-Active-defense-blog-post-scaled.webp 400w,\n/static/4cdd14b89e9545a1913f042df0c033ec/58556/Smokescreen-Active-defense-blog-post-scaled.webp 800w,\n/static/4cdd14b89e9545a1913f042df0c033ec/99238/Smokescreen-Active-defense-blog-post-scaled.webp 1200w,\n/static/4cdd14b89e9545a1913f042df0c033ec/7c22d/Smokescreen-Active-defense-blog-post-scaled.webp 1600w,\n/static/4cdd14b89e9545a1913f042df0c033ec/35cfd/Smokescreen-Active-defense-blog-post-scaled.webp 1700w","sizes":"(max-width: 800px) 100vw, 800px"}}},"medium":{"childImageSharp":{"fluid":{"base64":"data:image/jpeg;base64,/9j/2wBDABALDA4MChAODQ4SERATGCgaGBYWGDEjJR0oOjM9PDkzODdASFxOQERXRTc4UG1RV19iZ2hnPk1xeXBkeFxlZ2P/2wBDARESEhgVGC8aGi9jQjhCY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2P/wgARCAAeABQDASIAAhEBAxEB/8QAGAAAAwEBAAAAAAAAAAAAAAAAAAMEBQL/xAAXAQEBAQEAAAAAAAAAAAAAAAAAAQID/9oADAMBAAIQAxAAAAHhjmc9wlhS3Z1SVGcH/8QAHBAAAgICAwAAAAAAAAAAAAAAAAECEhETITFB/9oACAEBAAEFAoRNaKEevMF1Y4Fhu5sP/8QAFBEBAAAAAAAAAAAAAAAAAAAAIP/aAAgBAwEBPwEf/8QAFBEBAAAAAAAAAAAAAAAAAAAAIP/aAAgBAgEBPwEf/8QAGhAAAQUBAAAAAAAAAAAAAAAAEAABERIgIf/aAAgBAQAGPwLUDrqx/8QAHBABAQEAAgMBAAAAAAAAAAAAAQARITFBUWHh/9oACAEBAAE/ITMnIySLEeluZy5+yTG+W8Q46l+yCjkukofy/9oADAMBAAIAAwAAABCYLEP/xAAVEQEBAAAAAAAAAAAAAAAAAAAgIf/aAAgBAwEBPxCD/8QAFhEBAQEAAAAAAAAAAAAAAAAAEBFB/9oACAECAQE/EKaf/8QAHhABAAICAgMBAAAAAAAAAAAAAQARITFBYVGBkeH/2gAIAQEAAT8QGCBw41FZqumrH9hlpvRdSkYcahaBVVt47I2YepIiqF88TCrrUCEM6mvuO7dUFejqPTcf/9k=","aspectRatio":0.6647058823529411,"src":"/static/4cdd14b89e9545a1913f042df0c033ec/32fd5/Smokescreen-Active-defense-blog-post-scaled.jpg","srcSet":"/static/4cdd14b89e9545a1913f042df0c033ec/06e94/Smokescreen-Active-defense-blog-post-scaled.jpg 113w,\n/static/4cdd14b89e9545a1913f042df0c033ec/07ab6/Smokescreen-Active-defense-blog-post-scaled.jpg 225w,\n/static/4cdd14b89e9545a1913f042df0c033ec/32fd5/Smokescreen-Active-defense-blog-post-scaled.jpg 450w,\n/static/4cdd14b89e9545a1913f042df0c033ec/4a838/Smokescreen-Active-defense-blog-post-scaled.jpg 675w,\n/static/4cdd14b89e9545a1913f042df0c033ec/9842e/Smokescreen-Active-defense-blog-post-scaled.jpg 900w,\n/static/4cdd14b89e9545a1913f042df0c033ec/4f4f6/Smokescreen-Active-defense-blog-post-scaled.jpg 1700w","srcWebp":"/static/4cdd14b89e9545a1913f042df0c033ec/b8a88/Smokescreen-Active-defense-blog-post-scaled.webp","srcSetWebp":"/static/4cdd14b89e9545a1913f042df0c033ec/3a3bf/Smokescreen-Active-defense-blog-post-scaled.webp 113w,\n/static/4cdd14b89e9545a1913f042df0c033ec/975bf/Smokescreen-Active-defense-blog-post-scaled.webp 225w,\n/static/4cdd14b89e9545a1913f042df0c033ec/b8a88/Smokescreen-Active-defense-blog-post-scaled.webp 450w,\n/static/4cdd14b89e9545a1913f042df0c033ec/761da/Smokescreen-Active-defense-blog-post-scaled.webp 675w,\n/static/4cdd14b89e9545a1913f042df0c033ec/210c1/Smokescreen-Active-defense-blog-post-scaled.webp 900w,\n/static/4cdd14b89e9545a1913f042df0c033ec/35cfd/Smokescreen-Active-defense-blog-post-scaled.webp 1700w","sizes":"(max-width: 450px) 100vw, 450px"}}}},"author":{"id":"765e8417-7ed6-55b7-95a7-1d561141e760","name":"Sudarshan Pisupati"}}},{"node":{"id":"141a7972-5983-5910-bb47-f0396dbf162f","title":"You Need Deception Technology. And It’s Not Why You Think","content":"\r\nInformation security is a complex field. The list of available security technologies starts deceptively simple, beginning with firewalls and antivirus but quickly becomes complex and well, intimidating.
\r\n\r\n\r\n\r\nYou can ascertain the maturity of a cybersecurity program by the types of security controls implemented in a network. Most organizations have at least a firewall, antivirus, and maybe a VPN. As security programs develop, patch management technology, email filtering, and vulnerability scanning get implemented next.
\r\n\r\n\r\n\r\nAs organizations mature further, IDS, IPS, SIEM, and web application firewalls become common. Then comes Network Traffic Analysis (NTA), Network Access Control (NAC), Data Loss Prevention (DLP), User Entity and Behavior Analytics (UBA/UEBA), various types of encryption, single sign-on, file integrity validation, mobile device management, web filtering, and two-factor authentication. There are a lot more, but you get the idea.
\r\n\r\n\r\n\r\nEfforts to simplify the list often break security controls down into categories, such as protective or detective controls. Many of these technologies can be easily categorized based on their primary function. Firewalls, antivirus, NAC, VPN, IPS, email filtering, and vulnerability scanning are primarily protective. IDS, SIEM, DLP, UBA/UEBA, and file integrity validation are detective in nature.
\r\n\r\n\r\n\r\nThese are, of course, general categorizations. Firewalls, for example, can generate logs that act as detections while DLP often utilizes active blocking that is protective. Different vendor solutions can blur the distinction between preventive and detective, while solutions such as Unified Threat Management (UTM) and many next-gen firewalls incorporate the features of multiple technologies into a single solution. Functionally, though, it is still possible to categorize security technologies.
\r\n\r\n\r\n\r\nWhen it comes to deception technology, things get a lot more unclear – Is it protective? Is it detective? Is it suited for mature security programs? Or can it be implemented small security teams with limited security controls as well? The answer to all these questions is – Yes. Wait, how can this be?
\r\n\r\n\r\n\r\nWell, the problem is one involving the framing of the question. Before we look at deception technology, we are going to look at another aspect of security – physical security.
\r\n\r\n\r\n\r\nCybersecurity practitioners are aware of the impact physical security controls have. Physical security is generally considered a related but separate discipline. Weak physical security can often render highly effective cybersecurity controls moot. Why? Because attackers have two channels with which they can interact with your assets: cyber and physical.
\r\n\r\n\r\n\r\nCyber interactions occur via packets, bits, and bytes. They happen over the network and are relatively independent of the physical world. It does not matter what physical form the computer takes or if the connection to the Internet is via Ethernet or coax cable. You counter cyberattacks with cybersecurity controls.
\r\n\r\n\r\n\r\nPhysical interactions, on the other hand, occur in the real world and involve direct interactions with objects that have mass and can move from one location to another. You counter physical attacks using physical security controls.
\r\n\r\n\r\n\r\nWhile there is a relationship between physical and cyber, they are not directly related. Addressing one area provides no guarantee of protection in the other.
\r\n\r\n\r\n\r\nConsider data that is protected by theoretically perfect cyber controls. Assume there is absolutely no way for an attacker to harm an organization via any form of cyberattack. Weaknesses in physical security can still result in significant harm. An attacker with physical access can retrieve the output of a printer, listen to spoken conversations, or even shoulder surf an authorized user to obtain sensitive data. Even if none of these are possible, an attacker with a sledgehammer and an angle grinder in a data center can cause serious harm.
\r\n\r\n\r\n\r\nThe converse is also true. An organization with theoretically perfect physical security can be compromised if they have cyber weaknesses. Locked doors, security cameras, motion sensors, and security guards do little to stop an attack consisting of packets going across wires.
\r\n\r\n\r\n\r\nAnother way of looking at this relationship between physical and cybersecurity is from the perspective of an attacker. When planning their attack, adversaries can target cyber or physical controls depending on identified weaknesses.
\r\n\r\n\r\n\r\nThese, however, are not the only options available to attackers. To facilitate either physical or cyber compromise, attackers often target the human. Techniques such as phishing, spear-phishing, and social engineering exploit long-established habits, patterns, and biases to break into systems. These techniques could be employed to facilitate a cyberattack, such as when sending a malicious attachment in an email. They can also be used as part of a physical attack, for instance, when an adversary pretends to be delivering a package to gain access to a building.
\r\n\r\n\r\n\r\nAccording to the 2020 Ponemon Institute Cost of a Data Breach Report, the combination of phishing and social engineering represents 17% of data breaches, more than vulnerabilities in third-party software (16%), physical security compromise (10%), malicious insiders (7%), misconfigurations/system error (6%), or business email compromise (5%).
\r\n\r\n\r\n\r\nAdversaries attack us physically, and we employ physical security controls to counter those attacks. They launch cyberattacks, and we use cybersecurity controls as countermeasures. But what about attackers targeting the human mind? That is when cyber deception comes into play.
\r\n\r\n\r\n\r\nIn his book Practice to Deceive, noted deception author Barton Whaley writes, “In combat, deception strengthens the weaker side. When all other factors are equal, the more deceptive player or team will always win.”
\r\n\r\n\r\n\r\nSocial engineering, phishing, and cyberattacks such as antivirus evasion employ deception. Traditionally, however, defenders have not relied on cyber-deception. As a result, attackers consistently compromise our environments and remain on them for days, weeks, or even months before being detected. Deception technology allows us to change the game entirely.
\r\n\r\n\r\n\r\nDeception technology allows defenders to influence the thoughts and actions of attackers. Your network is yours. You have created it and, therefore, can control its every aspect, down to the individual packet. As a result, you have the capability of manipulating what the attackers see once they are inside. By using deception techniques, you can place attackers into a real-life version of The Matrix.
\r\n\r\n\r\n\r\nYou can place deceptive systems, services, credentials, files, and other resources on the network. As these resources have no real production function, there should be no legitimate interaction with them. Any attempt to interact with these resources is, therefore, suspicious at a minimum and malicious at worse. Alerting on this interaction results in a high-fidelity, low noise detection solution.
\r\n\r\n\r\n\r\nBy carefully designing and placing these deceptive assets on the network, you can distract attackers away from your truly critical resources, not only allowing for detection of the attack but also delaying its progress.
\r\n\r\n\r\n\r\nBy analyzing the interaction of the attackers with these deceptive resources, you can learn more about their tactics, techniques, and procedures. This threat intelligence can create a better defensive security architecture and improve the effectiveness of the deceptive environment.
\r\n\r\n\r\n\r\nFaster and more effective attack detection combined with comprehensive information about the attack allows for increased efficiency of security operations and a more effective incident response. You will not only minimize the harm resulting from the attacks but also reduce your SOC overhead.
\r\n\r\n\r\n\r\nHigher fidelity detection allows you to take a more active role in defensive operations. Traditionally, defensive security makes use of static technology to combat human and automated threats alike. Security technology can combat automated threats as humans cannot operate at the speeds necessary to counter automated attacks such as fast-spreading malware.
\r\n\r\n\r\n\r\nTechnology controls, however, are constrained by their programming. Creative attackers have a history of discovering the limits of, and then circumventing those controls. Given enough time and the necessary skills, creative human attackers will always win against technology – this is where the real value of deception technology comes into play.
\r\n\r\n\r\n\r\nThe only truly effective way to combat a creative human attacker is with another human. Unfortunately, most organizations lack the budget to maintain a staff of active defenders because, in part, SOC analysts are spending as much as one-third of their time dealing with false-positive alerts.
\r\n\r\n\r\n\r\nDeception technology significantly reduces the number of false positives, generates detailed attack intelligence, and detects attackers more quickly. As a result, your analysts save a ton of time that they would otherwise spend chasing ghosts. Without these benefits, having your analysts actively respond to attacks is an exercise in futility. With deception, you will identify attacks more quickly and have the time to engage attackers.
\r\n\r\n\r\n\r\nWhen discussing active attacker engagement, we are not talking about hacking back. There may be situations where nation-state operators engage in offensive counter-hacking, but this is illegal for most organizations. There are, however, many options available to active defenders that do not cross the hack-back line.
\r\n\r\n\r\n\r\nAs defenders, there is a lot you can do once you have identified an attacker on your network. You can manipulate, in real-time, the deceptive environment and the deception cover story based on your knowledge of the attack. Here are some examples of what is possible:
\r\n\r\n\r\n\r\nThese tactics are effective after the attacker has gained a solid foothold in the environment. Ideally, defenders could even slow down or distract attackers while law enforcement is engaged if the circumstances were appropriate.
\r\n\r\n\r\n\r\nTraditionally, information security professions like penetration testing, red-teaming, digital forensics, and incident response have been considered cool. It is because defenders appear to be responsible for babysitting technology and wading through copious amounts of log data.
\r\n\r\n\r\n\r\nWith deception technology, we can change that paradigm. You will be able to create active defense professionals who turn the adversary’s playbook against them. When you get to this stage, it will be easier for an attacker to physically compromise an environment than to compromise it across a wire. That is when defenders truly achieve ultimate victory.
\r\n\r\n\r\n\r\nDeception technology enables you to distract attackers away from critical resources and delay their progress in your network. It allows you to detect them more quickly, but none of these represent the superpower of cyber deception. Cyber deception can, when fully utilized, cause an attacker to second-guess everything they think they know about your environment. It can create the impression that detection and possible capture is imminent. And it can lead the attacker to conclude that attacking a deceptive environment is more trouble than it is worth. In every real sense, cyber deception can stop an attack before it even begins.
\r\n\r\n\r\n\r\nSo, back to where we started – Where does cyber deception fit into the landscape of information security? Is it detective or protective? Does it require a robust cybersecurity program? These questions assume that cyber-deception is a component of cybersecurity. It is not.
\r\n\r\n\r\n\r\nDefensive security operations involve three functions: cyber, physical, and mental. Like a stool with three legs, a failure in any one of these functions can lead to compromise.
\r\n\r\n\r\n\r\nCyber deception is the answer to the mental component, and like physical security, it works with but is separate from traditional cyber controls. As such, it can and should be deployed by every organization, regardless of size or technical complexity. It requires no other technical security controls, yet can benefit from and, in turn, can provide benefits to any existing security program. It is the missing piece of the defensive security puzzle. Without it, attackers have had the advantage. With cyber deception, defenders can finally take that advantage back.
\r\n","excerpt":"Deception technology is a different way of thinking about cybersecurity. Without it, attackers have the advantage. You can take that advantage back.\n","slug":"you-need-deception-technology","date":"2020-09-10T15:49:12.000Z","status":"publish","modified":"2020-09-14T09:22:29.000Z","wordpress_id":18568,"featured_media":{"id":"859ade4b-22e8-546a-8993-e72933193226","source_url":"https://ss-website-content-prod.s3.ap-south-1.amazonaws.com/wp-content/uploads/2020/09/You-need-deception-technology.jpeg","alt_text":"You need deception technology","large":{"childImageSharp":{"fluid":{"base64":"data:image/jpeg;base64,/9j/2wBDABALDA4MChAODQ4SERATGCgaGBYWGDEjJR0oOjM9PDkzODdASFxOQERXRTc4UG1RV19iZ2hnPk1xeXBkeFxlZ2P/2wBDARESEhgVGC8aGi9jQjhCY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2P/wgARCAANABQDASIAAhEBAxEB/8QAGAAAAgMAAAAAAAAAAAAAAAAAAAMBAgX/xAAUAQEAAAAAAAAAAAAAAAAAAAAA/9oADAMBAAIQAxAAAAHJq5AEh//EABsQAAICAwEAAAAAAAAAAAAAAAECABMQERIh/9oACAEBAAEFAq2aV6JPquTjif/EABQRAQAAAAAAAAAAAAAAAAAAABD/2gAIAQMBAT8BP//EABQRAQAAAAAAAAAAAAAAAAAAABD/2gAIAQIBAT8BP//EABYQAAMAAAAAAAAAAAAAAAAAAAAgMf/aAAgBAQAGPwJaf//EABkQAQACAwAAAAAAAAAAAAAAAAEAIRExQf/aAAgBAQABPyHUDsVv5mcDCG7iq4zqpYI//9oADAMBAAIAAwAAABDDz//EABQRAQAAAAAAAAAAAAAAAAAAABD/2gAIAQMBAT8QP//EABQRAQAAAAAAAAAAAAAAAAAAABD/2gAIAQIBAT8QP//EAB0QAAICAgMBAAAAAAAAAAAAAAEhABExQVFx0YH/2gAIAQEAAT8QDFQA0OvZXaJJRIfkMSNAOJglsefkvrA1agsLBJT/2Q==","aspectRatio":1.5037593984962405,"src":"/static/b62f4738daa35d16f49ade4155876bd2/14b42/You-need-deception-technology.jpg","srcSet":"/static/b62f4738daa35d16f49ade4155876bd2/f836f/You-need-deception-technology.jpg 200w,\n/static/b62f4738daa35d16f49ade4155876bd2/2244e/You-need-deception-technology.jpg 400w,\n/static/b62f4738daa35d16f49ade4155876bd2/14b42/You-need-deception-technology.jpg 800w,\n/static/b62f4738daa35d16f49ade4155876bd2/47498/You-need-deception-technology.jpg 1200w,\n/static/b62f4738daa35d16f49ade4155876bd2/0e329/You-need-deception-technology.jpg 1600w,\n/static/b62f4738daa35d16f49ade4155876bd2/eeda9/You-need-deception-technology.jpg 1650w","srcWebp":"/static/b62f4738daa35d16f49ade4155876bd2/58556/You-need-deception-technology.webp","srcSetWebp":"/static/b62f4738daa35d16f49ade4155876bd2/61e93/You-need-deception-technology.webp 200w,\n/static/b62f4738daa35d16f49ade4155876bd2/1f5c5/You-need-deception-technology.webp 400w,\n/static/b62f4738daa35d16f49ade4155876bd2/58556/You-need-deception-technology.webp 800w,\n/static/b62f4738daa35d16f49ade4155876bd2/99238/You-need-deception-technology.webp 1200w,\n/static/b62f4738daa35d16f49ade4155876bd2/7c22d/You-need-deception-technology.webp 1600w,\n/static/b62f4738daa35d16f49ade4155876bd2/36d36/You-need-deception-technology.webp 1650w","sizes":"(max-width: 800px) 100vw, 800px"}}},"medium":{"childImageSharp":{"fluid":{"base64":"data:image/jpeg;base64,/9j/2wBDABALDA4MChAODQ4SERATGCgaGBYWGDEjJR0oOjM9PDkzODdASFxOQERXRTc4UG1RV19iZ2hnPk1xeXBkeFxlZ2P/2wBDARESEhgVGC8aGi9jQjhCY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2P/wgARCAANABQDASIAAhEBAxEB/8QAGAAAAgMAAAAAAAAAAAAAAAAAAAMBAgX/xAAUAQEAAAAAAAAAAAAAAAAAAAAA/9oADAMBAAIQAxAAAAHJq5AEh//EABsQAAICAwEAAAAAAAAAAAAAAAECABMQERIh/9oACAEBAAEFAq2aV6JPquTjif/EABQRAQAAAAAAAAAAAAAAAAAAABD/2gAIAQMBAT8BP//EABQRAQAAAAAAAAAAAAAAAAAAABD/2gAIAQIBAT8BP//EABYQAAMAAAAAAAAAAAAAAAAAAAAgMf/aAAgBAQAGPwJaf//EABkQAQACAwAAAAAAAAAAAAAAAAEAIRExQf/aAAgBAQABPyHUDsVv5mcDCG7iq4zqpYI//9oADAMBAAIAAwAAABDDz//EABQRAQAAAAAAAAAAAAAAAAAAABD/2gAIAQMBAT8QP//EABQRAQAAAAAAAAAAAAAAAAAAABD/2gAIAQIBAT8QP//EAB0QAAICAgMBAAAAAAAAAAAAAAEhABExQVFx0YH/2gAIAQEAAT8QDFQA0OvZXaJJRIfkMSNAOJglsefkvrA1agsLBJT/2Q==","aspectRatio":1.5066666666666666,"src":"/static/b62f4738daa35d16f49ade4155876bd2/32fd5/You-need-deception-technology.jpg","srcSet":"/static/b62f4738daa35d16f49ade4155876bd2/06e94/You-need-deception-technology.jpg 113w,\n/static/b62f4738daa35d16f49ade4155876bd2/07ab6/You-need-deception-technology.jpg 225w,\n/static/b62f4738daa35d16f49ade4155876bd2/32fd5/You-need-deception-technology.jpg 450w,\n/static/b62f4738daa35d16f49ade4155876bd2/4a838/You-need-deception-technology.jpg 675w,\n/static/b62f4738daa35d16f49ade4155876bd2/9842e/You-need-deception-technology.jpg 900w,\n/static/b62f4738daa35d16f49ade4155876bd2/eeda9/You-need-deception-technology.jpg 1650w","srcWebp":"/static/b62f4738daa35d16f49ade4155876bd2/b8a88/You-need-deception-technology.webp","srcSetWebp":"/static/b62f4738daa35d16f49ade4155876bd2/3a3bf/You-need-deception-technology.webp 113w,\n/static/b62f4738daa35d16f49ade4155876bd2/975bf/You-need-deception-technology.webp 225w,\n/static/b62f4738daa35d16f49ade4155876bd2/b8a88/You-need-deception-technology.webp 450w,\n/static/b62f4738daa35d16f49ade4155876bd2/761da/You-need-deception-technology.webp 675w,\n/static/b62f4738daa35d16f49ade4155876bd2/210c1/You-need-deception-technology.webp 900w,\n/static/b62f4738daa35d16f49ade4155876bd2/36d36/You-need-deception-technology.webp 1650w","sizes":"(max-width: 450px) 100vw, 450px"}}}},"author":{"id":"2c2c7385-0c4f-5556-b304-3cae025c33da","name":"Kevin Fiscus"}}},{"node":{"id":"34bde990-0a83-5088-90fc-ec45aea87b8a","title":"The curious case of “How many decoys do I need?”","content":"\r\nMany an old sparring session has been witnessed on this subject here at Smokescreen. Buckle up, this is going to be a long read.
\r\n\r\n\r\n\r\nWhen someone asks “How many decoys do I need?”, what they’re really asking is how many decoys do I need to make sure that I can catch the adversary.
\r\n\r\n\r\n\r\nDeception has toed the industry line on this question. It seems natural to want comprehensive coverage. After all, you wouldn’t buy antivirus licenses for just 20% of your organisation. The technology, too, has been able to keep pace – you can literally place deception in every part of your environment. Notice I said, “you can”. Just because you can, doesn’t mean you should.
\r\n\r\n\r\n\r\nThat deception everywhere thinking might have made sense five years ago when deception technology was just hitting the market but does it hold today? To answer that, we’re going to dive into our experience of 80+ deception deployments to see if there’s a case to be made to rethink how we size, scope, and deploy deception in the enterprise.
\r\n\r\n\r\n\r\nWe’re dropping our vendor hat and will analyse this problem from the perspective of the entity we hope to thwart using deception – the attacker / adversary.
\r\n\r\n\r\n\r\nColloquially, the APT. This is either an organised crime group or a nation-state grade attacker. They are targeted in their approach. They want something valuable you have – intel, a database, a transaction processing system, a formula, intellectual property, confidential non-public information, access to your CEOs email, etc. They will deploy specialised, customised malware, infrastructure, and tooling to achieve these means. They spend time understanding you and focus heavily on avoiding detection. If they do get detected, they count on the fact that you won’t do anything about it until they are already gone.
\r\n\r\n\r\n\r\nDefinition of a decoy: Any fake machine, file, credential, account or lure placed in the network.
\r\n\r\n\r\n\r\nLet’s assume that you do not have the ability to do the following in your network:
\r\n\r\n\r\n\r\nLet’s also assume that the initial entry point and the subnet on which the entry point machine resides has no deception whatsoever. It means, you are running blind at the point of first infection.
\r\n\r\n\r\n\r\nWith these constraints, what does an effective deception deployment look like, so you can detect the adversary?
\r\n\r\n\r\n\r\nLet’s say the crown jewel here is the production customer database.
\r\n\r\n\r\n\r\nFor an adversary to be able to access the database (actually, any database), they will need:
\r\n\r\n\r\n\r\nLet’s run a couple of scenarios to see how this plays out.
\r\n\r\n\r\n\r\nDoes deception help in this scenario? The answer is no. In fact, you could cast reasonable doubt on whether any security product will be able to stop this.
\r\n\r\n\r\n\r\nIn such a scenario, the database server reconnaissance has already happened. The adversary will know exactly which set of account credentials are required to login to the server.
\r\n\r\n\r\n\r\nThis scenario throws an interesting question. Where can one find the credentials? What are the options available?
\r\n\r\n\r\n\r\nUnmanaged accounts like in #1 & #2 should be hardened, especially since we are talking about a business-critical system. #5 is also a hard sell in this scenario.
\r\n\r\n\r\n\r\nHow many decoys do you need?
\r\n\r\n\r\n\r\nSo, if you have 10 OS administrators and 10 DB administrators, you’ll need 2 fake AD accounts + 1 network decoy hosting a file share + 20 endpoint decoys.
\r\n\r\n\r\n\r\nHow do you find the hostname or IP address of a database server?
\r\n\r\n\r\n\r\nConsidering the above, the following are the four deception possibilities:
\r\n\r\n\r\n\r\nHow many decoys do you need?
\r\n\r\n\r\n\r\nA couple of Active Directory entries for databases + A network decoy hosting a file share + 2 network decoys hosting decoy databases + the deception in Scenario 2.
\r\n\r\n\r\n\r\nAll in all, at this point, you’ll add around 5 additional decoys.
\r\n\r\n\r\n\r\nHow many Network Decoys do I need?
\r\n\r\n\r\n\r\nNetwork decoys require special consideration as they are the hottest topic of debate because the process of deploying them requires VLAN trunking. The questions are:
\r\n\r\n\r\n\r\nIn our proposed strategy, it is possible for you to avoid trunking entirely. Just add a file share in the same subnet as your real file share. Place a database decoy preceding and succeeding the IP address of the actual database server.
\r\n\r\n\r\n\r\nIf we consider only the “production” version in our database server scenario, we need a total of 3 network decoys (a decoy file share and two fake database servers) to achieve a reasonable strategy that covers the most likely outcomes.
\r\n\r\n\r\n\r\nIf it makes you feel comfortable, you can double this up and it’s still only 6 network decoys.
\r\n\r\n\r\n\r\nIf you want to cover your test and UAT environments for the database server, that’s 9 network decoys.
\r\n\r\n\r\n\r\nIf you want to cover an additional scenario, that’s 18 network decoys.
\r\n\r\n\r\n\r\nThere is a cogent case to be made here that it is certainly not necessary to deploy decoys everywhere and yo’ll still achieve effectiveness. Our example scenario needed no more than 6 network decoys, a couple of fake accounts, fake computer entries in Active Directory, and endpoint deception deployed to a very targeted group.
\r\n\r\n\r\n\r\nWith a focused deployment, you will understand exactly what tactics you are attempting to cover with deception and you can sleep well knowing you have achieved that outcome. If you find yourself attempting to blanket your network with deception, it is likely you are adopting the spray and pray approach which usually has little value. You’ll be chasing sheep when you have the opportunity to catch the wolves.
\r\n","excerpt":"Decoys can be deployed everywhere in your network – current-gen deception technology makes that possible. There are however no free lunches and pervasive deception might come with a cost. So the question is, should you?\n","slug":"how-many-decoys-do-i-need","date":"2020-07-20T06:03:16.000Z","status":"publish","modified":"2020-09-11T02:19:17.000Z","wordpress_id":18421,"featured_media":{"id":"e924a8d1-d814-5487-8d67-de66a2f7b385","source_url":"https://ss-website-content-prod.s3.ap-south-1.amazonaws.com/wp-content/uploads/2020/07/How-many-decoys-do-I-need.png","alt_text":"decoys","large":{"childImageSharp":{"fluid":{"base64":"data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAABQAAAALCAYAAAB/Ca1DAAAACXBIWXMAAAsTAAALEwEAmpwYAAACy0lEQVQozz2SXUiTURjHz76k1Mxmtc3N6TY1/CzX2pyrJnPNPqAvjUbQNygVCV1FdNFFEF0WZBB0IY2KIjMLiqgEr72wD+3jShPS2YZpTS2d/TrvS/rAw/O+nPP8zv9/niMM1ZtQMmO9F13VRvSVbgxqlVm+AW1JBSK/CFFUit5Vhs5ZisbmRJjsCLNMUwFidT7CaJbVglCB6zehqXCzTNaMag96h2w229DaXWRWuYmeaaOwLoiQ/1p7CTkeN5ad9eTWbiTX68YU8mOJBMj1VCOW1fgQJZXsOdXG2w8DhPfsQwhBhk6nVld5BcnxcZ68eKkCNTYXqzb7KDt7gKLodsw7t1DQ1IAp4sdYV4PQVXmkMi/vP37iXX8/JcUuFbSYWZnL6evrY2FhgdJgg7RlxRQMUHPqII79ETa0HsBaX0eWxUGmzSF7iis4fekySjzu6qKltZVYLIbf7ycnJwenw0Hdlq2k0/Pcvv8AscJIWTDM/mMt2N21hJuj7D58jH3HT1Ls9SNWejfzLT4Of/8SCoXoktDe3l56enro7u7mZns7RouVh0+fqYcG9jYj8sxkrytHV+BAay1EZ7WjMVmlejmYax0xdWPsUSfLs7NJ/frF1NQUo6OjTMo6m0rhDTdS2biL9Pw88e8J7L4AIisXvd2pAjWWAjTKEBWoAnv/+QvW4DYuXLmqwtPyvuLxON8TCRbSaXYcOSGt5rH7RIu6Pij3H207J5+TXQKL0CpVQlVgYmJCXmpE2rCyxu3j6/Cw2jQyMsLQ0BCzMzMEmg4iLMqbs/H8TQ+Lsf3QYfn+1mJQrCtAqVLc636GpynKkfMXud5xh2QyydzcHClpdUIe9lPa7h8Y4Omr18Q6u3g3OLgEvBW7K4ewGoNi/b9KodzXvAQsxvT0NAlpdXJykrGxMYal4h8/JpbW//z5zczsrPp9QwoQq6TCQteS9X+wd+nDk8Ie7wAAAABJRU5ErkJggg==","aspectRatio":1.9047619047619047,"src":"/static/33b83b27cd195b73256e62ee8a884b72/ee604/How-many-decoys-do-I-need.png","srcSet":"/static/33b83b27cd195b73256e62ee8a884b72/69585/How-many-decoys-do-I-need.png 200w,\n/static/33b83b27cd195b73256e62ee8a884b72/497c6/How-many-decoys-do-I-need.png 400w,\n/static/33b83b27cd195b73256e62ee8a884b72/ee604/How-many-decoys-do-I-need.png 800w,\n/static/33b83b27cd195b73256e62ee8a884b72/f3583/How-many-decoys-do-I-need.png 1200w,\n/static/33b83b27cd195b73256e62ee8a884b72/5707d/How-many-decoys-do-I-need.png 1600w,\n/static/33b83b27cd195b73256e62ee8a884b72/0ef64/How-many-decoys-do-I-need.png 2400w","srcWebp":"/static/33b83b27cd195b73256e62ee8a884b72/58556/How-many-decoys-do-I-need.webp","srcSetWebp":"/static/33b83b27cd195b73256e62ee8a884b72/61e93/How-many-decoys-do-I-need.webp 200w,\n/static/33b83b27cd195b73256e62ee8a884b72/1f5c5/How-many-decoys-do-I-need.webp 400w,\n/static/33b83b27cd195b73256e62ee8a884b72/58556/How-many-decoys-do-I-need.webp 800w,\n/static/33b83b27cd195b73256e62ee8a884b72/99238/How-many-decoys-do-I-need.webp 1200w,\n/static/33b83b27cd195b73256e62ee8a884b72/7c22d/How-many-decoys-do-I-need.webp 1600w,\n/static/33b83b27cd195b73256e62ee8a884b72/f1e40/How-many-decoys-do-I-need.webp 2400w","sizes":"(max-width: 800px) 100vw, 800px"}}},"medium":{"childImageSharp":{"fluid":{"base64":"data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAABQAAAAKCAYAAAC0VX7mAAAACXBIWXMAAAsTAAALEwEAmpwYAAAChklEQVQozz2RS0gUUBSG78yokaWWOs44D2d8p6OOU76LbApxUZj4gGiVitgm0UWrRKimtZaboqcgWcFsohxdREVDbtJFFlLio2wjvlIcc3z0db1qBw73wDn/f///HBGak0+YswCR6UKk56BzHCU0+Qih9lRESgaW46fIKT+LSEgmJCldZhrRJwqIyncR7sgk8piTwwUuDjoy0BhMiH25hYjULC60XsXb58PiyEYIQZhOp952zy3m5+Z2SI0J7M9wkN5URUpdBeYKN/baMqxVp9G7pahYI0IjFcUUnWTyx08G+vrQx8Yoor2sralhOzy3uxBReiKyc8hurCGpupzMukqMp4o4YEkiwpaCiDFITHImbR13FKijs5Pm5mY8Hg82mw273Y7JbKa7p4fllRX0zjzC0xxU1TfhPFNOyblKWTdSeamexDzp9JAUYyot489akF/T0xQWFjI6Okp/fz9+vx+v10tDQwNZRSXqw0fPXkiQnhCpRmtNlOAENPEWhD5e2jWg3X57Xr5Swy3X2ih1u1U9NTXF/Pw8K1KVz+dTwPu9z1Wv9fpNRGQ0WosdnUyt7GklqdZgRrNNuD3U+9pHuKuIu0+6FSgYDDIpSdnaYuDde4TckTDZePtxUPUf9DzF5MpHxJnRmW2S0LpDGCev/GnkKyIjVzatFJ+vZn1tTYHGxsYISIVvPvgx5BWjTUzj4pUW9qLr4WN1hBBpXak07qgUXt8Al9tvcE/uZ2jkC78XFwkEAiwvLzM7O8viwgLfxsf5PjHJ8OcRNjY2FOGwnA2xJaORCpVKZd2KWJf29mJrc5OlpSVmZmbUDicmJpiWx1pdDexO/JX1qqoGh4bRScL/u9wl/QdHt8WNhvW2hQAAAABJRU5ErkJggg==","aspectRatio":1.9152542372881356,"src":"/static/33b83b27cd195b73256e62ee8a884b72/62b1f/How-many-decoys-do-I-need.png","srcSet":"/static/33b83b27cd195b73256e62ee8a884b72/e7519/How-many-decoys-do-I-need.png 113w,\n/static/33b83b27cd195b73256e62ee8a884b72/7e7e9/How-many-decoys-do-I-need.png 225w,\n/static/33b83b27cd195b73256e62ee8a884b72/62b1f/How-many-decoys-do-I-need.png 450w,\n/static/33b83b27cd195b73256e62ee8a884b72/e2e7f/How-many-decoys-do-I-need.png 675w,\n/static/33b83b27cd195b73256e62ee8a884b72/db955/How-many-decoys-do-I-need.png 900w,\n/static/33b83b27cd195b73256e62ee8a884b72/0ef64/How-many-decoys-do-I-need.png 2400w","srcWebp":"/static/33b83b27cd195b73256e62ee8a884b72/b8a88/How-many-decoys-do-I-need.webp","srcSetWebp":"/static/33b83b27cd195b73256e62ee8a884b72/3a3bf/How-many-decoys-do-I-need.webp 113w,\n/static/33b83b27cd195b73256e62ee8a884b72/975bf/How-many-decoys-do-I-need.webp 225w,\n/static/33b83b27cd195b73256e62ee8a884b72/b8a88/How-many-decoys-do-I-need.webp 450w,\n/static/33b83b27cd195b73256e62ee8a884b72/761da/How-many-decoys-do-I-need.webp 675w,\n/static/33b83b27cd195b73256e62ee8a884b72/210c1/How-many-decoys-do-I-need.webp 900w,\n/static/33b83b27cd195b73256e62ee8a884b72/f1e40/How-many-decoys-do-I-need.webp 2400w","sizes":"(max-width: 450px) 100vw, 450px"}}}},"author":{"id":"765e8417-7ed6-55b7-95a7-1d561141e760","name":"Sudarshan Pisupati"}}},{"node":{"id":"5e1c6dca-c67a-5ab3-b731-b92e52c4ded4","title":"6 Ways Deception Technology Levels Up Your SOC","content":"\nDeception technology enables security teams to evolve from simple log aggregation and static detection use-cases to a proactive, low false-positive detection model, with deep analytics to convert data to information, and finally, heavily automated response mechanisms.
\n\n\n\nIn summary, it arms security operations teams with many of the most desired capabilities of a next-gen SOC.
\n\n\n\nHere’s a low-down of how deception technology levels up your SOC:
\n\n\n\nThere were days (or were there?) where defenders could neatly divide their network into trusted and untrusted. Alas, networks are now more complex than ever and adversaries are ahead for the most part.
\n\n\n\nIt’s no surprise then that the industry has moved to assuming that the environment is hostile, and is likely in various stages of compromise already.
\n\n\n\nThis approach liberates defenders from having to try and plug every weakness (an impossible task!) to baselining and monitoring for compromise in progress.
\n\n\n\nIf security teams have a good baseline and reliable telemetry, they can find even the most sophisticated attackers dwelling within the network.
\n\n\n\nDeception technology already ‘assumes breach’. Decoys are placed on endpoints, in Active Directory, and on the network, in such a way that an attacker in progress will engage with these deceptive assets and reveal their presence.
\n\n\n\n![\"Deception](\"https://internal-wp.smokescreen.io/wp-content/uploads/2020/02/Kill-chain-decoys-1024x441.png\")
Deception is an ‘active defence’ strategy, designed to make the network hostile for attackers, and to shift the costs of remaining undetected onto them.
\n\n\n\nIn contrast, static security monitoring use-cases fall out of date quickly, and cannot keep up with changing attacker tactics, thus making it easier for attackers to evade detection and dwell within the network for months or even years.
\n\n\n\nHowever, deception does not rely on static use-cases. By targeting the human intent behind an attack, as opposed to the tools, exploits, or techniques being used, deception-based defences can remain effective no matter what the bad guys try in the future.
\n\n\n\nThis means that the modern SOC can stay agile and adaptive to new threats without having to wait to see them first. Deception can also be used by threat- hunters and incident responders to lay down traps both to find evil or dimension the spread of an on-going incident.
\n\n\n\nTraditional SOCs have ‘cried wolf’ far too often. Even with significant tuning, finding the balance between too many alerts, and missing real incidents is extremely challenging and a constant process.
\n\n\n\nA reduction in the number of false positives automatically makes the security team more productive as they can focus on real threats instead of chasing down ghosts.
\n\n\n\nDeception technology has extremely low false positives because nobody should even interact with a decoy system, credential, or file. Any interaction is worthy of investigation, and can even trigger an orchestrated response. This means that the SOC can reduce the number of alerts to only the ones that matter.
\n\n\n\nMost data analytics focuses on ‘collecting everything’ and then trying to make sense of the data. Security is not necessarily a big-data problem, it’s more of a ‘good-data’ problem.
\n\n\n\nSince deception systems only see anomalous or malicious traffic, data-analytics can be applied to better understand the threats within the network instead of hunting for a needle in a haystack (or ElasticSearch DB!).
\n\n\n\nThis also means that the SOC can move from consuming static, external threat intelligence (which is not specific, and often stale) to creating its own threat intelligence and IOCs that are more relevant to the business, and can better inform future defences.
\n\n\n\nIn order to deal with threats at wire-speed, you need orchestrated response mechanisms. However, the challenge is to find orchestration triggers that are so reliable that a human being does not have to validate them before the response is actually fired. Failing to do so can mean that response actions trigger on false positives, which can lead to disruption of legitimate business activity.
\n\n\n\nWith low false positives and built-in orchestration and integration capabilities, a deception platform can enable ‘continuous response’, reliably detecting compromised assets and users within the network, and investigating, containing or eradicating the threat automatically, without the need for human intervention.
\n\n\n\nWhile security teams have typically focused more on external adversaries, the insider with legitimate access is far harder to tackle. They often have detailed knowledge of the security mechanisms in place and can tailor their malicious intent to look completely benign.
\n\n\n\nDeception can detect insiders seeking out data on high-value target personnel, searching for systems they should not access, or copying and opening data that they are not authorised to. It also injects an element of unpredictability; deception deployments are invisible to normal users, and the placement of decoys is known only to a limited trusted circle, so the insider will either not know of the existence or the placement of the deception. This also serves as a deterrent against casual fraud or misplaced inquisitiveness by internal employees.
\n\n\n\nDeception is a crucial component of the modern SOC. The use of adversarial thinking against the attacker changes the game for defenders, letting them ‘punch above their weight’ against sophisticated adversaries.
\n\n\n\nWant to learn how Smokescreen’s deception platform fits into your SOC? Download the whitepaper.
\n","excerpt":"Learn how deception technology enables SOCs to move from simple log aggregation and static detection use-cases to a proactive, low false-positive detection model that heavily automates response mechanisms.\n","slug":"6-ways-deception-technology-levels-up-your-soc","date":"2020-02-11T12:54:00.000Z","status":"publish","modified":"2021-01-24T16:44:20.000Z","wordpress_id":18362,"featured_media":{"id":"5f8ebc04-8b45-5d4d-a533-1fac6ca83dc5","source_url":"https://ss-website-content-prod.s3.ap-south-1.amazonaws.com/wp-content/uploads/2020/01/SOC-Deception-scaled.jpeg","alt_text":"Deception SOC","large":{"childImageSharp":{"fluid":{"base64":"data:image/jpeg;base64,/9j/2wBDABALDA4MChAODQ4SERATGCgaGBYWGDEjJR0oOjM9PDkzODdASFxOQERXRTc4UG1RV19iZ2hnPk1xeXBkeFxlZ2P/2wBDARESEhgVGC8aGi9jQjhCY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2P/wgARCAANABQDASIAAhEBAxEB/8QAFgABAQEAAAAAAAAAAAAAAAAAAAMC/8QAFAEBAAAAAAAAAAAAAAAAAAAAAP/aAAwDAQACEAMQAAABgmNJj//EABgQAQEAAwAAAAAAAAAAAAAAAAARASFB/9oACAEBAAEFAsuqu6//xAAUEQEAAAAAAAAAAAAAAAAAAAAQ/9oACAEDAQE/AT//xAAUEQEAAAAAAAAAAAAAAAAAAAAQ/9oACAECAQE/AT//xAAUEAEAAAAAAAAAAAAAAAAAAAAg/9oACAEBAAY/Al//xAAZEAACAwEAAAAAAAAAAAAAAAAAQREhgQH/2gAIAQEAAT8hbSRxjaVNpP/aAAwDAQACAAMAAAAQsA//xAAUEQEAAAAAAAAAAAAAAAAAAAAQ/9oACAEDAQE/ED//xAAUEQEAAAAAAAAAAAAAAAAAAAAQ/9oACAECAQE/ED//xAAdEAEAAgICAwAAAAAAAAAAAAABACERMUFRYaHB/9oACAEBAAE/EFoPtAYuSlvKcdxA8r7is/RggbpdN6g0k578T//Z","aspectRatio":1.492537313432836,"src":"/static/f595f7c786f638b097be04b800fd5c5f/14b42/SOC-Deception-scaled.jpg","srcSet":"/static/f595f7c786f638b097be04b800fd5c5f/f836f/SOC-Deception-scaled.jpg 200w,\n/static/f595f7c786f638b097be04b800fd5c5f/2244e/SOC-Deception-scaled.jpg 400w,\n/static/f595f7c786f638b097be04b800fd5c5f/14b42/SOC-Deception-scaled.jpg 800w,\n/static/f595f7c786f638b097be04b800fd5c5f/47498/SOC-Deception-scaled.jpg 1200w,\n/static/f595f7c786f638b097be04b800fd5c5f/0e329/SOC-Deception-scaled.jpg 1600w,\n/static/f595f7c786f638b097be04b800fd5c5f/4a461/SOC-Deception-scaled.jpg 2560w","srcWebp":"/static/f595f7c786f638b097be04b800fd5c5f/58556/SOC-Deception-scaled.webp","srcSetWebp":"/static/f595f7c786f638b097be04b800fd5c5f/61e93/SOC-Deception-scaled.webp 200w,\n/static/f595f7c786f638b097be04b800fd5c5f/1f5c5/SOC-Deception-scaled.webp 400w,\n/static/f595f7c786f638b097be04b800fd5c5f/58556/SOC-Deception-scaled.webp 800w,\n/static/f595f7c786f638b097be04b800fd5c5f/99238/SOC-Deception-scaled.webp 1200w,\n/static/f595f7c786f638b097be04b800fd5c5f/7c22d/SOC-Deception-scaled.webp 1600w,\n/static/f595f7c786f638b097be04b800fd5c5f/ab8d3/SOC-Deception-scaled.webp 2560w","sizes":"(max-width: 800px) 100vw, 800px"}}},"medium":{"childImageSharp":{"fluid":{"base64":"data:image/jpeg;base64,/9j/2wBDABALDA4MChAODQ4SERATGCgaGBYWGDEjJR0oOjM9PDkzODdASFxOQERXRTc4UG1RV19iZ2hnPk1xeXBkeFxlZ2P/2wBDARESEhgVGC8aGi9jQjhCY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2P/wgARCAANABQDASIAAhEBAxEB/8QAFgABAQEAAAAAAAAAAAAAAAAAAAMC/8QAFAEBAAAAAAAAAAAAAAAAAAAAAP/aAAwDAQACEAMQAAABgmNJj//EABgQAQEAAwAAAAAAAAAAAAAAAAARASFB/9oACAEBAAEFAsuqu6//xAAUEQEAAAAAAAAAAAAAAAAAAAAQ/9oACAEDAQE/AT//xAAUEQEAAAAAAAAAAAAAAAAAAAAQ/9oACAECAQE/AT//xAAUEAEAAAAAAAAAAAAAAAAAAAAg/9oACAEBAAY/Al//xAAZEAACAwEAAAAAAAAAAAAAAAAAQREhgQH/2gAIAQEAAT8hbSRxjaVNpP/aAAwDAQACAAMAAAAQsA//xAAUEQEAAAAAAAAAAAAAAAAAAAAQ/9oACAEDAQE/ED//xAAUEQEAAAAAAAAAAAAAAAAAAAAQ/9oACAECAQE/ED//xAAdEAEAAgICAwAAAAAAAAAAAAABACERMUFRYaHB/9oACAEBAAE/EFoPtAYuSlvKcdxA8r7is/RggbpdN6g0k578T//Z","aspectRatio":1.486842105263158,"src":"/static/f595f7c786f638b097be04b800fd5c5f/32fd5/SOC-Deception-scaled.jpg","srcSet":"/static/f595f7c786f638b097be04b800fd5c5f/06e94/SOC-Deception-scaled.jpg 113w,\n/static/f595f7c786f638b097be04b800fd5c5f/07ab6/SOC-Deception-scaled.jpg 225w,\n/static/f595f7c786f638b097be04b800fd5c5f/32fd5/SOC-Deception-scaled.jpg 450w,\n/static/f595f7c786f638b097be04b800fd5c5f/4a838/SOC-Deception-scaled.jpg 675w,\n/static/f595f7c786f638b097be04b800fd5c5f/9842e/SOC-Deception-scaled.jpg 900w,\n/static/f595f7c786f638b097be04b800fd5c5f/4a461/SOC-Deception-scaled.jpg 2560w","srcWebp":"/static/f595f7c786f638b097be04b800fd5c5f/b8a88/SOC-Deception-scaled.webp","srcSetWebp":"/static/f595f7c786f638b097be04b800fd5c5f/3a3bf/SOC-Deception-scaled.webp 113w,\n/static/f595f7c786f638b097be04b800fd5c5f/975bf/SOC-Deception-scaled.webp 225w,\n/static/f595f7c786f638b097be04b800fd5c5f/b8a88/SOC-Deception-scaled.webp 450w,\n/static/f595f7c786f638b097be04b800fd5c5f/761da/SOC-Deception-scaled.webp 675w,\n/static/f595f7c786f638b097be04b800fd5c5f/210c1/SOC-Deception-scaled.webp 900w,\n/static/f595f7c786f638b097be04b800fd5c5f/ab8d3/SOC-Deception-scaled.webp 2560w","sizes":"(max-width: 450px) 100vw, 450px"}}}},"author":{"id":"34627d50-53e7-5dda-bb36-6ab2c0cf489d","name":"Amir Moin"}}},{"node":{"id":"654b0327-cc6b-54c4-813d-fa5c70d599ea","title":"Deception Technology 101","content":"\r\nDeception technology is all the rage these days. From mature security teams at large enterprises to lean teams at mid-market companies, almost everyone is beginning to see the benefits of early threat detection. While there are clear merits, there is a lot of vendor-speak out there that might make it hard for you to evaluate if deception is the right approach for your security strategy.
\r\n\r\n\r\n\r\nWith this guide, we intend to answer some questions around what the technology is, who it’s for, what it’s capable of doing (and not doing), key use cases, and advantages. We’re going to keep it simple but go fairly deep where necessary. So grab a cup of coffee (or beer depending on when you’re reading this) and strap in.
\r\n\r\n\r\n\r\nLet’s start with the basic definition. Deception technology is a simple but effective approach to building security defences that detect threats early with low false positives and minimal performance impact on the network. The technology works by creating decoys – realistic-but-fake assets (domains, databases, servers, applications, files, credentials, cookies, sessions, and more) that are deployed in your network alongside legitimate assets. For an attacker who has breached the network, there is no way to differentiate the fake from the real. The moment they interact with a decoy, a silent alarm is raised while the systems collect information on the attacker’s actions and intent.
\r\n\r\n\r\n\r\nModern-day deception technology-based cybersecurity defences borrow heavily from proven military deception principles employed by the likes of Chanakya, Sun Tzu, Napoleon, and Genghis Khan to conquer continents by use of deceit, camouflage, and subterfuge. The most famous example of military deception perhaps is Operation Fortitude which was devised by the Allied forces to mislead the German high command as to the location of the invasion eventually leading to the Normandy landings.
\r\n\r\n\r\n\r\nIn the context of cybersecurity, defenders use decoys and lures to mislead attackers into believing that they have a foothold in the network and revealing themselves. The beauty of this approach lies in its simplicity.
\r\n\r\n\r\n\r\nPicture two adversaries with comparable capabilities but differing goals facing off against each other. The odds of either of them winning are usually at a coin toss. What if one of the two had the benefit of speed, flexibility, and targeted information? It’s no contest. The speedier, more nimble of the adversaries will usually outcompete their opponent. Even so, the latter has greater strength and access to more information. Why? Because the opponent with more information falls into ‘analysis paralysis’. They have so much information that analysing all of it becomes infeasible and some information must be prioritised over the rest. This is how adversaries lacking in strength usually win an adversarial contest.
\r\n\r\n\r\n\r\nSomething very similar happens in cybersecurity. Consider for a minute how things have played out over the past couple of decades.
\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\nAttacker: Let’s play a game with some simple rules. I’ll try to access your information or other resources. If I’m successful once, I win.
\r\n
Defender: Sounds fair.
Attacker: If you prevent me from being able to reach my target at any time including otherwise rough or busy days, after-hours, on weekends and holidays… you win.
Defender: …
No wonder we’re losing. It’s a rigged game. As a defender, you need to be right 100% of the time. The attacker just has to be right once. Thankfully, deception flips the table by placing the burden of success on the attackers instead. Once you populate your network with decoys, adversaries need to carry out a flawless attack without interacting with any deceptive assets, triggering any detection controls, or prompting other defensive actions, to succeed in their attack. In other words, the attacker now needs to be right 100% of the time, while a single mistake hands the defenders a win.
\r\n\r\n\r\n\r\nDeception technology is attack-vector-agnostic. It only ever looks at the intent of the adversary to detect attacks. No legitimate user has any business accessing a decoy system, file or application. Therefore, by design, any interaction with a decoy is suspicious at a minimum and malicious at worst. Since deception-based defences do not depend on signatures or heuristics for detection, they are able to detect virtually any attack including APTs, zero-days, reconnaissance, lateral movement, malwareless attacks, social engineering, man-in-the-middle attacks, and ransomware in real-time.
\r\n\r\n\r\n\r\nYes and no. Against the vast majority of adversaries, deception is extremely effective because it leverages the fact that they do not know everything about the network they’re trying to move around. Since decoys are essentially just another asset in the network and their strength is functional and not technical, differentiating them from legitimate assets is virtually impossible.
\r\n\r\n\r\n\r\nFurther, by injecting fake records in a user’s browser history, password manager, and other common points of internal reconnaissance, the attacker can be deceived about functional uses of decoys, making them appear like they are either regularly-used assets – indicating they’re likely useful and can be used by the attacker to move laterally to what appears to be a valuable target – or an infrequently-used but valuable asset – indicating they can be used to access privileged and/or critical information.
\r\n\r\n\r\n\r\nHowever, deception can lose some of its efficacy against attackers with extensive knowledge of the various components needed for a successful attack and their functional use. A malicious member of the team responsible for a deception deployment, for instance, is a prime candidate for such activity. Even here, though, deception can be extremely effective when coupled with other tools in your security stack. Monitoring access to privileged and sensitive resources through other solutions such as PIMs and DLPs goes a long way towards covering these blind spots in a deception program. This fits right into a defence-in-depth strategy.
\r\n\r\n\r\n\r\nIt’s assumed that deception is a capability deployed only by highly mature security organizations. While this was largely true five years ago, we have identified that the large mid-market enterprise and smaller companies also find the technology extremely attractive. Deception is becoming a mainstream capability across markets. Here’s how:
\r\n\r\n\r\n\r\nForward-leaning, big-budget, large-security-team-type organisations benefit from deception as an optimisation across their threat detection, internal threat intelligence creation, and response capabilities.
\r\n\r\n\r\n\r\nLarge customers look to detect better, more advanced threats with deception and leverage the low false-positive alerts either for proactive threat-hunting, or integrated response through enforcement technologies that they have already invested in. This market segment has led the way for deception being more broadly adopted.
\r\n\r\n\r\n\r\nThe mid-market CISO is faced with a conundrum — Her security team and budget are small, but she still has a significant threat and risk perception (perhaps she’s in an industry without compliance regulations driving investment).
\r\n\r\n\r\n\r\nShe’s got some basic security hygiene in place but needs to do something to detect more serious threats. Her wish list from a solution is:
\r\n\r\n\r\n\r\nDeception perfectly checks all the boxes above for her, letting her quickly start punching above her weight when it comes to more advanced, targeted threats.
\r\n\r\n\r\n\r\nWhen we launched IllusionBLACK in 2015, our CEO Sahir Hidayatullah, wrote a manifesto outlining the key advantages of deception technology. 5 years and 4 generations of deception platform later, those advantages still hold.
\r\n\r\n\r\n\r\nIn anti-submarine warfare, the sighting of a periscope breaking the water is an unambiguous indicator of an imminent threat. We believe deception alerts are very similar, and term them ‘periscope events’ — a behavior that, when detected, clearly indicates that an attacker is in the network.
\r\n\r\n\r\n\r\nIf you place detection classes on a scale of accuracy, at one extreme you have:
\r\n\r\n\r\n\r\nDeception’s periscope events are the middle ground — highly accurate, but with broad threat coverage (we can broadly detect any type of submarine with extremely low false positives).
\r\n\r\n\r\n\r\n![\"\"](\"https://internal-wp.smokescreen.io/wp-content/uploads/2020/02/Screenshot-2020-01-23-at-8.50.57-PM-1024x457-1.png\")
Most security controls are not aware of current business risks (your antivirus does not know or care that you’re going through an M&A). However, deception is intrinsically aligned with the current business threat perception. For example, if a company is launching a new product, it can create deception around that product launch, aligning security controls tightly to areas where the organisation perceives risk.
\r\n\r\n\r\n\r\nSince deception is a detection class, it can be applied broadly horizontally across the enterprise, including environments that are often neglected blindspots. For example, deception can detect threats at the perimeter, the endpoint, the network, Active Directory, and application layers, as well as offer coverage to more neglected environments such as SCADA/ICS, IoT, and cloud.
\r\n\r\n\r\n\r\nUnlike point solutions, deception also covers the entire kill-chain; from pre-attack reconnaissance to exploitation, privilege escalation, lateral movement, and data-theft / destruction.
\r\n\r\n\r\n\r\nFalse positives cripple security team productivity and drag both IT and security teams through convoluted triage workflows. Often, the process of trying to validate the alert is more time consuming than the actual remediation measure.
\r\n\r\n\r\n\r\nDeception has an intrinsic low false-positive property — nobody should open a decoy file, log in to a decoy application, use a decoy credential, or scan a decoy server. However, the alerts are also far more contextual; giving insight into the attacker’s intent (“they went for the R&D information, not the financial systems”).
\r\n\r\n\r\n\r\nMost behavior-based systems try to establish a normal baseline and then classify any activity above the baseline as anomalous, this leads to a number of false positives. Deception establishes a zero-activity normal baseline, where any activity at all is worthy of investigation.
\r\n\r\n\r\n\r\nIt also gives detailed IOCs (indicators of compromise). Everything that happens on a decoy is considered evil; so analysts don’t need to weed through the data to segregate legitimate user activity and forensically relevant artifacts. Not only can you detect more reliably, but you can ‘know your enemy’ far better.
\r\n\r\n\r\n\r\nYou can also use deception to qualify medium or ‘warm’ alerts from other platforms. For example, a UEBA system may generate a medium risk score for a user’s behavior, leaving the analyst in no man’s land — “is this a threat, or a false positive?” Dynamic deployment of deception on and around that user’s environment may result in a higher-order detection if the attack is real.
\r\n\r\n\r\n\r\nRing-fencing potential problem areas in this manner is also exceptionally useful during incident response in environments where the available logging is limited, but a rapid increase in visibility is required. If the DMZ may be compromised, lay down deception and watch for privilege escalation or lateral movement detection while the root cause of the compromise is being investigated. This can help answer two of the most fundamental questions in incident response, “how far in did they get, and are they still in?”.
\r\n\r\n\r\n\r\nOrchestrated / automated response is most useful only when the trigger event is 100% certain. While plenty of orchestration tooling is being built (like shovels during the gold rush), not many real-world transformational orchestration use cases exist because there are very few alerts that are 100% certain. The ones that are, typically don’t require orchestration, because the products that generate them already contain remedial capabilities (for example, an antivirus detection quarantining a file).
\r\n\r\n\r\n\r\nDeception alerts are highly certain, contextual, and real-time, affording opportunities for security teams to orchestrate more complex and invasive scenarios (for example, use of a decoy credential can result in automatic redirection of the compromised asset into a decoy environment, while disabling the logged-on user’s account and access in the real environment).
\r\n\r\n\r\n\r\nIn terms of containment / response use cases, deception alerts can integrate with:
\r\n\r\n\r\n\r\nSince deception alerts are contextual, the response can also target the appropriate application. For example, if an attacker targets a decoy SWIFT server in a banking environment, the user’s account can be disabled for the real SWIFT server.
\r\n\r\n\r\n\r\nDeception is being used to detect threats across the kill-chain starting with reconnaissance going all the way up to data theft. Broadly, we see three key use cases.
\r\n\r\n\r\n\r\n![\"\"](\"https://internal-wp.smokescreen.io/wp-content/uploads/2020/02/Decoys-for-the-entire-kill-chain-1-1024x377.png\")
At a time when it’s possible to scan all IPv4 IPs in under an hour, monitoring all inbound connections – even just the unusual ones – becomes like drinking from the proverbial fire hose. With VMs available in the cloud within minutes, the noise comes not just from suspicious visitors to a page or from adversaries targeting the organisation, but from almost anyone that can create a cloud account and run a script or two.
\r\n\r\n\r\n\r\nSecurity isn’t a big data problem so much as a good data problem.
\r\n\r\n\r\n\r\nSetting up deceptive public-facing assets, if done right, can drastically simplify this problem and give you actionable telemetry on who’s targeting you. This is different from simply setting up a traditional honeypot with a number of open ports on a public IP. Such a setup is going to generate noisy alerts as everything from Google and Shodan to scripts for college research projects trying to connect to these honeypots. Instead, deploying decoys that mimic beta/staging applications can create high-confidence alerts telling you that an attacker is attempting to reach specific public-facing (but unannounced) infrastructure. Irrespective of their reason and methodology for doing so – including scripts set up to search for such infrastructure belonging to specific organisations, the alerts produced become a high-confidence indicator of intent to locate sensitive infrastructure belonging to your organisation.
\r\n\r\n\r\n\r\nThese alerts become useful pivot points to check for other activity in the valuable but voluminous logs from the WAF (Web Application Firewall) and other sources. For example, other interactions by the source attempting to access public-facing decoys can be looked into and the source optionally blocked. If successful login attempts are discovered, resetting the user’s credentials and enabling 2FA (Two Factor Authentication) for the account are common first steps for a containment… You get the idea.
\r\n\r\n\r\n\r\nBarring insider threats, once attackers gain a foothold in an organisation, they’re like a new employee on day one except for the onboarding – they have a very broad sense of the objective they need to achieve, but no information on the relative location of the things they need or how to get there.
\r\n\r\n\r\n\r\nA strategically deployed set of decoy internal servers and workstations play well here, being available as targets to the attacker. However, simply deploying decoys leaves the odds of them being targeted at not much better than random chance. Effective network deception requires the decoys to be placed in the various locations an attacker might peruse to identify targets; better still if they can be made to look not just like valuable assets on the network, but systems that the appropriate legitimate users interact with to perform their tasks.
\r\n\r\n\r\n\r\nRegular users know the hostnames or network locations of the databases they need to administer, the document servers they need to pull files from, the hosts they must remote into. Even forgetful users that connect to a couple of incorrect hosts in the course of looking for the one they want are unlikely to continue once they can see that they have connected to a different host than the one they intended to connect to.
\r\n\r\n\r\n\r\nAn attacker, on the other hand, often has something of value to glean from connecting to a different system than the one they seek to target. This results in different behavior from a regular user, making attacker interactions with decoys easy to differentiate from a user that mistyped an IP. As with other types of deception, such alerts then make for great points to begin investigations from.
\r\n\r\n\r\n\r\nConsider your usage of the file system on your machine. More often than not, you probably know which file you want and where it’s located. For folks that deal with a large number of local files, you may search through the file system using some keywords you know to be associated with or present in the file you’re looking for.
\r\n\r\n\r\n\r\nHowever, if a decoy file is placed on your system, it’s unlikely to affect any tasks you need to perform, particularly if you know it’s a decoy. To an attacker, though, a file that appears to have legitimate and valuable content, and looks like it is accessed by the user, is a candidate for exfiltration.
\r\n\r\n\r\n\r\nCoupled with fake processes, and breadcrumbs pointing to decoy workstations/servers posing as legitimate systems accessed by the user, endpoint deception can be put to use to detect not just behavior that would be suspicious on the network, but also behavior that would be the norm on the network but has no legitimate place on a particular endpoint at a particular time.
\r\n\r\n\r\n\r\nEven a malicious insider who might be familiar with weaknesses in existing defences doesn’t have extensive knowledge of every valuable file on other endpoints. Additionally, since the goal of many attacks is data theft, theft of decoy files becomes a particularly high priority signal because it indicates an attacker may be close to accomplishing their goal – after all, an attacker stealing decoy files is likely to also be stealing real ones.
\r\n\r\n\r\n\r\nDeception technology is a “force multiplier” for a number of existing capabilities that organisations may already have implemented. Here are some examples:
\r\n\r\n\r\n\r\nEndpoint detection can be significantly improved with deception. An attacker using decoy credentials stored in memory, following a decoy SSH or RDP session, or trying to escalate privileges by exploiting a decoy running process provides extremely reliable indicators of malicious host-based activity. The EDR can ‘fill in the blanks’ into what happened before (which processes ran, what other network connections were created etc.)
\r\n\r\n\r\n\r\nUser Entity and Behavior Analytics (UEBA) systems are prone to false positives and data paralysis, especially in larger, geographically disparate networks where analysts may not have the context to validate an alert (Eric in the Paris security team doesn’t know why Nakamura san is uploading a lot of data in Tokyo).
\r\n\r\n\r\n\r\nHowever, the UEBA system can provide excellent enrichment to a deception alert, fleshing out the user backstory. For example, if a decoy file is copied and the user is suddenly logging in outside of office hours concurrently from two places, the detection is very likely to be real.
\r\n\r\n\r\n\r\nSandboxing was deception 1.0, focused on convincing malware to detonate and reveal its cards. Modern deception is sandboxing for the human attacker. By providing a wider virtual ‘attack surface’, and a believable environment for them to progress their attack, higher-order forensics can be developed.
\r\n\r\n\r\n\r\nMany threat intelligence services offer dumps of malware hashes, domains or IPs that rapidly go stale or are devoid of context (“block these 5000 IPs because they’re from China”). The commercial ramp-up to more specific threat intelligence is significant, and often only consumable by extremely mature security organisations.
\r\n\r\n\r\n\r\nWhile deception is typically seen as a behind-the-firewall capability, it is possible to deploy Internet-facing decoys that only engage with targeted threats against a named organization. These ‘private threat intelligence’ decoys give predictive analytics of attacker activity early on in the reconnaissance phase of the kill chain.
\r\n\r\n\r\n\r\nFor example, decoy Amazon S3 buckets incorporating the company’s name can identify attempted reconnaissance, while decoy UAT, staging and testbed subdomains can identify attackers looking for a weak way in. Decoy login portals / webmail systems / VPNs can also reliably uncover spear-phished credentials (attackers need somewhere to use them). More business-specific use cases include decoy credit cards with a specific bank BIN or fake insurance policyholder information that may be targeted at renewal time.
\r\n\r\n\r\n\r\nThe use of deception lets less mature companies create rather than consume threat intelligence that is specifically relevant to their vertical or geography. More advanced security teams can leverage advanced counterintelligence deception use cases, such as decoy social media accounts to attract spear-phishing.
\r\n\r\n\r\n\r\nNetwork threat detection is a critical piece of the puzzle, especially since attackers cannot avoid using the network to move around. However, network threat analytics tools suffer from scalability challenges in deployment and are increasingly blind as more traffic is encrypted, even east-west in the network.
\r\n\r\n\r\n\r\nNetwork deception is the ‘original honeypot’, and it still works exceptionally well at detecting everything from worm-like activity such as network-driven ransomware to targeted attackers in large networks.
\r\n\r\n\r\n\r\nThrough improvements in virtualization and software-defined networking, we can place network decoys at scale in every subnet and VLAN, as well as in the dark IP space of the network to efficiently detect network-driven threats. Moreover, since the network decoy itself is instrumented, it is not blind to encrypted traffic and can provide full packet forensics about the threat.
\r\n\r\n\r\n\r\nDeception and threat hunting are two pillars of ‘active defence’ — proactively attempting to take the fight to the adversary. We find that the champions for deception technology at many of our customers are the threat hunting teams, as they are able to think like the attacker and deploy deception in paths where they perceive they will have to traverse.
\r\n\r\n\r\n\r\nA deception alert is a perfect trigger to a hunt mission and can let an analyst ring-fence a potential incident with decoys while they pivot on available data to understand the root cause of the threat. The real-world analogy of a hunter laying traps is extremely applicable here.
\r\n\r\n\r\n\r\nIn fact, we’re so bullish about this use case that we’ve put our money where our mouth is by launching Shadowhunt, a human-driven managed threat hunting service powered by the IllusionBLACK platform.
\r\n\r\n\r\n\r\nWow, that was a lot of reading you got done. Phew! If you’ve come this far, I’d like to leave you with some closing thoughts. Whether you’re a CISO trying to move the needle on the detect, know, and respond metrics, or someone on the security team struggling to reign in all those false positives, deception technology can improve the quality of your life by an order of magnitude.
\r\n\r\n\r\n\r\nDeception technology can help you cut down your:
\r\n\r\n\r\n\r\nWell, that’s it from us. If you have any questions about deception technology or want to get an expert opinion, feel free to hit us up. We’d love to hear what you’re currently dealing with and help you out.
\r\n","excerpt":"Deception technology is now fairly mainstream but still shrouded in vendor speak. Read this detailed guide to understand what the technology is, who it’s for, what it’s capable of doing, how it fits in your security stack, key use cases, and advantages.\n","slug":"deception-technology-101","date":"2020-02-08T08:14:05.000Z","status":"publish","modified":"2020-09-11T02:19:32.000Z","wordpress_id":18371,"featured_media":{"id":"ba95f456-c987-5f37-80ae-b1130f538e5e","source_url":"https://ss-website-content-prod.s3.ap-south-1.amazonaws.com/wp-content/uploads/2020/02/Screenshot-2020-01-27-at-1.09.56-PM-1.png","alt_text":"","large":{"childImageSharp":{"fluid":{"base64":"data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAABQAAAALCAIAAADwazoUAAAACXBIWXMAAAsTAAALEwEAmpwYAAACfklEQVQozyWS21NSURTGz0z1kkg2PRQXr1ND3MQ7YDOomKSiAUqYHEHliFy8HdADhnI5R1SQg3ITAZtRTHBSrKmmpofqofrDWk4ze/asWXt/a/3WtzfCra3jcGurGNUMBrPm/oOW1rb6hsa6+gZ597Od3Qgd3z9IpLbC2za7w71KzFowC2Z1Liw6nAviZgnC5nAZ1UzmvZqmx08gbmhs6pLKcJd7Y9O/ukb8+Pnr95+/lesP2zu70UgIX7brxsbtDue8zT5lMiN3qxi3bt95PqAaVo9At+UVHDSTRhR6RvdiheO3pXK5cv1xZWlOpxtdWrQW8hmSugEJkRTS2SXF5qx7MXo3Es1mj0rli1y+AJqTkyJkgiFy/Y0PyNPJqMOO8QXimWkDQbgIj9flXkNidBwuwXiwYL6DRPL95dXZu/NUOhPe3gElSVEkFV7FsUjYg1lQrWbIMT+55rYRBI4EgiHgtM7boP+sxQIwyVT6vHQBu3rkpaKn14iiQ8NqhULu8XjyuXQ6Se/Ho2SAcOGLCEltQXlo6w8EYVTwCfSZwywggHMPH7HGxvUaLdhk8G34wWeXm/Cu+yBQ9g8gcPX/wNRWOF84TmcOT06L56Vy9igXo2mPd90w8Voqk0taWnlP+WwOh8W+WRDDGyPAHInuHeXywHlVuf70+cvlVeW0eAZJqPL123c4Al/gFLiEIrFGNwYsMlm3RqdD1COjKIpasLlNfwAK4bjLbJ42olMABnYkkqnpmdnBwSGajgeCQYhfGSamTCb4JCBBBEKhQCCEBxtWq/V6vVLZ39HR2dbeLpXKlEqlRqNVKHpYLFazRKJSvejt64M8j8fj8wUikfgfdAEJrG9VLqsAAAAASUVORK5CYII=","aspectRatio":1.7699115044247788,"src":"/static/cc761f7c9fa6734e37318904a20cb79f/ee604/Screenshot-2020-01-27-at-1.09.56-PM-1.png","srcSet":"/static/cc761f7c9fa6734e37318904a20cb79f/69585/Screenshot-2020-01-27-at-1.09.56-PM-1.png 200w,\n/static/cc761f7c9fa6734e37318904a20cb79f/497c6/Screenshot-2020-01-27-at-1.09.56-PM-1.png 400w,\n/static/cc761f7c9fa6734e37318904a20cb79f/ee604/Screenshot-2020-01-27-at-1.09.56-PM-1.png 800w,\n/static/cc761f7c9fa6734e37318904a20cb79f/f3583/Screenshot-2020-01-27-at-1.09.56-PM-1.png 1200w,\n/static/cc761f7c9fa6734e37318904a20cb79f/5707d/Screenshot-2020-01-27-at-1.09.56-PM-1.png 1600w,\n/static/cc761f7c9fa6734e37318904a20cb79f/b3888/Screenshot-2020-01-27-at-1.09.56-PM-1.png 2878w","srcWebp":"/static/cc761f7c9fa6734e37318904a20cb79f/58556/Screenshot-2020-01-27-at-1.09.56-PM-1.webp","srcSetWebp":"/static/cc761f7c9fa6734e37318904a20cb79f/61e93/Screenshot-2020-01-27-at-1.09.56-PM-1.webp 200w,\n/static/cc761f7c9fa6734e37318904a20cb79f/1f5c5/Screenshot-2020-01-27-at-1.09.56-PM-1.webp 400w,\n/static/cc761f7c9fa6734e37318904a20cb79f/58556/Screenshot-2020-01-27-at-1.09.56-PM-1.webp 800w,\n/static/cc761f7c9fa6734e37318904a20cb79f/99238/Screenshot-2020-01-27-at-1.09.56-PM-1.webp 1200w,\n/static/cc761f7c9fa6734e37318904a20cb79f/7c22d/Screenshot-2020-01-27-at-1.09.56-PM-1.webp 1600w,\n/static/cc761f7c9fa6734e37318904a20cb79f/650fc/Screenshot-2020-01-27-at-1.09.56-PM-1.webp 2878w","sizes":"(max-width: 800px) 100vw, 800px"}}},"medium":{"childImageSharp":{"fluid":{"base64":"data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAABQAAAALCAIAAADwazoUAAAACXBIWXMAAAsTAAALEwEAmpwYAAACfklEQVQozyWS21NSURTGz0z1kkg2PRQXr1ND3MQ7YDOomKSiAUqYHEHliFy8HdADhnI5R1SQg3ITAZtRTHBSrKmmpofqofrDWk4ze/asWXt/a/3WtzfCra3jcGurGNUMBrPm/oOW1rb6hsa6+gZ597Od3Qgd3z9IpLbC2za7w71KzFowC2Z1Liw6nAviZgnC5nAZ1UzmvZqmx08gbmhs6pLKcJd7Y9O/ukb8+Pnr95+/lesP2zu70UgIX7brxsbtDue8zT5lMiN3qxi3bt95PqAaVo9At+UVHDSTRhR6RvdiheO3pXK5cv1xZWlOpxtdWrQW8hmSugEJkRTS2SXF5qx7MXo3Es1mj0rli1y+AJqTkyJkgiFy/Y0PyNPJqMOO8QXimWkDQbgIj9flXkNidBwuwXiwYL6DRPL95dXZu/NUOhPe3gElSVEkFV7FsUjYg1lQrWbIMT+55rYRBI4EgiHgtM7boP+sxQIwyVT6vHQBu3rkpaKn14iiQ8NqhULu8XjyuXQ6Se/Ho2SAcOGLCEltQXlo6w8EYVTwCfSZwywggHMPH7HGxvUaLdhk8G34wWeXm/Cu+yBQ9g8gcPX/wNRWOF84TmcOT06L56Vy9igXo2mPd90w8Voqk0taWnlP+WwOh8W+WRDDGyPAHInuHeXywHlVuf70+cvlVeW0eAZJqPL123c4Al/gFLiEIrFGNwYsMlm3RqdD1COjKIpasLlNfwAK4bjLbJ42olMABnYkkqnpmdnBwSGajgeCQYhfGSamTCb4JCBBBEKhQCCEBxtWq/V6vVLZ39HR2dbeLpXKlEqlRqNVKHpYLFazRKJSvejt64M8j8fj8wUikfgfdAEJrG9VLqsAAAAASUVORK5CYII=","aspectRatio":1.765625,"src":"/static/cc761f7c9fa6734e37318904a20cb79f/62b1f/Screenshot-2020-01-27-at-1.09.56-PM-1.png","srcSet":"/static/cc761f7c9fa6734e37318904a20cb79f/e7519/Screenshot-2020-01-27-at-1.09.56-PM-1.png 113w,\n/static/cc761f7c9fa6734e37318904a20cb79f/7e7e9/Screenshot-2020-01-27-at-1.09.56-PM-1.png 225w,\n/static/cc761f7c9fa6734e37318904a20cb79f/62b1f/Screenshot-2020-01-27-at-1.09.56-PM-1.png 450w,\n/static/cc761f7c9fa6734e37318904a20cb79f/e2e7f/Screenshot-2020-01-27-at-1.09.56-PM-1.png 675w,\n/static/cc761f7c9fa6734e37318904a20cb79f/db955/Screenshot-2020-01-27-at-1.09.56-PM-1.png 900w,\n/static/cc761f7c9fa6734e37318904a20cb79f/b3888/Screenshot-2020-01-27-at-1.09.56-PM-1.png 2878w","srcWebp":"/static/cc761f7c9fa6734e37318904a20cb79f/b8a88/Screenshot-2020-01-27-at-1.09.56-PM-1.webp","srcSetWebp":"/static/cc761f7c9fa6734e37318904a20cb79f/3a3bf/Screenshot-2020-01-27-at-1.09.56-PM-1.webp 113w,\n/static/cc761f7c9fa6734e37318904a20cb79f/975bf/Screenshot-2020-01-27-at-1.09.56-PM-1.webp 225w,\n/static/cc761f7c9fa6734e37318904a20cb79f/b8a88/Screenshot-2020-01-27-at-1.09.56-PM-1.webp 450w,\n/static/cc761f7c9fa6734e37318904a20cb79f/761da/Screenshot-2020-01-27-at-1.09.56-PM-1.webp 675w,\n/static/cc761f7c9fa6734e37318904a20cb79f/210c1/Screenshot-2020-01-27-at-1.09.56-PM-1.webp 900w,\n/static/cc761f7c9fa6734e37318904a20cb79f/650fc/Screenshot-2020-01-27-at-1.09.56-PM-1.webp 2878w","sizes":"(max-width: 450px) 100vw, 450px"}}}},"author":{"id":"72c88789-f3cb-50a8-9db3-a549434a7d3b","name":"Kush Mehra"}}},{"node":{"id":"13ba7811-8420-5fbe-afba-edab7cde09f4","title":"Open Source Honeypots That Detect Threats For Free","content":"If you’re a target for either financially motivated cyber criminals, or nation state grade attackers, chances are your security team feels outgunned. Deception technology excels at detecting these attacks by shifting the cognitive, economic and time costs of the attack back onto the attacker. The principles of deception have been around for years, and recently, they’ve become the secret weapon of purple teams and threat hunters worldwide. Here’s the good new — You can start seeing the benefits of deception for free using open source honeypots that can be deployed immediately.
\nDeception is so crucial to detecting lateral movement, uncovering privilege escalation, and building threat intelligence, that any deception, even open-source honeypots are valuable. Whenever we’re on the road, we make it a point to give a shout-out to some of these tools, and will happily help you plan how you can use them. And we’ll do this for free, no strings attached. Just get in touch!
\nCaveat Emptor: You get what you pay for — Some of these tools may no longer be supported, and will require leg-work to setup and see results. However, they’re a great way to get familiar with deception. They’re also emulations, not real systems, so don’t expect high-interaction activity. While we’ll offer friendly advice around how you can use them, we don’t officially support them.
\nFor more on planning effective deception, check out our strategy focused blog-posts:
\nSetting up most of these open source honeypots in a lab should be a fairly simple weekend project for seasoned security professionals. You can then run red-team style attacks against them to understand what sort of telemetry you can expect. Finally, you can tweak the source to reduce how easily they can be fingerprinted (don’t forget to submit patches to the authors if you do).
\nIf you’d like to take the next step with professional deception technology, check out our IllusionBLACK platform by seeing a live demo.
\n","excerpt":"If you’re a target for either financially motivated cyber-criminals, or nation-state grade attackers, chances are your security team feels outgunned. Deception technology excels at detecting these attacks by shifting the cognitive, economic and time costs of the attack back onto the attacker.\n","slug":"practical-honeypots-a-list-of-open-source-deception-tools-that-detect-threats-for-free","date":"2017-09-20T12:18:42.000Z","status":"publish","modified":"2020-09-14T06:17:12.000Z","wordpress_id":16927,"featured_media":{"id":"fe9a8c35-b0a3-525e-b272-29dd6f0cbf3b","source_url":"https://ss-website-content-prod.s3.ap-south-1.amazonaws.com/wp-content/uploads/2017/09/Open-source-honeypots-Smokescreen.jpeg","alt_text":"Open source honeypots","large":{"childImageSharp":{"fluid":{"base64":"data:image/jpeg;base64,/9j/2wBDABALDA4MChAODQ4SERATGCgaGBYWGDEjJR0oOjM9PDkzODdASFxOQERXRTc4UG1RV19iZ2hnPk1xeXBkeFxlZ2P/2wBDARESEhgVGC8aGi9jQjhCY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2P/wgARCAANABQDASIAAhEBAxEB/8QAFwAAAwEAAAAAAAAAAAAAAAAAAAIDBf/EABQBAQAAAAAAAAAAAAAAAAAAAAD/2gAMAwEAAhADEAAAAdyTzAUP/8QAFhABAQEAAAAAAAAAAAAAAAAAEAEC/9oACAEBAAEFAq6f/8QAFBEBAAAAAAAAAAAAAAAAAAAAEP/aAAgBAwEBPwE//8QAFBEBAAAAAAAAAAAAAAAAAAAAEP/aAAgBAgEBPwE//8QAFBABAAAAAAAAAAAAAAAAAAAAIP/aAAgBAQAGPwJf/8QAGBAAAwEBAAAAAAAAAAAAAAAAAAERECH/2gAIAQEAAT8haFudDef/2gAMAwEAAgADAAAAEEPP/8QAFBEBAAAAAAAAAAAAAAAAAAAAEP/aAAgBAwEBPxA//8QAFBEBAAAAAAAAAAAAAAAAAAAAEP/aAAgBAgEBPxA//8QAGhAAAwADAQAAAAAAAAAAAAAAAAERECFBMf/aAAgBAQABPxCSvwlLzgno0R4Ez//Z","aspectRatio":1.5037593984962405,"src":"/static/03cd33bfc3eac071715696dc4b64baf3/14b42/Open-source-honeypots-Smokescreen.jpg","srcSet":"/static/03cd33bfc3eac071715696dc4b64baf3/f836f/Open-source-honeypots-Smokescreen.jpg 200w,\n/static/03cd33bfc3eac071715696dc4b64baf3/2244e/Open-source-honeypots-Smokescreen.jpg 400w,\n/static/03cd33bfc3eac071715696dc4b64baf3/14b42/Open-source-honeypots-Smokescreen.jpg 800w,\n/static/03cd33bfc3eac071715696dc4b64baf3/47498/Open-source-honeypots-Smokescreen.jpg 1200w,\n/static/03cd33bfc3eac071715696dc4b64baf3/0e329/Open-source-honeypots-Smokescreen.jpg 1600w,\n/static/03cd33bfc3eac071715696dc4b64baf3/eeda9/Open-source-honeypots-Smokescreen.jpg 1650w","srcWebp":"/static/03cd33bfc3eac071715696dc4b64baf3/58556/Open-source-honeypots-Smokescreen.webp","srcSetWebp":"/static/03cd33bfc3eac071715696dc4b64baf3/61e93/Open-source-honeypots-Smokescreen.webp 200w,\n/static/03cd33bfc3eac071715696dc4b64baf3/1f5c5/Open-source-honeypots-Smokescreen.webp 400w,\n/static/03cd33bfc3eac071715696dc4b64baf3/58556/Open-source-honeypots-Smokescreen.webp 800w,\n/static/03cd33bfc3eac071715696dc4b64baf3/99238/Open-source-honeypots-Smokescreen.webp 1200w,\n/static/03cd33bfc3eac071715696dc4b64baf3/7c22d/Open-source-honeypots-Smokescreen.webp 1600w,\n/static/03cd33bfc3eac071715696dc4b64baf3/36d36/Open-source-honeypots-Smokescreen.webp 1650w","sizes":"(max-width: 800px) 100vw, 800px"}}},"medium":{"childImageSharp":{"fluid":{"base64":"data:image/jpeg;base64,/9j/2wBDABALDA4MChAODQ4SERATGCgaGBYWGDEjJR0oOjM9PDkzODdASFxOQERXRTc4UG1RV19iZ2hnPk1xeXBkeFxlZ2P/2wBDARESEhgVGC8aGi9jQjhCY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2P/wgARCAANABQDASIAAhEBAxEB/8QAFwAAAwEAAAAAAAAAAAAAAAAAAAIDBf/EABQBAQAAAAAAAAAAAAAAAAAAAAD/2gAMAwEAAhADEAAAAdyTzAUP/8QAFhABAQEAAAAAAAAAAAAAAAAAEAEC/9oACAEBAAEFAq6f/8QAFBEBAAAAAAAAAAAAAAAAAAAAEP/aAAgBAwEBPwE//8QAFBEBAAAAAAAAAAAAAAAAAAAAEP/aAAgBAgEBPwE//8QAFBABAAAAAAAAAAAAAAAAAAAAIP/aAAgBAQAGPwJf/8QAGBAAAwEBAAAAAAAAAAAAAAAAAAERECH/2gAIAQEAAT8haFudDef/2gAMAwEAAgADAAAAEEPP/8QAFBEBAAAAAAAAAAAAAAAAAAAAEP/aAAgBAwEBPxA//8QAFBEBAAAAAAAAAAAAAAAAAAAAEP/aAAgBAgEBPxA//8QAGhAAAwADAQAAAAAAAAAAAAAAAAERECFBMf/aAAgBAQABPxCSvwlLzgno0R4Ez//Z","aspectRatio":1.5066666666666666,"src":"/static/03cd33bfc3eac071715696dc4b64baf3/32fd5/Open-source-honeypots-Smokescreen.jpg","srcSet":"/static/03cd33bfc3eac071715696dc4b64baf3/06e94/Open-source-honeypots-Smokescreen.jpg 113w,\n/static/03cd33bfc3eac071715696dc4b64baf3/07ab6/Open-source-honeypots-Smokescreen.jpg 225w,\n/static/03cd33bfc3eac071715696dc4b64baf3/32fd5/Open-source-honeypots-Smokescreen.jpg 450w,\n/static/03cd33bfc3eac071715696dc4b64baf3/4a838/Open-source-honeypots-Smokescreen.jpg 675w,\n/static/03cd33bfc3eac071715696dc4b64baf3/9842e/Open-source-honeypots-Smokescreen.jpg 900w,\n/static/03cd33bfc3eac071715696dc4b64baf3/eeda9/Open-source-honeypots-Smokescreen.jpg 1650w","srcWebp":"/static/03cd33bfc3eac071715696dc4b64baf3/b8a88/Open-source-honeypots-Smokescreen.webp","srcSetWebp":"/static/03cd33bfc3eac071715696dc4b64baf3/3a3bf/Open-source-honeypots-Smokescreen.webp 113w,\n/static/03cd33bfc3eac071715696dc4b64baf3/975bf/Open-source-honeypots-Smokescreen.webp 225w,\n/static/03cd33bfc3eac071715696dc4b64baf3/b8a88/Open-source-honeypots-Smokescreen.webp 450w,\n/static/03cd33bfc3eac071715696dc4b64baf3/761da/Open-source-honeypots-Smokescreen.webp 675w,\n/static/03cd33bfc3eac071715696dc4b64baf3/210c1/Open-source-honeypots-Smokescreen.webp 900w,\n/static/03cd33bfc3eac071715696dc4b64baf3/36d36/Open-source-honeypots-Smokescreen.webp 1650w","sizes":"(max-width: 450px) 100vw, 450px"}}}},"author":{"id":"9257cd1e-ca7f-578b-a2dd-9c2e74282caf","name":"Smokescreen Team"}}},{"node":{"id":"ea4f620c-95dd-5361-8f79-ff8b1fa8ff02","title":"7 Ways to Fail At Implementing Deception Technology","content":"Distributed Deception Platforms are a hot topic today. Most CISOs are thinking of implementing deception technology or road-mapping it into their evaluations and budgets. The promises sound great:
\nUnfortunately, due to the unique secretive nature of deception (after all, you may not want people to know about it), there’s precious little information on how a security team can implement deception tecnology successfully and make it useful.
\nIf you’re being pushed to power-up a sleek appliance and kiss your cybersecurity woes goodbye, don’t believe the marketing hype — that’s not going to happen.
\nAfter implementing deception technology campaigns for the better part of a decade, we’ve compiled a list of the 7 deadly sins that will guarantee that your deception investment will disappoint you. Here we go:
\nIt’s quite obvious that for a deception technology deployment to be successful, you need an objective and a strategy. At a minimum, make sure you know what assets you’re trying to protect (they’re not all equal to the hacker). The best deception campaigns are extremely goal-oriented (e.g.: “Catch targeted attacks against my SWIFT servers, especially focused on breaches from third-party networks.”).
\nThe Fix: Make a list of your top 3 nightmare scenarios, and identify the assets (endpoints / servers / people / credentials / network zones) that are a part of those nightmares.
\nThere’s a reason some of the best deception specialists moonlight as threat hunters or red-teamers. Deception is an ‘active defence‘ capability — where deep knowledge of the attacker’s modus operandi is crucial. Knowing the critical paths an attacker will follow will massively boost the effectiveness of your deception capabilities.
\nThe Fix: Have your in-house / external red-team build attack trees to the assets you’ve identified at risk. Train your blue-team on how to think adversarially.
\nOne of the best things about deception technology is that the alerts are low false positive and real-time. That’s great, but when the metaphorical (or literal) phone rings, do you have a plan for how to respond? The attacker is very likely still ‘live and squirming’ on your infrastructure. This leads to interesting new opportunities and questions:
\nThe Fix: Have a specific set of incident response play-books for responding to deception alerts. War-game the scenarios end-to-end, ideally without your DFIR / blue-team being aware. Start basic and build a roadmap to advanced deception use cases.
\nConfident and experienced deception specialists will encourage (even insist) that you test the deception realism in your environment after you implement it. Not only does this validate that the deception is ‘working’ to meet your business objectives, but it will give you useful metrics like time-to-decieve, deception engagement time, coverage, and kill-chain hit ratios.
\nThe Fix: Blind test the strategy underlying your deception technology deployment. See how ‘real’ your simulated adversary believes the decoys are. Did you miss something? This is worth doing regularly.
\nThe best way to increase deception engagement time is to customise the decoys to your environment. There are a number of nifty tricks here (our MirageMaker feature does a lot of this for you), but never underestimate the power of human ingenuity.
\nThe Fix: Find the most devious folks in your infosec team and brainstorm how you can decieve, degrade, deny, disrupt, and dazzle an attacker even better. You want your deception to maximise the economic burden to the attacker in terms of time, effort, and cognitive load.
\nWell planned deception systems unify three perspectives to quickly arrive at the root cause of an incident:
\nWe call this the ‘deception trifecta’, and your entire strategy must be built around it.
\nThe Fix: Study the deception trifecta and determine how weak or strong you are on each side. Improve visibility, collection, and analysis speed for each perspective. Ensure supporting systems can flesh out context when deception systems alert you (e.g. do you have an updated asset inventory?)
\nRemember IDS? DLP? NAC? cough SIEM cough?
\nThe success of cybersecurity technologies is pretty binary: Either they’re well implemented by people who knew how to do it right, or far more often, they’re a mess of false promises and mismatched expectations. If you’re just being sold a box, AMC, and product training, there’s a lot missing. Sure, you might make it work, but the onus should be on the vendor to ensure you operationalise deception capabilities and see success for stuff that matters to you (we do this for every customer, big or small).
\nThe Fix: Talk to your provider to understand the depth of their knowledge on deception technology deployments, adversarial thinking, and most importantly, how they’ll make it all work for you. Get into specifics. Speak to their people. Hint: if their title says ‘Sales’… well… caveat emptor 🙂
\nDeception technology is more than just a new way to detect lateral movement, privilege escalation, ransomware, data-theft or solve any other current cybersecurity woes. It’s a fundamentally different way of thinking about how you defend your organisation, irrespective of shiny boxes (ours or anybody else’s)!
\nAvoid the mistakes above, and your security team will really see the benefits behind the hype. We have customers that now use deception as their ‘concertmaster‘ — the single most important pillar in their security stack, with everything else supporting it.
\nAt Smokescreen, we believe we’ve solved these problems through our technology, support, and experience. If you’d like to learn more about how we think it should be done, get in touch for a chat with our specialists!
\nIf you’re in the process of evaluating deception technology vendors, read our blog post on 10 questions you need to ask them or download our guide that dives deep into capabilities that make for a great deception solution.
\n\n\n\n","excerpt":"Since there’s precious little information on how security teams can make deception implementations successful (some folks like to keep it a secret), there’s plenty that can go wrong. Here are 7 ways to completely botch your deployment of deception technology.\n","slug":"7-deadly-sins-how-to-fail-at-implementing-deception-technology","date":"2017-09-18T14:01:05.000Z","status":"publish","modified":"2020-01-05T09:25:57.000Z","wordpress_id":16912,"featured_media":{"id":"940f3e3f-92f9-56f6-91a1-525330dda41c","source_url":"https://ss-website-content-prod.s3.ap-south-1.amazonaws.com/wp-content/uploads/2017/09/failwin.png","alt_text":"Fail At Deception Technology","large":{"childImageSharp":{"fluid":{"base64":"data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAABQAAAAMCAIAAADtbgqsAAAACXBIWXMAABYlAAAWJQFJUiTwAAABqklEQVQoz41SW0sCURCeWf9E1FMEvUWa1/VumpnXzdveLFN3VZDKCsmgf9BT4ENkQUpBUA/9xObsLrpUD8HHYc4538x85zsD6OL/hZ0gW52BZeziwbrb9lsXtFL8M9k4pBx3yCD7bMlOP4ZSkKuDoEJOxEjaKmSCYiePyQKWj6DWQqGB8axJAFaSNrLmkHWOoOgo65jML/sTL1uDRp/OHQZQ7WNaIAKgN0r1QNLgsAl5iaF6AvU2+mPGE3wY3gOlB5VjdpUTGSpNkLvIJ4CL7lO0UpJOr8bth1lnMl3rXVA5LpFjzT0RzItI5dpD9/3z5XQ+eJytdoeMkCoCF8tQ8kZJap2Puk+vN/P3zbMxNedIOTnE76KgctSqf+2bvNx9fN2+fa4PRoyQFgB9MRIJogZlki1DQWayRQ0DcSZ7y4tUXe0xqUUFCgYoVrrMY2Y1CVB0TtIYZJ1dkB8Lw6l/SaVno9gxOUCG0VucAbD8jB1ASYFqk35r8RNLt91hpI8UOyC2mZeZsnluGxJarRn4NSTm5HgjGEyiJ2wQArYJc9mmzxX8e0LNEjZR32MQjkf1g0MQAAAAAElFTkSuQmCC","aspectRatio":1.680672268907563,"src":"/static/741aacdb6ba2e8df1b88b93b521715a6/ee604/failwin.png","srcSet":"/static/741aacdb6ba2e8df1b88b93b521715a6/69585/failwin.png 200w,\n/static/741aacdb6ba2e8df1b88b93b521715a6/497c6/failwin.png 400w,\n/static/741aacdb6ba2e8df1b88b93b521715a6/ee604/failwin.png 800w,\n/static/741aacdb6ba2e8df1b88b93b521715a6/a8378/failwin.png 1024w","srcWebp":"/static/741aacdb6ba2e8df1b88b93b521715a6/58556/failwin.webp","srcSetWebp":"/static/741aacdb6ba2e8df1b88b93b521715a6/61e93/failwin.webp 200w,\n/static/741aacdb6ba2e8df1b88b93b521715a6/1f5c5/failwin.webp 400w,\n/static/741aacdb6ba2e8df1b88b93b521715a6/58556/failwin.webp 800w,\n/static/741aacdb6ba2e8df1b88b93b521715a6/cc834/failwin.webp 1024w","sizes":"(max-width: 800px) 100vw, 800px"}}},"medium":{"childImageSharp":{"fluid":{"base64":"data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAABQAAAAMCAIAAADtbgqsAAAACXBIWXMAABYlAAAWJQFJUiTwAAABqklEQVQoz41SW0sCURCeWf9E1FMEvUWa1/VumpnXzdveLFN3VZDKCsmgf9BT4ENkQUpBUA/9xObsLrpUD8HHYc4538x85zsD6OL/hZ0gW52BZeziwbrb9lsXtFL8M9k4pBx3yCD7bMlOP4ZSkKuDoEJOxEjaKmSCYiePyQKWj6DWQqGB8axJAFaSNrLmkHWOoOgo65jML/sTL1uDRp/OHQZQ7WNaIAKgN0r1QNLgsAl5iaF6AvU2+mPGE3wY3gOlB5VjdpUTGSpNkLvIJ4CL7lO0UpJOr8bth1lnMl3rXVA5LpFjzT0RzItI5dpD9/3z5XQ+eJytdoeMkCoCF8tQ8kZJap2Puk+vN/P3zbMxNedIOTnE76KgctSqf+2bvNx9fN2+fa4PRoyQFgB9MRIJogZlki1DQWayRQ0DcSZ7y4tUXe0xqUUFCgYoVrrMY2Y1CVB0TtIYZJ1dkB8Lw6l/SaVno9gxOUCG0VucAbD8jB1ASYFqk35r8RNLt91hpI8UOyC2mZeZsnluGxJarRn4NSTm5HgjGEyiJ2wQArYJc9mmzxX8e0LNEjZR32MQjkf1g0MQAAAAAElFTkSuQmCC","aspectRatio":1.6865671641791045,"src":"/static/741aacdb6ba2e8df1b88b93b521715a6/62b1f/failwin.png","srcSet":"/static/741aacdb6ba2e8df1b88b93b521715a6/e7519/failwin.png 113w,\n/static/741aacdb6ba2e8df1b88b93b521715a6/7e7e9/failwin.png 225w,\n/static/741aacdb6ba2e8df1b88b93b521715a6/62b1f/failwin.png 450w,\n/static/741aacdb6ba2e8df1b88b93b521715a6/e2e7f/failwin.png 675w,\n/static/741aacdb6ba2e8df1b88b93b521715a6/db955/failwin.png 900w,\n/static/741aacdb6ba2e8df1b88b93b521715a6/a8378/failwin.png 1024w","srcWebp":"/static/741aacdb6ba2e8df1b88b93b521715a6/b8a88/failwin.webp","srcSetWebp":"/static/741aacdb6ba2e8df1b88b93b521715a6/3a3bf/failwin.webp 113w,\n/static/741aacdb6ba2e8df1b88b93b521715a6/975bf/failwin.webp 225w,\n/static/741aacdb6ba2e8df1b88b93b521715a6/b8a88/failwin.webp 450w,\n/static/741aacdb6ba2e8df1b88b93b521715a6/761da/failwin.webp 675w,\n/static/741aacdb6ba2e8df1b88b93b521715a6/210c1/failwin.webp 900w,\n/static/741aacdb6ba2e8df1b88b93b521715a6/cc834/failwin.webp 1024w","sizes":"(max-width: 450px) 100vw, 450px"}}}},"author":{"id":"9257cd1e-ca7f-578b-a2dd-9c2e74282caf","name":"Smokescreen Team"}}},{"node":{"id":"faa742a1-4c12-586e-9304-8a6f65d02427","title":"10 Questions To Ask Deception Technology Vendors","content":"In order for you to cut through the marketing hype, here’s a set of evaluation questions to ask deception technology vendors that will help you better understand disparate offerings.
\nIf you’re currently evaluating deception technology vendors, we’ve written a guide that goes deeper into some of the questions that we’ve listed above. You can download it here.
\n","excerpt":"Deception technology is a major buzzword today. In order for you to cut through the marketing hype, here’s a set of evaluation questions that will help you better understand disparate deception offerings and identify vendors that know what they’re doing.\n","slug":"10-questions-to-ask-your-deception-technology-provider","date":"2017-09-18T12:58:47.000Z","status":"publish","modified":"2020-01-05T09:26:06.000Z","wordpress_id":16901,"featured_media":{"id":"cbfa76e5-6c88-57a7-a370-c16bd4df05ad","source_url":"https://ss-website-content-prod.s3.ap-south-1.amazonaws.com/wp-content/uploads/2017/09/10questions-1.png","alt_text":"Deception technology vendors","large":{"childImageSharp":{"fluid":{"base64":"data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAABQAAAANCAYAAACpUE5eAAAACXBIWXMAABYlAAAWJQFJUiTwAAACrklEQVQ4y51TS0+TURCdyyNpXBjUoEaNJG40UWIiMcbyKPZNH7bFttDSUqSFlvKwhdIGKOVRKUVolYiiGNSNG1f+w+NMrzFx62Lud7/7nTnfnZlzqPOJCWS0gIacIIsXZA+AXCGQNwLyT4ACcdDopA7Z+/jMO64xguUcJblPzTBwUKeRl0E7lNkDJQB3mJOimiD0EjSWAo3P6JC9nMk3wQiWcyRXOAwDNibkRQ2PgKw+0EgQ9DyqbxJOgqKzoNgcRxYU55jIaGL5JhjB8k2Vzdeq0DDkALUP8mLyot3Jt/NwKb6YToww2eQCKJkHpVdBMyugWX6mlvW3aFqTCqFUxmF45gJddVqxWX2AlZ1HCBcGQFPLUNvvQOUjULEGanwF1T6BDs9Bm0293zkGrR2Att7ys65xi2UYzG5Qx7ALx427OPt4j0n7QEuboPoZqPkdtM/J57/0e+Mb6OALkzZApz9BpX1+5/P3PzSuuAeDjwfZZnLhTsgO27wZvSmecjjTuqFa2dU3qjShqh84TqA2DqFyW/zTMmj1NVSmCMW9VckcaDoHg3OUhyJ1W3lj5f65uSfBKT3NCR7GtPSvCJrf4FjXPZSz+LzuY4Cn7R4D2fygYTf3kEvu5An3z+XRl83DW6nhYW4dxnINpt0Gest12Juf8XjvGP31E9iOTmE/OEFvqQrL9hsYSzsYLFTgWa/ifmIOFywsnw6e8iVPGN3BBG7FM7gSS+PiZBY9CyV0pQu4vrSBa6/K6Clso2e5gpuLa7icyqMrkUU342/EZnE7kmxxGER+okMS6Yg4W8LmEvzijoTWXITlEc3okDJFg0EWtz+msZIjpQ7YtQ61UxzaKY5RKFa/YheoFwkodoXifiomboXsQ9NQ7JQWRrCOANrEsn+d8sfL6n+9bP7Xy78B/QzPO9OV/CAAAAAASUVORK5CYII=","aspectRatio":1.5267175572519085,"src":"/static/b18c94100d3b034bc59158680ab07e07/ee604/10questions-1.png","srcSet":"/static/b18c94100d3b034bc59158680ab07e07/69585/10questions-1.png 200w,\n/static/b18c94100d3b034bc59158680ab07e07/497c6/10questions-1.png 400w,\n/static/b18c94100d3b034bc59158680ab07e07/ee604/10questions-1.png 800w,\n/static/b18c94100d3b034bc59158680ab07e07/a8378/10questions-1.png 1024w","srcWebp":"/static/b18c94100d3b034bc59158680ab07e07/58556/10questions-1.webp","srcSetWebp":"/static/b18c94100d3b034bc59158680ab07e07/61e93/10questions-1.webp 200w,\n/static/b18c94100d3b034bc59158680ab07e07/1f5c5/10questions-1.webp 400w,\n/static/b18c94100d3b034bc59158680ab07e07/58556/10questions-1.webp 800w,\n/static/b18c94100d3b034bc59158680ab07e07/cc834/10questions-1.webp 1024w","sizes":"(max-width: 800px) 100vw, 800px"}}},"medium":{"childImageSharp":{"fluid":{"base64":"data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAABQAAAANCAYAAACpUE5eAAAACXBIWXMAABYlAAAWJQFJUiTwAAACrklEQVQ4y51TS0+TURCdyyNpXBjUoEaNJG40UWIiMcbyKPZNH7bFttDSUqSFlvKwhdIGKOVRKUVolYiiGNSNG1f+w+NMrzFx62Lud7/7nTnfnZlzqPOJCWS0gIacIIsXZA+AXCGQNwLyT4ACcdDopA7Z+/jMO64xguUcJblPzTBwUKeRl0E7lNkDJQB3mJOimiD0EjSWAo3P6JC9nMk3wQiWcyRXOAwDNibkRQ2PgKw+0EgQ9DyqbxJOgqKzoNgcRxYU55jIaGL5JhjB8k2Vzdeq0DDkALUP8mLyot3Jt/NwKb6YToww2eQCKJkHpVdBMyugWX6mlvW3aFqTCqFUxmF45gJddVqxWX2AlZ1HCBcGQFPLUNvvQOUjULEGanwF1T6BDs9Bm0293zkGrR2Att7ys65xi2UYzG5Qx7ALx427OPt4j0n7QEuboPoZqPkdtM/J57/0e+Mb6OALkzZApz9BpX1+5/P3PzSuuAeDjwfZZnLhTsgO27wZvSmecjjTuqFa2dU3qjShqh84TqA2DqFyW/zTMmj1NVSmCMW9VckcaDoHg3OUhyJ1W3lj5f65uSfBKT3NCR7GtPSvCJrf4FjXPZSz+LzuY4Cn7R4D2fygYTf3kEvu5An3z+XRl83DW6nhYW4dxnINpt0Gest12Juf8XjvGP31E9iOTmE/OEFvqQrL9hsYSzsYLFTgWa/ifmIOFywsnw6e8iVPGN3BBG7FM7gSS+PiZBY9CyV0pQu4vrSBa6/K6Clso2e5gpuLa7icyqMrkUU342/EZnE7kmxxGER+okMS6Yg4W8LmEvzijoTWXITlEc3okDJFg0EWtz+msZIjpQ7YtQ61UxzaKY5RKFa/YheoFwkodoXifiomboXsQ9NQ7JQWRrCOANrEsn+d8sfL6n+9bP7Xy78B/QzPO9OV/CAAAAAASUVORK5CYII=","aspectRatio":1.527027027027027,"src":"/static/b18c94100d3b034bc59158680ab07e07/62b1f/10questions-1.png","srcSet":"/static/b18c94100d3b034bc59158680ab07e07/e7519/10questions-1.png 113w,\n/static/b18c94100d3b034bc59158680ab07e07/7e7e9/10questions-1.png 225w,\n/static/b18c94100d3b034bc59158680ab07e07/62b1f/10questions-1.png 450w,\n/static/b18c94100d3b034bc59158680ab07e07/e2e7f/10questions-1.png 675w,\n/static/b18c94100d3b034bc59158680ab07e07/db955/10questions-1.png 900w,\n/static/b18c94100d3b034bc59158680ab07e07/a8378/10questions-1.png 1024w","srcWebp":"/static/b18c94100d3b034bc59158680ab07e07/b8a88/10questions-1.webp","srcSetWebp":"/static/b18c94100d3b034bc59158680ab07e07/3a3bf/10questions-1.webp 113w,\n/static/b18c94100d3b034bc59158680ab07e07/975bf/10questions-1.webp 225w,\n/static/b18c94100d3b034bc59158680ab07e07/b8a88/10questions-1.webp 450w,\n/static/b18c94100d3b034bc59158680ab07e07/761da/10questions-1.webp 675w,\n/static/b18c94100d3b034bc59158680ab07e07/210c1/10questions-1.webp 900w,\n/static/b18c94100d3b034bc59158680ab07e07/cc834/10questions-1.webp 1024w","sizes":"(max-width: 450px) 100vw, 450px"}}}},"author":{"id":"9257cd1e-ca7f-578b-a2dd-9c2e74282caf","name":"Smokescreen Team"}}},{"node":{"id":"0b6fe724-d0b1-5b1a-a31b-daeeb17e0310","title":"Deception and Kerckhoffs’s Cryptographic Principle","content":"Conceptually, deception is an incredibly intuitive approach to cybersecurity. The parallels between deception in the real-world, and deception in cyberspace are clear and easy to understand. However, in the digital battlefield it’s far more nuanced — it’s easy to do it badly, and far harder to get it right. Which makes it rather similar to a more traditional security practice — cryptography.
\nCryptographers are familiar with a well-known axiom called Kerckhoff’s principle, which states:
\n\nA cryptosystem should be secure even if everything about the system, except the key, is public knowledge.
This was famously paraphrased by Claude Shannon in what is known as Shannon’s Maxim:
\n\n“The enemy knows the system“, i.e., “one ought to design systems under the assumption that the enemy will immediately gain full familiarity with them“
The applicability to deception is immediately apparent. It should remain effective, even when an attacker:
\nHowever, the exact map of the minefield — the specific placement of decoys, their running services, and their content is not known. This deception map is the equivalent of the secret key in a crypto-system. As long as the map is not known to the attacker, the illusion should still remain extremely effective, despite the attacker having complete visibility into the rest of the system.
\nAt Smokescreen, we are laser focused on making sure deception is ‘done right’ — with the necessary rigour and formal reasoning to hold up in real-world conditions. How do we do this? Our depth of experience in related cybersecurity disciplines is our secret weapon. We apply hard earned knowledge from red-teaming, asymmetric thinking, threat hunting, cryptography and incident response to build the most formidable and effective deception system available.
\n","excerpt":"The parallels between deception in the real-world, and deception in cyberspace are clear and easy to understand. However, deception in the digital battlefield is far more nuanced — it’s easy to do it badly, and far harder to get it right. Which makes it rather similar to a more traditional security practice — cryptography.\n","slug":"deception-and-kerckhoffss-cryptographic-principle","date":"2017-02-16T10:50:52.000Z","status":"publish","modified":"2020-01-06T07:05:07.000Z","wordpress_id":16772,"featured_media":{"id":"c7ca7a31-c5f1-5880-8111-9cbfd1198f24","source_url":"https://ss-website-content-prod.s3.ap-south-1.amazonaws.com/wp-content/uploads/2017/02/Enigma-plugboard.jpg","alt_text":"Deception","large":{"childImageSharp":{"fluid":{"base64":"data:image/jpeg;base64,/9j/2wBDABALDA4MChAODQ4SERATGCgaGBYWGDEjJR0oOjM9PDkzODdASFxOQERXRTc4UG1RV19iZ2hnPk1xeXBkeFxlZ2P/2wBDARESEhgVGC8aGi9jQjhCY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2P/wgARCAAOABQDASIAAhEBAxEB/8QAFwAAAwEAAAAAAAAAAAAAAAAAAAMEBf/EABYBAQEBAAAAAAAAAAAAAAAAAAIAAf/aAAwDAQACEAMQAAABQ6NgWaUG3//EABoQAAIDAQEAAAAAAAAAAAAAAAECAAMRBBL/2gAIAQEAAQUC5l8LaodDWwK7DsKHf//EABURAQEAAAAAAAAAAAAAAAAAAAAR/9oACAEDAQE/AUf/xAAVEQEBAAAAAAAAAAAAAAAAAAAAEf/aAAgBAgEBPwFX/8QAGRABAAIDAAAAAAAAAAAAAAAAAQAhAhIg/9oACAEBAAY/AryLibnP/8QAGhABAAMBAQEAAAAAAAAAAAAAAQARITFBYf/aAAgBAQABPyEVqOqJ0KesQFX9GbGx0OTQKn//2gAMAwEAAgADAAAAEDzP/8QAFREBAQAAAAAAAAAAAAAAAAAAARD/2gAIAQMBAT8QCf/EABURAQEAAAAAAAAAAAAAAAAAAAEQ/9oACAECAQE/EFn/xAAbEAEBAAMBAQEAAAAAAAAAAAABEQAhMcFxkf/aAAgBAQABPxAAdtioQ7gVpEDn5kg4eBH5gNDyQ5wxJMSOmeY1IR3LfM//2Q==","aspectRatio":1.4705882352941178,"src":"/static/33488cec05051fdb0cde315fb03b25b1/14b42/Enigma-plugboard.jpg","srcSet":"/static/33488cec05051fdb0cde315fb03b25b1/f836f/Enigma-plugboard.jpg 200w,\n/static/33488cec05051fdb0cde315fb03b25b1/2244e/Enigma-plugboard.jpg 400w,\n/static/33488cec05051fdb0cde315fb03b25b1/14b42/Enigma-plugboard.jpg 800w,\n/static/33488cec05051fdb0cde315fb03b25b1/a1fc1/Enigma-plugboard.jpg 921w","srcWebp":"/static/33488cec05051fdb0cde315fb03b25b1/58556/Enigma-plugboard.webp","srcSetWebp":"/static/33488cec05051fdb0cde315fb03b25b1/61e93/Enigma-plugboard.webp 200w,\n/static/33488cec05051fdb0cde315fb03b25b1/1f5c5/Enigma-plugboard.webp 400w,\n/static/33488cec05051fdb0cde315fb03b25b1/58556/Enigma-plugboard.webp 800w,\n/static/33488cec05051fdb0cde315fb03b25b1/147d5/Enigma-plugboard.webp 921w","sizes":"(max-width: 800px) 100vw, 800px"}}},"medium":{"childImageSharp":{"fluid":{"base64":"data:image/jpeg;base64,/9j/2wBDABALDA4MChAODQ4SERATGCgaGBYWGDEjJR0oOjM9PDkzODdASFxOQERXRTc4UG1RV19iZ2hnPk1xeXBkeFxlZ2P/2wBDARESEhgVGC8aGi9jQjhCY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2P/wgARCAAOABQDASIAAhEBAxEB/8QAFwAAAwEAAAAAAAAAAAAAAAAAAAMEBf/EABYBAQEBAAAAAAAAAAAAAAAAAAIAAf/aAAwDAQACEAMQAAABQ6NgWaUG3//EABoQAAIDAQEAAAAAAAAAAAAAAAECAAMRBBL/2gAIAQEAAQUC5l8LaodDWwK7DsKHf//EABURAQEAAAAAAAAAAAAAAAAAAAAR/9oACAEDAQE/AUf/xAAVEQEBAAAAAAAAAAAAAAAAAAAAEf/aAAgBAgEBPwFX/8QAGRABAAIDAAAAAAAAAAAAAAAAAQAhAhIg/9oACAEBAAY/AryLibnP/8QAGhABAAMBAQEAAAAAAAAAAAAAAQARITFBYf/aAAgBAQABPyEVqOqJ0KesQFX9GbGx0OTQKn//2gAMAwEAAgADAAAAEDzP/8QAFREBAQAAAAAAAAAAAAAAAAAAARD/2gAIAQMBAT8QCf/EABURAQEAAAAAAAAAAAAAAAAAAAEQ/9oACAECAQE/EFn/xAAbEAEBAAMBAQEAAAAAAAAAAAABEQAhMcFxkf/aAAgBAQABPxAAdtioQ7gVpEDn5kg4eBH5gNDyQ5wxJMSOmeY1IR3LfM//2Q==","aspectRatio":1.4675324675324675,"src":"/static/33488cec05051fdb0cde315fb03b25b1/32fd5/Enigma-plugboard.jpg","srcSet":"/static/33488cec05051fdb0cde315fb03b25b1/06e94/Enigma-plugboard.jpg 113w,\n/static/33488cec05051fdb0cde315fb03b25b1/07ab6/Enigma-plugboard.jpg 225w,\n/static/33488cec05051fdb0cde315fb03b25b1/32fd5/Enigma-plugboard.jpg 450w,\n/static/33488cec05051fdb0cde315fb03b25b1/4a838/Enigma-plugboard.jpg 675w,\n/static/33488cec05051fdb0cde315fb03b25b1/9842e/Enigma-plugboard.jpg 900w,\n/static/33488cec05051fdb0cde315fb03b25b1/a1fc1/Enigma-plugboard.jpg 921w","srcWebp":"/static/33488cec05051fdb0cde315fb03b25b1/b8a88/Enigma-plugboard.webp","srcSetWebp":"/static/33488cec05051fdb0cde315fb03b25b1/3a3bf/Enigma-plugboard.webp 113w,\n/static/33488cec05051fdb0cde315fb03b25b1/975bf/Enigma-plugboard.webp 225w,\n/static/33488cec05051fdb0cde315fb03b25b1/b8a88/Enigma-plugboard.webp 450w,\n/static/33488cec05051fdb0cde315fb03b25b1/761da/Enigma-plugboard.webp 675w,\n/static/33488cec05051fdb0cde315fb03b25b1/210c1/Enigma-plugboard.webp 900w,\n/static/33488cec05051fdb0cde315fb03b25b1/147d5/Enigma-plugboard.webp 921w","sizes":"(max-width: 450px) 100vw, 450px"}}}},"author":{"id":"9257cd1e-ca7f-578b-a2dd-9c2e74282caf","name":"Smokescreen Team"}}},{"node":{"id":"5a599627-06ce-5648-9110-44d5069384ca","title":"The Capability Maturity of 3rd Generation Deception Technology","content":"Deception in cybersecurity has come a long way from the early days of the traditional honeypot. We’re currently at 3rd generation deception technology. Recent advances in virtualisation technology and the changing face of modern attacks have led to a rapidly maturing set of deception capabilities that organisations must adopt to see value from deception systems.
\nWhen you look at the available deception solutions, there are three clear-cut generations of capability maturity. Here’s how they break down:
\nEpitomised by the traditional honeypot. This was where much of the early work on building deception platforms began. Much of the available technology is open-source, and has primarily been developed as academic research projects. They are usually emulation based, with basic logging capabilities. Unfortunately, most of these projects are now abandonware as the primary developers have moved on. They’re easy to fingerprint and often have well-known security vulnerabilities. That said, they are quick to setup and play with, and are great for dipping one’s feet into deception or helping to build a business case.
\nA few years ago, commercial solutions appeared that try to reboot the network honeypot with enterprise features such as central monitoring and alerting. They typically run a few full ‘fat’ virtual machines that are propagated via NIC bonding / IP aliasing to distribute these VM’s across the enterprise network. They’ll often include some form of lure on the endpoint to draw attackers towards the VMs. These are essentially ‘enterprise honeypots’, however they are technology limited as they rely on the same few VM’s to create multiple decoys — something that won’t fool a seasoned cyber-criminal, leave alone a nation-state attacker.
\n3rd generation deception technology represent the state-of-the-art in terms of technology adoption. Using technology such as micro-virtualisation to replace fat VM’s, means you can have hundreds of individually unique network decoys, each with their own personality. 3rd gen systems also incorporate advanced analytics, machine learning, automated data creation for at-scale deployments, and visual attack reconstructions. They have coverage of areas that the network honeypot misses, including support for threat intelligence decoys, web-application integrations, social-engineering attacks, and Active Directory attacks. Often, they will incorporate orchestration as a first-class citizen — integrating with other solutions through rule-based triggers.
\nEach generation builds on the next, and we’re likely to see far more innovation in the deception space in the next 12 to 24 months. At Smokescreen, we’ve got an extremely deep innovation roadmap, with a lot of new stuff in the lab that we’ve been beta-testing with mature customers for a while now. Many of these new capabilities are completely novel, and really brings active defence to defence teams, letting them go toe-to-toe with apex adversaries.
\n","excerpt":"Deception in cybersecurity has come a long way from the early days of honeypots. Recent advances in virtualisation and evolving modern attacks have led to a rapidly maturing set of capabilities that organisations must adopt to see value from deception systems.\n","slug":"the-capability-maturity-of-deception-technology","date":"2016-08-11T05:24:29.000Z","status":"publish","modified":"2020-01-06T03:53:30.000Z","wordpress_id":16544,"featured_media":{"id":"85e39cd9-ced0-59be-b49d-0bccab6725e7","source_url":"https://ss-website-content-prod.s3.ap-south-1.amazonaws.com/wp-content/uploads/2016/08/maturity-model-deception.jpg","alt_text":"3rd generation deception technology","large":{"childImageSharp":{"fluid":{"base64":"data:image/jpeg;base64,/9j/2wBDABALDA4MChAODQ4SERATGCgaGBYWGDEjJR0oOjM9PDkzODdASFxOQERXRTc4UG1RV19iZ2hnPk1xeXBkeFxlZ2P/2wBDARESEhgVGC8aGi9jQjhCY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2P/wgARCAAMABQDASIAAhEBAxEB/8QAFwABAQEBAAAAAAAAAAAAAAAAAAECBf/EABYBAQEBAAAAAAAAAAAAAAAAAAIAAf/aAAwDAQACEAMQAAAB5NxEKLf/xAAWEAEBAQAAAAAAAAAAAAAAAAAhACD/2gAIAQEAAQUCIz//xAAVEQEBAAAAAAAAAAAAAAAAAAAQEf/aAAgBAwEBPwGH/8QAFBEBAAAAAAAAAAAAAAAAAAAAEP/aAAgBAgEBPwE//8QAFhABAQEAAAAAAAAAAAAAAAAAMQAg/9oACAEBAAY/AiM//8QAGhABAAIDAQAAAAAAAAAAAAAAAQARECFBgf/aAAgBAQABPyEobt7F4MSmXn//2gAMAwEAAgADAAAAEFcf/8QAFhEAAwAAAAAAAAAAAAAAAAAAEBEx/9oACAEDAQE/EEo//8QAFBEBAAAAAAAAAAAAAAAAAAAAEP/aAAgBAgEBPxA//8QAGhABAQADAQEAAAAAAAAAAAAAAQARITFBwf/aAAgBAQABPxBBcxmoDH3K/bUHJSA8JV6yX//Z","aspectRatio":1.7094017094017093,"src":"/static/5aaf55854d6e7e461896d8711e9f0b9b/14b42/maturity-model-deception.jpg","srcSet":"/static/5aaf55854d6e7e461896d8711e9f0b9b/f836f/maturity-model-deception.jpg 200w,\n/static/5aaf55854d6e7e461896d8711e9f0b9b/2244e/maturity-model-deception.jpg 400w,\n/static/5aaf55854d6e7e461896d8711e9f0b9b/14b42/maturity-model-deception.jpg 800w,\n/static/5aaf55854d6e7e461896d8711e9f0b9b/c0aaa/maturity-model-deception.jpg 1127w","srcWebp":"/static/5aaf55854d6e7e461896d8711e9f0b9b/58556/maturity-model-deception.webp","srcSetWebp":"/static/5aaf55854d6e7e461896d8711e9f0b9b/61e93/maturity-model-deception.webp 200w,\n/static/5aaf55854d6e7e461896d8711e9f0b9b/1f5c5/maturity-model-deception.webp 400w,\n/static/5aaf55854d6e7e461896d8711e9f0b9b/58556/maturity-model-deception.webp 800w,\n/static/5aaf55854d6e7e461896d8711e9f0b9b/dd926/maturity-model-deception.webp 1127w","sizes":"(max-width: 800px) 100vw, 800px"}}},"medium":{"childImageSharp":{"fluid":{"base64":"data:image/jpeg;base64,/9j/2wBDABALDA4MChAODQ4SERATGCgaGBYWGDEjJR0oOjM9PDkzODdASFxOQERXRTc4UG1RV19iZ2hnPk1xeXBkeFxlZ2P/2wBDARESEhgVGC8aGi9jQjhCY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2P/wgARCAAMABQDASIAAhEBAxEB/8QAFwABAQEBAAAAAAAAAAAAAAAAAAECBf/EABYBAQEBAAAAAAAAAAAAAAAAAAIAAf/aAAwDAQACEAMQAAAB5NxEKLf/xAAWEAEBAQAAAAAAAAAAAAAAAAAhACD/2gAIAQEAAQUCIz//xAAVEQEBAAAAAAAAAAAAAAAAAAAQEf/aAAgBAwEBPwGH/8QAFBEBAAAAAAAAAAAAAAAAAAAAEP/aAAgBAgEBPwE//8QAFhABAQEAAAAAAAAAAAAAAAAAMQAg/9oACAEBAAY/AiM//8QAGhABAAIDAQAAAAAAAAAAAAAAAQARECFBgf/aAAgBAQABPyEobt7F4MSmXn//2gAMAwEAAgADAAAAEFcf/8QAFhEAAwAAAAAAAAAAAAAAAAAAEBEx/9oACAEDAQE/EEo//8QAFBEBAAAAAAAAAAAAAAAAAAAAEP/aAAgBAgEBPxA//8QAGhABAQADAQEAAAAAAAAAAAAAAQARITFBwf/aAAgBAQABPxBBcxmoDH3K/bUHJSA8JV6yX//Z","aspectRatio":1.7121212121212122,"src":"/static/5aaf55854d6e7e461896d8711e9f0b9b/32fd5/maturity-model-deception.jpg","srcSet":"/static/5aaf55854d6e7e461896d8711e9f0b9b/06e94/maturity-model-deception.jpg 113w,\n/static/5aaf55854d6e7e461896d8711e9f0b9b/07ab6/maturity-model-deception.jpg 225w,\n/static/5aaf55854d6e7e461896d8711e9f0b9b/32fd5/maturity-model-deception.jpg 450w,\n/static/5aaf55854d6e7e461896d8711e9f0b9b/4a838/maturity-model-deception.jpg 675w,\n/static/5aaf55854d6e7e461896d8711e9f0b9b/9842e/maturity-model-deception.jpg 900w,\n/static/5aaf55854d6e7e461896d8711e9f0b9b/c0aaa/maturity-model-deception.jpg 1127w","srcWebp":"/static/5aaf55854d6e7e461896d8711e9f0b9b/b8a88/maturity-model-deception.webp","srcSetWebp":"/static/5aaf55854d6e7e461896d8711e9f0b9b/3a3bf/maturity-model-deception.webp 113w,\n/static/5aaf55854d6e7e461896d8711e9f0b9b/975bf/maturity-model-deception.webp 225w,\n/static/5aaf55854d6e7e461896d8711e9f0b9b/b8a88/maturity-model-deception.webp 450w,\n/static/5aaf55854d6e7e461896d8711e9f0b9b/761da/maturity-model-deception.webp 675w,\n/static/5aaf55854d6e7e461896d8711e9f0b9b/210c1/maturity-model-deception.webp 900w,\n/static/5aaf55854d6e7e461896d8711e9f0b9b/dd926/maturity-model-deception.webp 1127w","sizes":"(max-width: 450px) 100vw, 450px"}}}},"author":{"id":"9257cd1e-ca7f-578b-a2dd-9c2e74282caf","name":"Smokescreen Team"}}},{"node":{"id":"1aadbf65-a42d-51d9-a616-d1e125eaef18","title":"Gartner identifies deception as a top 10 security technology for 2016","content":"Industry research and advisory firm Gartner has been tracking deception technology for a while now. Research Director Lawrence Pingree (Twitter) had written about it in 2015. Now, Gartner identifies deception as a top security technology for 2016 in a list it has released.
\nThe researtch firm just released its list of the ‘Top 10 Technologies for Information Security in 2016‘ and deception technology is one of the technologies they recommend. Here’s what they have to say:
\n\nDeception technologies are defined by the use of deceits and/or tricks designed to thwart, or throw off, an attacker’s cognitive processes, disrupt an attacker’s automation tools, delay an attacker’s activities or disrupt breach progression. Deception technologies are emerging for network, application, endpoint and data, with the best systems combing multiple techniques. By 2018, Gartner predicts that 10 percent of enterprises will use deception tools and tactics, and actively participate in deception operations against attackers.
The other technologies that made the list are:
\nThe growing interest in deception platforms is a result of the realisation that legacy detection systems are too focused on the ever-changing tools of the attacker, and do not deploy defences that are unique from organisation to organisation. As a result, attackers can easily modify their tools to evade these static defences. The evidence is the number of high-profile breaches that have succeeded in spite of antivirus, SIEM, sandboxing and other traditional defences being in place.
\nDeception technology is now in it’s 3rd generation. If you want to learn about how it offers greatly improved cross kill-chain threat detection along with response mechanisms, read this this blog post.
\n","excerpt":"Gartner lists deception as a top 10 cybersecurity technology for 2016\n","slug":"gartner-identifies-deception-as-a-top-10-security-technology-for-2016","date":"2016-06-15T15:04:50.000Z","status":"publish","modified":"2020-01-06T04:09:26.000Z","wordpress_id":16518,"featured_media":{"id":"3ea00f25-6499-58f4-b977-4cb5dfcd2fbb","source_url":"https://ss-website-content-prod.s3.ap-south-1.amazonaws.com/wp-content/uploads/2016/08/1258.gartnerLogo_Blue_WEB.jpg","alt_text":"Gartner identifies deception","large":{"childImageSharp":{"fluid":{"base64":"data:image/jpeg;base64,/9j/2wBDABALDA4MChAODQ4SERATGCgaGBYWGDEjJR0oOjM9PDkzODdASFxOQERXRTc4UG1RV19iZ2hnPk1xeXBkeFxlZ2P/2wBDARESEhgVGC8aGi9jQjhCY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2P/wgARCAAKABQDASIAAhEBAxEB/8QAFwABAAMAAAAAAAAAAAAAAAAAAAIDBf/EABQBAQAAAAAAAAAAAAAAAAAAAAH/2gAMAwEAAhADEAAAAdqN5AH/xAAXEAEBAQEAAAAAAAAAAAAAAAABAhIg/9oACAEBAAEFAqaHV8//xAAUEQEAAAAAAAAAAAAAAAAAAAAQ/9oACAEDAQE/AT//xAAUEQEAAAAAAAAAAAAAAAAAAAAQ/9oACAECAQE/AT//xAAaEAAABwAAAAAAAAAAAAAAAAAAAhEgITKh/9oACAEBAAY/AoKoprf/xAAZEAACAwEAAAAAAAAAAAAAAAABMRARICH/2gAIAQEAAT8hTRHBC+HH/9oADAMBAAIAAwAAABBwz//EABcRAAMBAAAAAAAAAAAAAAAAAAEQEVH/2gAIAQMBAT8Qh1f/xAAXEQADAQAAAAAAAAAAAAAAAAABEBFR/9oACAECAQE/EKMX/8QAGxABAAICAwAAAAAAAAAAAAAAAREhAFEgQXH/2gAIAQEAAT8QVTx1CEvuIb30MasJCzXD/9k=","aspectRatio":2.0618556701030926,"src":"/static/7f61a0900c89de5dc348fa315eaa944c/14b42/1258.gartnerLogo_Blue_WEB.jpg","srcSet":"/static/7f61a0900c89de5dc348fa315eaa944c/f836f/1258.gartnerLogo_Blue_WEB.jpg 200w,\n/static/7f61a0900c89de5dc348fa315eaa944c/2244e/1258.gartnerLogo_Blue_WEB.jpg 400w,\n/static/7f61a0900c89de5dc348fa315eaa944c/14b42/1258.gartnerLogo_Blue_WEB.jpg 800w,\n/static/7f61a0900c89de5dc348fa315eaa944c/1d3b0/1258.gartnerLogo_Blue_WEB.jpg 1095w","srcWebp":"/static/7f61a0900c89de5dc348fa315eaa944c/58556/1258.gartnerLogo_Blue_WEB.webp","srcSetWebp":"/static/7f61a0900c89de5dc348fa315eaa944c/61e93/1258.gartnerLogo_Blue_WEB.webp 200w,\n/static/7f61a0900c89de5dc348fa315eaa944c/1f5c5/1258.gartnerLogo_Blue_WEB.webp 400w,\n/static/7f61a0900c89de5dc348fa315eaa944c/58556/1258.gartnerLogo_Blue_WEB.webp 800w,\n/static/7f61a0900c89de5dc348fa315eaa944c/c921d/1258.gartnerLogo_Blue_WEB.webp 1095w","sizes":"(max-width: 800px) 100vw, 800px"}}},"medium":{"childImageSharp":{"fluid":{"base64":"data:image/jpeg;base64,/9j/2wBDABALDA4MChAODQ4SERATGCgaGBYWGDEjJR0oOjM9PDkzODdASFxOQERXRTc4UG1RV19iZ2hnPk1xeXBkeFxlZ2P/2wBDARESEhgVGC8aGi9jQjhCY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2P/wgARCAAKABQDASIAAhEBAxEB/8QAFwABAAMAAAAAAAAAAAAAAAAAAAIDBf/EABQBAQAAAAAAAAAAAAAAAAAAAAH/2gAMAwEAAhADEAAAAdqN5AH/xAAXEAEBAQEAAAAAAAAAAAAAAAABAhIg/9oACAEBAAEFAqaHV8//xAAUEQEAAAAAAAAAAAAAAAAAAAAQ/9oACAEDAQE/AT//xAAUEQEAAAAAAAAAAAAAAAAAAAAQ/9oACAECAQE/AT//xAAaEAAABwAAAAAAAAAAAAAAAAAAAhEgITKh/9oACAEBAAY/AoKoprf/xAAZEAACAwEAAAAAAAAAAAAAAAABMRARICH/2gAIAQEAAT8hTRHBC+HH/9oADAMBAAIAAwAAABBwz//EABcRAAMBAAAAAAAAAAAAAAAAAAEQEVH/2gAIAQMBAT8Qh1f/xAAXEQADAQAAAAAAAAAAAAAAAAABEBFR/9oACAECAQE/EKMX/8QAGxABAAICAwAAAAAAAAAAAAAAAREhAFEgQXH/2gAIAQEAAT8QVTx1CEvuIb30MasJCzXD/9k=","aspectRatio":2.0545454545454547,"src":"/static/7f61a0900c89de5dc348fa315eaa944c/32fd5/1258.gartnerLogo_Blue_WEB.jpg","srcSet":"/static/7f61a0900c89de5dc348fa315eaa944c/06e94/1258.gartnerLogo_Blue_WEB.jpg 113w,\n/static/7f61a0900c89de5dc348fa315eaa944c/07ab6/1258.gartnerLogo_Blue_WEB.jpg 225w,\n/static/7f61a0900c89de5dc348fa315eaa944c/32fd5/1258.gartnerLogo_Blue_WEB.jpg 450w,\n/static/7f61a0900c89de5dc348fa315eaa944c/4a838/1258.gartnerLogo_Blue_WEB.jpg 675w,\n/static/7f61a0900c89de5dc348fa315eaa944c/9842e/1258.gartnerLogo_Blue_WEB.jpg 900w,\n/static/7f61a0900c89de5dc348fa315eaa944c/1d3b0/1258.gartnerLogo_Blue_WEB.jpg 1095w","srcWebp":"/static/7f61a0900c89de5dc348fa315eaa944c/b8a88/1258.gartnerLogo_Blue_WEB.webp","srcSetWebp":"/static/7f61a0900c89de5dc348fa315eaa944c/3a3bf/1258.gartnerLogo_Blue_WEB.webp 113w,\n/static/7f61a0900c89de5dc348fa315eaa944c/975bf/1258.gartnerLogo_Blue_WEB.webp 225w,\n/static/7f61a0900c89de5dc348fa315eaa944c/b8a88/1258.gartnerLogo_Blue_WEB.webp 450w,\n/static/7f61a0900c89de5dc348fa315eaa944c/761da/1258.gartnerLogo_Blue_WEB.webp 675w,\n/static/7f61a0900c89de5dc348fa315eaa944c/210c1/1258.gartnerLogo_Blue_WEB.webp 900w,\n/static/7f61a0900c89de5dc348fa315eaa944c/c921d/1258.gartnerLogo_Blue_WEB.webp 1095w","sizes":"(max-width: 450px) 100vw, 450px"}}}},"author":{"id":"9257cd1e-ca7f-578b-a2dd-9c2e74282caf","name":"Smokescreen Team"}}},{"node":{"id":"a88fcb7f-3bf0-5a47-9ada-d4cfbf6e2ab9","title":"Why Deception Matters in Cybersecurity","content":"Deception has a centuries-old successful history in military warfare. Military doctrine from Sun Tzu, Genghis Khan, Clausewitz, Machiavelli and Chanakya, all the way through the Second World War has stressed the importance of deceiving the enemy to know their plans and thwart their objectives. Clearly, deception matters.
\nMilitary history is rife with examples of crucial victories, won through subterfuge:
\nInformation today is the coin of the realm, and as such, using deception and misinformation have never been more topical to modern conflict.
\nEarly in computer security, many attacks were famously thwarted through ingenious deception by the defenders. The most famous examples are Clifford Stoll’s tracking a Russian hacker in the 80’s. The story is told best in his book, The Cuckoo’s Egg
\n![](\"https://internal-wp.smokescreen.io/wp-content/uploads/2020/04/clifford-stoll-625x300-c.jpg\")
However, as computing evolved and became more complex, this form of active defence was superceded by protective measures — firewalls and antivirus.
\nUnfortunately, today’s attacks on computer security have shown that protection is both overrated, and impossible to achieve. The largest organisations, from Target Corp. to J.P. Morgan and Sony have been victims of massive hacks, despite
\nhaving every conceivable protection mechanism.
Hackers themselves rely heavily on deception. Social-engineering, or hacking the human, is the number one mechanism used to gain a foothold in the organisation.
\n![\"\"](\"https://esihere.files.wordpress.com/2011/11/social-engineering-specialist_design.png\")
Why then don’t defenders deploy deception? Up until now it was too hard. Too complex to maintain. That has changed now. Active defence is the future of cyber-security, and organisations that forget the foundational principles of warfare will be on the back-foot in dealing with the most modern form of war.
\n","excerpt":"Deception has a centuries-old successful history in military warfare. Military doctrine from Sun Tzu, Genghis Khan, and Machiavelli, all the way through the Second World War has stressed the importance of deceiving the enemy to know their plans and thwart their objectives.\n","slug":"why-deception-matters","date":"2016-01-10T15:26:16.000Z","status":"publish","modified":"2020-04-20T03:58:10.000Z","wordpress_id":16536,"featured_media":{"id":"e2ba9fa4-3a90-5b34-8703-e21ac1e41a0d","source_url":"https://ss-website-content-prod.s3.ap-south-1.amazonaws.com/wp-content/uploads/2016/08/Theprocessionofthetrojanhorseintroybygiovannidomenicotiepolo.jpg","alt_text":"Deception matters","large":{"childImageSharp":{"fluid":{"base64":"data:image/jpeg;base64,/9j/2wBDABALDA4MChAODQ4SERATGCgaGBYWGDEjJR0oOjM9PDkzODdASFxOQERXRTc4UG1RV19iZ2hnPk1xeXBkeFxlZ2P/2wBDARESEhgVGC8aGi9jQjhCY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2P/wgARCAASABQDASIAAhEBAxEB/8QAGQABAQADAQAAAAAAAAAAAAAAAAQBAgMF/8QAFgEBAQEAAAAAAAAAAAAAAAAAAQAC/9oADAMBAAIQAxAAAAHebl0zu95yc1EWAf/EABoQAAIDAQEAAAAAAAAAAAAAAAECAAMREiP/2gAIAQEAAQUCR/NS1lvUdsi9FeTLgNUAEAZ//8QAFhEAAwAAAAAAAAAAAAAAAAAAABAR/9oACAEDAQE/ASP/xAAWEQADAAAAAAAAAAAAAAAAAAAAEBH/2gAIAQIBAT8BK//EABwQAAICAgMAAAAAAAAAAAAAAAABAiEQMRESYf/aAAgBAQAGPwJ+I7OuMJRG4lpsVGjR/8QAGhABAQEBAQEBAAAAAAAAAAAAAREAITFhgf/aAAgBAQABPyExp0E77r1R7DTuFVnVxcifMIqpcaAL80QA/NI43//aAAwDAQACAAMAAAAQtCB+/8QAFxEBAAMAAAAAAAAAAAAAAAAAEAERQf/aAAgBAwEBPxCoGn//xAAYEQACAwAAAAAAAAAAAAAAAAAAEQEQQf/aAAgBAgEBPxByMZX/xAAcEAEBAAICAwAAAAAAAAAAAAABEQAhYaFRkcH/2gAIAQEAAT8QbbbxFNPmDZbV9HDl9tOHT3htM9pATcneL6OGibAPeVUgXZifabgLowIKtgDONHjP/9k=","aspectRatio":1.1049723756906078,"src":"/static/581ea041147a2c712100ab856de90452/dcf4f/Theprocessionofthetrojanhorseintroybygiovannidomenicotiepolo.jpg","srcSet":"/static/581ea041147a2c712100ab856de90452/f836f/Theprocessionofthetrojanhorseintroybygiovannidomenicotiepolo.jpg 200w,\n/static/581ea041147a2c712100ab856de90452/2244e/Theprocessionofthetrojanhorseintroybygiovannidomenicotiepolo.jpg 400w,\n/static/581ea041147a2c712100ab856de90452/dcf4f/Theprocessionofthetrojanhorseintroybygiovannidomenicotiepolo.jpg 774w","srcWebp":"/static/581ea041147a2c712100ab856de90452/e9050/Theprocessionofthetrojanhorseintroybygiovannidomenicotiepolo.webp","srcSetWebp":"/static/581ea041147a2c712100ab856de90452/61e93/Theprocessionofthetrojanhorseintroybygiovannidomenicotiepolo.webp 200w,\n/static/581ea041147a2c712100ab856de90452/1f5c5/Theprocessionofthetrojanhorseintroybygiovannidomenicotiepolo.webp 400w,\n/static/581ea041147a2c712100ab856de90452/e9050/Theprocessionofthetrojanhorseintroybygiovannidomenicotiepolo.webp 774w","sizes":"(max-width: 774px) 100vw, 774px"}}},"medium":{"childImageSharp":{"fluid":{"base64":"data:image/jpeg;base64,/9j/2wBDABALDA4MChAODQ4SERATGCgaGBYWGDEjJR0oOjM9PDkzODdASFxOQERXRTc4UG1RV19iZ2hnPk1xeXBkeFxlZ2P/2wBDARESEhgVGC8aGi9jQjhCY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2P/wgARCAASABQDASIAAhEBAxEB/8QAGQABAQADAQAAAAAAAAAAAAAAAAQBAgMF/8QAFgEBAQEAAAAAAAAAAAAAAAAAAQAC/9oADAMBAAIQAxAAAAHebl0zu95yc1EWAf/EABoQAAIDAQEAAAAAAAAAAAAAAAECAAMREiP/2gAIAQEAAQUCR/NS1lvUdsi9FeTLgNUAEAZ//8QAFhEAAwAAAAAAAAAAAAAAAAAAABAR/9oACAEDAQE/ASP/xAAWEQADAAAAAAAAAAAAAAAAAAAAEBH/2gAIAQIBAT8BK//EABwQAAICAgMAAAAAAAAAAAAAAAABAiEQMRESYf/aAAgBAQAGPwJ+I7OuMJRG4lpsVGjR/8QAGhABAQEBAQEBAAAAAAAAAAAAAREAITFhgf/aAAgBAQABPyExp0E77r1R7DTuFVnVxcifMIqpcaAL80QA/NI43//aAAwDAQACAAMAAAAQtCB+/8QAFxEBAAMAAAAAAAAAAAAAAAAAEAERQf/aAAgBAwEBPxCoGn//xAAYEQACAwAAAAAAAAAAAAAAAAAAEQEQQf/aAAgBAgEBPxByMZX/xAAcEAEBAAICAwAAAAAAAAAAAAABEQAhYaFRkcH/2gAIAQEAAT8QbbbxFNPmDZbV9HDl9tOHT3htM9pATcneL6OGibAPeVUgXZifabgLowIKtgDONHjP/9k=","aspectRatio":1.107843137254902,"src":"/static/581ea041147a2c712100ab856de90452/32fd5/Theprocessionofthetrojanhorseintroybygiovannidomenicotiepolo.jpg","srcSet":"/static/581ea041147a2c712100ab856de90452/06e94/Theprocessionofthetrojanhorseintroybygiovannidomenicotiepolo.jpg 113w,\n/static/581ea041147a2c712100ab856de90452/07ab6/Theprocessionofthetrojanhorseintroybygiovannidomenicotiepolo.jpg 225w,\n/static/581ea041147a2c712100ab856de90452/32fd5/Theprocessionofthetrojanhorseintroybygiovannidomenicotiepolo.jpg 450w,\n/static/581ea041147a2c712100ab856de90452/4a838/Theprocessionofthetrojanhorseintroybygiovannidomenicotiepolo.jpg 675w,\n/static/581ea041147a2c712100ab856de90452/dcf4f/Theprocessionofthetrojanhorseintroybygiovannidomenicotiepolo.jpg 774w","srcWebp":"/static/581ea041147a2c712100ab856de90452/b8a88/Theprocessionofthetrojanhorseintroybygiovannidomenicotiepolo.webp","srcSetWebp":"/static/581ea041147a2c712100ab856de90452/3a3bf/Theprocessionofthetrojanhorseintroybygiovannidomenicotiepolo.webp 113w,\n/static/581ea041147a2c712100ab856de90452/975bf/Theprocessionofthetrojanhorseintroybygiovannidomenicotiepolo.webp 225w,\n/static/581ea041147a2c712100ab856de90452/b8a88/Theprocessionofthetrojanhorseintroybygiovannidomenicotiepolo.webp 450w,\n/static/581ea041147a2c712100ab856de90452/761da/Theprocessionofthetrojanhorseintroybygiovannidomenicotiepolo.webp 675w,\n/static/581ea041147a2c712100ab856de90452/e9050/Theprocessionofthetrojanhorseintroybygiovannidomenicotiepolo.webp 774w","sizes":"(max-width: 450px) 100vw, 450px"}}}},"author":{"id":"9257cd1e-ca7f-578b-a2dd-9c2e74282caf","name":"Smokescreen Team"}}},{"node":{"id":"b6cfef25-eb71-5b78-b2b3-78990af2fe3b","title":"Lenny Zeltser on Protean Security Tactics","content":"We’re big fans of the SANS team, and specifically of Lenny Zeltser. It’s gratifying then, to see him discussing deception and active defence in his recent series of blog posts, and we highly recommend reading his history of deception in computer security.
\nLenny Zeltser is right about deception and active defence on all account. Here, we’d like to extend a couple of his main arguments:
\nWhen you integrate decoys and active defence into the fabric of the environment, you asymmetrically turn the tables on even the most advanced attackers. They are human after all.
\n","excerpt":"We’re big fans of the SANS team and of Lenny Zelster. Lenny has discussed deception in his recent series of blog posts, and we highly recommend reading his history of deception. Here we extend a couple of his main arguments.\n","slug":"lenny-zeltser-on-protean-security-tactics","date":"2015-05-10T13:57:39.000Z","status":"publish","modified":"2020-01-06T07:05:17.000Z","wordpress_id":16431,"featured_media":{"id":"4c6ca115-85db-5bad-a8a7-05e1bd3a85b4","source_url":"https://ss-website-content-prod.s3.ap-south-1.amazonaws.com/wp-content/uploads/2016/06/bg.jpg","alt_text":"Lenny Zeltser","large":{"childImageSharp":{"fluid":{"base64":"data:image/jpeg;base64,/9j/2wBDABALDA4MChAODQ4SERATGCgaGBYWGDEjJR0oOjM9PDkzODdASFxOQERXRTc4UG1RV19iZ2hnPk1xeXBkeFxlZ2P/2wBDARESEhgVGC8aGi9jQjhCY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2P/wgARCAALABQDASIAAhEBAxEB/8QAFwAAAwEAAAAAAAAAAAAAAAAAAAECBf/EABUBAQEAAAAAAAAAAAAAAAAAAAAB/9oADAMBAAIQAxAAAAHAqGiAX//EABQQAQAAAAAAAAAAAAAAAAAAACD/2gAIAQEAAQUCX//EABQRAQAAAAAAAAAAAAAAAAAAABD/2gAIAQMBAT8BP//EABQRAQAAAAAAAAAAAAAAAAAAABD/2gAIAQIBAT8BP//EABQQAQAAAAAAAAAAAAAAAAAAACD/2gAIAQEABj8CX//EABgQAAIDAAAAAAAAAAAAAAAAAAABIDFB/9oACAEBAAE/IUXkf//aAAwDAQACAAMAAAAQr8//xAAUEQEAAAAAAAAAAAAAAAAAAAAQ/9oACAEDAQE/ED//xAAUEQEAAAAAAAAAAAAAAAAAAAAQ/9oACAECAQE/ED//xAAZEAEBAAMBAAAAAAAAAAAAAAABABEhMUH/2gAIAQEAAT8QQmHk8ADHs6YZWVe3/9k=","aspectRatio":1.7699115044247788,"src":"/static/4bd58c20282a97532a0586a6a69e308a/14b42/bg.jpg","srcSet":"/static/4bd58c20282a97532a0586a6a69e308a/f836f/bg.jpg 200w,\n/static/4bd58c20282a97532a0586a6a69e308a/2244e/bg.jpg 400w,\n/static/4bd58c20282a97532a0586a6a69e308a/14b42/bg.jpg 800w,\n/static/4bd58c20282a97532a0586a6a69e308a/47498/bg.jpg 1200w,\n/static/4bd58c20282a97532a0586a6a69e308a/0e329/bg.jpg 1600w,\n/static/4bd58c20282a97532a0586a6a69e308a/d8255/bg.jpg 1920w","srcWebp":"/static/4bd58c20282a97532a0586a6a69e308a/58556/bg.webp","srcSetWebp":"/static/4bd58c20282a97532a0586a6a69e308a/61e93/bg.webp 200w,\n/static/4bd58c20282a97532a0586a6a69e308a/1f5c5/bg.webp 400w,\n/static/4bd58c20282a97532a0586a6a69e308a/58556/bg.webp 800w,\n/static/4bd58c20282a97532a0586a6a69e308a/99238/bg.webp 1200w,\n/static/4bd58c20282a97532a0586a6a69e308a/7c22d/bg.webp 1600w,\n/static/4bd58c20282a97532a0586a6a69e308a/25f09/bg.webp 1920w","sizes":"(max-width: 800px) 100vw, 800px"}}},"medium":{"childImageSharp":{"fluid":{"base64":"data:image/jpeg;base64,/9j/2wBDABALDA4MChAODQ4SERATGCgaGBYWGDEjJR0oOjM9PDkzODdASFxOQERXRTc4UG1RV19iZ2hnPk1xeXBkeFxlZ2P/2wBDARESEhgVGC8aGi9jQjhCY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2P/wgARCAALABQDASIAAhEBAxEB/8QAFwAAAwEAAAAAAAAAAAAAAAAAAAECBf/EABUBAQEAAAAAAAAAAAAAAAAAAAAB/9oADAMBAAIQAxAAAAHAqGiAX//EABQQAQAAAAAAAAAAAAAAAAAAACD/2gAIAQEAAQUCX//EABQRAQAAAAAAAAAAAAAAAAAAABD/2gAIAQMBAT8BP//EABQRAQAAAAAAAAAAAAAAAAAAABD/2gAIAQIBAT8BP//EABQQAQAAAAAAAAAAAAAAAAAAACD/2gAIAQEABj8CX//EABgQAAIDAAAAAAAAAAAAAAAAAAABIDFB/9oACAEBAAE/IUXkf//aAAwDAQACAAMAAAAQr8//xAAUEQEAAAAAAAAAAAAAAAAAAAAQ/9oACAEDAQE/ED//xAAUEQEAAAAAAAAAAAAAAAAAAAAQ/9oACAECAQE/ED//xAAZEAEBAAMBAAAAAAAAAAAAAAABABEhMUH/2gAIAQEAAT8QQmHk8ADHs6YZWVe3/9k=","aspectRatio":1.765625,"src":"/static/4bd58c20282a97532a0586a6a69e308a/32fd5/bg.jpg","srcSet":"/static/4bd58c20282a97532a0586a6a69e308a/06e94/bg.jpg 113w,\n/static/4bd58c20282a97532a0586a6a69e308a/07ab6/bg.jpg 225w,\n/static/4bd58c20282a97532a0586a6a69e308a/32fd5/bg.jpg 450w,\n/static/4bd58c20282a97532a0586a6a69e308a/4a838/bg.jpg 675w,\n/static/4bd58c20282a97532a0586a6a69e308a/9842e/bg.jpg 900w,\n/static/4bd58c20282a97532a0586a6a69e308a/d8255/bg.jpg 1920w","srcWebp":"/static/4bd58c20282a97532a0586a6a69e308a/b8a88/bg.webp","srcSetWebp":"/static/4bd58c20282a97532a0586a6a69e308a/3a3bf/bg.webp 113w,\n/static/4bd58c20282a97532a0586a6a69e308a/975bf/bg.webp 225w,\n/static/4bd58c20282a97532a0586a6a69e308a/b8a88/bg.webp 450w,\n/static/4bd58c20282a97532a0586a6a69e308a/761da/bg.webp 675w,\n/static/4bd58c20282a97532a0586a6a69e308a/210c1/bg.webp 900w,\n/static/4bd58c20282a97532a0586a6a69e308a/25f09/bg.webp 1920w","sizes":"(max-width: 450px) 100vw, 450px"}}}},"author":{"id":"9257cd1e-ca7f-578b-a2dd-9c2e74282caf","name":"Smokescreen Team"}}}]}},"pageContext":{"id":"a725b316-af4b-5d16-8453-4b07c65d8fca"}},"staticQueryHashes":["1478079672"]}