{"componentChunkName":"component---src-templates-category-js","path":"/categories/strategy/","result":{"data":{"category":{"name":"strategy","description":"","slug":"strategy"},"posts":{"edges":[{"node":{"id":"58eb6f3c-c8ac-5680-a020-d1cc788cadbb","title":"The pragmatic security leader’s guide to deception technology","content":"\n

Deception technology provides a unique approach to detecting adversary activity in a network. Compared to other detection controls, it’s easier to deploy, gives you greater visibility, and solves your false positives problem.

\n\n\n\n

Let’s cut to the chase, shall we? Of course, I’m going to say this. I work for a company that sells a deception solution. I’m quite sure that if you’ve ever spoken to a deception vendor, you would have heard a similar pitch. If you haven’t talked to one, well, that’s more or less what you’re going to hear in a nutshell.

\n\n\n\n

While what I’ve stated above is accurate, there are nuances to every approach. As they say, when it comes to cybersecurity, there are no silver bullets. I’m writing this post because when you’re evaluating technology or deploying it, you must understand the conditions under which it can be effective. It allows you to be pragmatic and set realistic expectations.

\n\n\n\n

In the next couple of paragraphs, I’m going to delve into nuances of deception technology that often don’t make it to marketing materials.

\n\n\n\n

Visibility, realism, and fingerprinting – The deception trifecta

\n\n\n\n

As with any security control, there are several components that come together to make deception effective. For now, I’m going to focus on the three most important properties that can make or break a deception technology deployment. These are:

\n\n\n\n
  1. Visibility: The deceptive component/decoys must be visible to none but the adversary so that they lead to detection without raising any false positives.
  2. Realism: The deceptive component/decoys should be indistinguishable from your real assets so that malicious actors can’t tell the difference between what’s real and what’s fake.
  3. Fingerprinting: The deceptive component/decoys should not exhibit any property that would reveal their true nature resulting in the adversary not interacting with them.
\n\n\n\n

In an ideal world, every deceptive component should exhibit all three properties in totality. The reality, however, is different.

\n\n\n\n

Some decoys will be visible to folks inside your company but will be a popular target for attackers. Some will have limited realism but will not be fingeprintable. The point is, when you’re deploying deception in a living, breathing network, trade-offs have to be made – sometimes because of internal limitations, and other times because that’s the best strategy.

\n\n\n\n

In my experience, an understanding of these three properties helps in deciding what trade-offs to make and what you can expect. Let’s break them down one by one.

\n\n\n\n

Visibility

\n\n\n\n

Visibility is an important consideration when deploying deceptive components. In organizations, highly visible decoys will lead to false positives and noise. However, the decoys themselves may be the only effective way to detect an adversary. Being aware of different deceptive components and their visibility property can help inform your thinking about what to do. Here’s a handy table.

\n\n\n\n
Component Visibility to regular users
Private Threat Intelligence (Internet-facing decoys) Not visible
Internal network decoys Not visible
Active Directory decoys Not visible
MiTM Deception Not visible
Endpoint Deception – File Decoys * Invisible unless the user chooses the option to show hidden files. 

* The Endpoint deception policy allows file decoys to be hidden to make them invisible to regular users.
Endpoint Deception – Browser Lures * Cookies are invisible to the user.

* Credentials may be viewed if the user browses to the Saved Password page.

* Browser Favorites will be visible to the user.
Endpoint Deception – Session Lures * Network Shares and Windows Credentials are placed in Credential Manager and rarely accessed by regular users and are therefore effectively invisible.

* Session Lures created for software like PuTTY and WinSCP will be visible in the panel of saved sessions.
Endpoint Deception – Privilege Escalation Not visible
Endpoint Deception – Defense Evasion Effectively invisible. Fake Processes are visible in Task Manager but they masquerade as a real process and hide in plain sight.
\n\n\n\n

Fingerprintability

\n\n\n\n

If an adversary can fingerprint your deceptive assets, she will be able to avoid them altogether. That can’t be good, can it? Here are a couple of things to consider when looking at deception solutions to figure out if they’re fingerprintable.

\n\n\n\n

What are the characteristics of the decoys?

\n\n\n\n

For decoys deployed to the network, network characteristics can result in fingerprinting. While it’s relatively easy to fake characteristics like MAC addresses, Hostnames, and IP addresses, NetBIOS names are harder to spoof as they are tied to the machine itself. 

\n\n\n\n

Are they high interaction?

\n\n\n\n

All deception components have a limitation to the extent to which they fool an adversary. However, it’s important to test whether interacting with a deception component gives away large portions of your deployment. If decoys are created using multiple virtual network adapters from a single machine, it is likely that once you login to a decoy and run “ipconfig / ifconfig”, you will be able to figure out all the decoys projected from that host.

\n\n\n\n

Test open-source fingerprinting tools

\n\n\n\n

Open-source fingerprinting tools like HoneypotBuster, attempt to fingerprint deception in active directory and fake credentials in memory. We recommend testing these tools, especially on computer objects in Active Directory as they contain properties that cannot be easily modified in a deception scenario. Also, tools like HoneypotBuster check only the domain from which the tool is run and will not check domains that are trusted in any way. Ensure that you run the tool against the domain where the deception has been configured in Active Directory.

\n\n\n\n

Realism

\n\n\n\n

The realism of a deception component is critical to keeping an attacker engaged. Ideally, the component should be real enough that it allows the adversary to reveal tools, tactics, and techniques that are being used in your environment. It should also provide you with enough telemetry to determine what the next steps should be. 

\n\n\n\n

The overarching goal here is to make the deception component real enough to engage the adversary for long enough so that you can respond to the event. 

\n\n\n\n

Here is some guidance for ensuring that the deception technology components you opt for meet the realism criteria:

\n\n\n\n\n\n\n\n

In summary

\n\n\n\n

When evaluating deception technology, visibility, realism, and fingerprinting should be some of the key components that you should closely look at to figure how the solution will play out in your network.

\n","excerpt":"When evaluating deception technology, look at three key components of the solution to ascertain how effective it will be in your environment – visibility, realism, and fingerprintability.\n","slug":"the-pragmatic-security-leaders-guide-to-deception-technology","date":"2021-02-01T04:04:10.000Z","status":"publish","modified":"2021-02-01T12:39:33.000Z","wordpress_id":18727,"featured_media":{"id":"2a4ed0d8-6b54-5c32-b562-d58644b889bc","source_url":"https://ss-website-content-prod.s3.ap-south-1.amazonaws.com/wp-content/uploads/2021/02/Maze.jpeg","alt_text":"deception technology","large":{"childImageSharp":{"fluid":{"base64":"data:image/jpeg;base64,/9j/2wBDABALDA4MChAODQ4SERATGCgaGBYWGDEjJR0oOjM9PDkzODdASFxOQERXRTc4UG1RV19iZ2hnPk1xeXBkeFxlZ2P/2wBDARESEhgVGC8aGi9jQjhCY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2P/wgARCAANABQDASIAAhEBAxEB/8QAFwABAQEBAAAAAAAAAAAAAAAAAAUCBP/EABYBAQEBAAAAAAAAAAAAAAAAAAABAv/aAAwDAQACEAMQAAAB6EXObaQR/8QAGxAAAgMAAwAAAAAAAAAAAAAAAAMBAhMREjL/2gAIAQEAAQUC1WbLNaC/Kp5O81P/xAAUEQEAAAAAAAAAAAAAAAAAAAAQ/9oACAEDAQE/AT//xAAUEQEAAAAAAAAAAAAAAAAAAAAQ/9oACAECAQE/AT//xAAaEAACAgMAAAAAAAAAAAAAAAAAAQIxEBFR/9oACAEBAAY/ArLxJse+DR//xAAcEAACAgIDAAAAAAAAAAAAAAAAAREhYZExUfH/2gAIAQEAAT8hXkMzRJMN6LW3NDsaj6E0hzDP/9oADAMBAAIAAwAAABAP/wD/xAAVEQEBAAAAAAAAAAAAAAAAAAAAIf/aAAgBAwEBPxBH/8QAFxEBAAMAAAAAAAAAAAAAAAAAAAERIf/aAAgBAgEBPxC5a//EAB0QAAIDAAIDAAAAAAAAAAAAAAERACExUaFBYZH/2gAIAQEAAT8QCDJ0VveITtcW4CWCKPtC86gnxhX31DgsS5l2VfYJIzZGz//Z","aspectRatio":1.5037593984962405,"src":"/static/bb6b3e0811f2e1fac8c855c6c38b11f2/14b42/Maze.jpg","srcSet":"/static/bb6b3e0811f2e1fac8c855c6c38b11f2/f836f/Maze.jpg 200w,\n/static/bb6b3e0811f2e1fac8c855c6c38b11f2/2244e/Maze.jpg 400w,\n/static/bb6b3e0811f2e1fac8c855c6c38b11f2/14b42/Maze.jpg 800w,\n/static/bb6b3e0811f2e1fac8c855c6c38b11f2/47498/Maze.jpg 1200w,\n/static/bb6b3e0811f2e1fac8c855c6c38b11f2/0e329/Maze.jpg 1600w,\n/static/bb6b3e0811f2e1fac8c855c6c38b11f2/42f14/Maze.jpg 1651w","srcWebp":"/static/bb6b3e0811f2e1fac8c855c6c38b11f2/58556/Maze.webp","srcSetWebp":"/static/bb6b3e0811f2e1fac8c855c6c38b11f2/61e93/Maze.webp 200w,\n/static/bb6b3e0811f2e1fac8c855c6c38b11f2/1f5c5/Maze.webp 400w,\n/static/bb6b3e0811f2e1fac8c855c6c38b11f2/58556/Maze.webp 800w,\n/static/bb6b3e0811f2e1fac8c855c6c38b11f2/99238/Maze.webp 1200w,\n/static/bb6b3e0811f2e1fac8c855c6c38b11f2/7c22d/Maze.webp 1600w,\n/static/bb6b3e0811f2e1fac8c855c6c38b11f2/34b00/Maze.webp 1651w","sizes":"(max-width: 800px) 100vw, 800px"}}},"medium":{"childImageSharp":{"fluid":{"base64":"data:image/jpeg;base64,/9j/2wBDABALDA4MChAODQ4SERATGCgaGBYWGDEjJR0oOjM9PDkzODdASFxOQERXRTc4UG1RV19iZ2hnPk1xeXBkeFxlZ2P/2wBDARESEhgVGC8aGi9jQjhCY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2P/wgARCAANABQDASIAAhEBAxEB/8QAFwABAQEBAAAAAAAAAAAAAAAAAAUCBP/EABYBAQEBAAAAAAAAAAAAAAAAAAABAv/aAAwDAQACEAMQAAAB6EXObaQR/8QAGxAAAgMAAwAAAAAAAAAAAAAAAAMBAhMREjL/2gAIAQEAAQUC1WbLNaC/Kp5O81P/xAAUEQEAAAAAAAAAAAAAAAAAAAAQ/9oACAEDAQE/AT//xAAUEQEAAAAAAAAAAAAAAAAAAAAQ/9oACAECAQE/AT//xAAaEAACAgMAAAAAAAAAAAAAAAAAAQIxEBFR/9oACAEBAAY/ArLxJse+DR//xAAcEAACAgIDAAAAAAAAAAAAAAAAAREhYZExUfH/2gAIAQEAAT8hXkMzRJMN6LW3NDsaj6E0hzDP/9oADAMBAAIAAwAAABAP/wD/xAAVEQEBAAAAAAAAAAAAAAAAAAAAIf/aAAgBAwEBPxBH/8QAFxEBAAMAAAAAAAAAAAAAAAAAAAERIf/aAAgBAgEBPxC5a//EAB0QAAIDAAIDAAAAAAAAAAAAAAERACExUaFBYZH/2gAIAQEAAT8QCDJ0VveITtcW4CWCKPtC86gnxhX31DgsS5l2VfYJIzZGz//Z","aspectRatio":1.5066666666666666,"src":"/static/bb6b3e0811f2e1fac8c855c6c38b11f2/32fd5/Maze.jpg","srcSet":"/static/bb6b3e0811f2e1fac8c855c6c38b11f2/06e94/Maze.jpg 113w,\n/static/bb6b3e0811f2e1fac8c855c6c38b11f2/07ab6/Maze.jpg 225w,\n/static/bb6b3e0811f2e1fac8c855c6c38b11f2/32fd5/Maze.jpg 450w,\n/static/bb6b3e0811f2e1fac8c855c6c38b11f2/4a838/Maze.jpg 675w,\n/static/bb6b3e0811f2e1fac8c855c6c38b11f2/9842e/Maze.jpg 900w,\n/static/bb6b3e0811f2e1fac8c855c6c38b11f2/42f14/Maze.jpg 1651w","srcWebp":"/static/bb6b3e0811f2e1fac8c855c6c38b11f2/b8a88/Maze.webp","srcSetWebp":"/static/bb6b3e0811f2e1fac8c855c6c38b11f2/3a3bf/Maze.webp 113w,\n/static/bb6b3e0811f2e1fac8c855c6c38b11f2/975bf/Maze.webp 225w,\n/static/bb6b3e0811f2e1fac8c855c6c38b11f2/b8a88/Maze.webp 450w,\n/static/bb6b3e0811f2e1fac8c855c6c38b11f2/761da/Maze.webp 675w,\n/static/bb6b3e0811f2e1fac8c855c6c38b11f2/210c1/Maze.webp 900w,\n/static/bb6b3e0811f2e1fac8c855c6c38b11f2/34b00/Maze.webp 1651w","sizes":"(max-width: 450px) 100vw, 450px"}}}},"author":{"id":"765e8417-7ed6-55b7-95a7-1d561141e760","name":"Sudarshan Pisupati"}}},{"node":{"id":"e3cd17da-d028-5fad-bd26-31d9b3a4604d","title":"Using deception to shield the insurance sector","content":"\n

Let’s cut to the chase, insurance companies are under siege from cyberattacks. An Accenture report from 2020 shows that attacks on insurers have more than doubled from 240 to 519, on average. Insurers also sit on top of sensitive customer data and are at risk of losing it – 44% exposed more than 500,000 customer records in 2019 compared to 15% for cross-industry peers.

\n\n\n\n

As more people around the world come under the ambit of insurance policies, the risk to insurers continues to grow. In this post, we take a look at some of the key pieces of an insurer’s infrastructure that adversaries target, why they go after it, and how you can use deception to build active defenses that mitigate the risk of these attacks and put you in a better position to detect and contain these threats,

\n\n\n\n

For a moment, step into the shoes of a malicious entity targeting an insurance company. Your goal is to get $$$. What are your best opportunities?

\n\n\n\n

Opportunity #1 – Compromise the database cluster or core application

\n\n\n\n

The database of all policyholders and their policy details, complete with confidential and protected information is perhaps the most valuable asset of an insurer. This would be the holy grail of compromises. Given that a lot of this information is distributed across many systems (some of them legacy), protecting them is a challenge for the sector. 

\n\n\n\n

Adversary Opportunities

\n\n\n\n

Not only would this data sell for a neat sum on the underground market, but it can also be weaponized in numerous ways, including and not limited to: 

\n\n\n\n\n\n\n\n

Adversary Considerations

\n\n\n\n

To achieve this target, adversaries will have to invest time and money into:

\n\n\n\n\n\n\n\n

Adversary Decision Criteria

\n\n\n\n

Cost-benefit analysis reveals Low to medium risk with an extremely high payout. 

\n\n\n\n

Adversary Profiles

\n\n\n\n

Advanced and organized criminal syndicates.

\n\n\n\n

Opportunity #2 – Deploy Ransomware

\n\n\n\n

Insurance companies deal with lots of files. Lots and lots of files. If an adversary succeeds in encrypting as many files as possible, the payout from this activity can be significant. 

\n\n\n\n

Adversary Opportunities

\n\n\n\n\n\n\n\n

Considerations

\n\n\n\n\n\n\n\n

Adversary Profile 

\n\n\n\n

Ransomware operators of any sophistication. 

\n\n\n\n

Opportunity #3 – Attacking public-facing Direct-to-Consumer applications

\n\n\n\n

Insurance companies worldwide are expected to digitize their interactions with consumers. Everything from pre-sales to claims management is expected to be made available to consumers directly in a bid to simplify the consumer experience. This involves the adoption of cloud services, moving previously internal systems to Internet-facing infrastructure, and spinning up even more infrastructure to support business objectives. Adversaries now have a wider attack surface available to them to exploit. 

\n\n\n\n

Adversary Opportunities

\n\n\n\n\n\n\n\n

Adversary Considerations

\n\n\n\n

Mapping external infrastructure is a trivial task and therefore there are minimal considerations for groups adopting this approach. 

\n\n\n\n

Decision Criteria

\n\n\n\n

Low effort with payout equivalent to the criticality of the infrastructure they compromise.

\n\n\n\n

Adversary Profile

\n\n\n\n

Cybercriminals of any sophistication. 

\n\n\n\n

Your Defense Plan in a nutshell

\n\n\n\n\n\n\n\n

Enter Deception

\n\n\n\n

Deception is about tilting the odds of winning in your favor. It’s about making reasonable judgments about what the adversary might go after and presenting that information to them on a platter. Deception is about abstracting defenses to individual attacker techniques with lesser effort and increased cost to the attacker. 

\n\n\n\n

The core principle of deception is the idea that any interaction with a decoy can be viewed as suspicious and warrants immediate action.  

\n\n\n\n

Using deception to beat adversary motivations

\n\n\n\n

Broadly, the plan is to plant decoys across the network, from perimeter to end-point, to deceive the adversary. At a high-level, the following locations will be configured with decoys:

\n\n\n\n
  1. Decoys in the perimeter.
  2. Decoys in the network.
  3. Decoys on the endpoint.
  4. Decoys in Active Directory.
\n\n\n\n

By spreading decoys across the infrastructure, we maximize our chances of detecting adversaries. Remember, we only need to be able to detect the adversary once. 

\n\n\n\n

The following is a break-down of what this might look like in practice. 

\n\n\n\n

Decoy applications at the perimeter

\n\n\n\n\n\n\n\n

Decoy Systems on the network

\n\n\n\n\n\n\n\n

Decoy core application and database users in Active Directory

\n\n\n\n\n\n\n\n

Decoys on the endpoint

\n\n\n\n\n\n\n\n

What’s the alternative?

\n\n\n\n

Let’s say you don’t want to use deception. The alternative is to understand and defend yourself against every attacker technique. As per MITRE ATT&CK, these are over 100 and this does not account for variations in how these attacks might be executed. 

\n\n\n\n

Deception is grounded in addressing the motivations of the adversary and presenting fake information on a platter that adversaries find attractive. It is technique-agnostic and abstracts away the complexity that arises from blocking individual tools, techniques, and behaviors. 

\n\n\n\n

Deception is a form of Active Defense, where security teams take proactive steps to channel the adversary and make their life difficult. It varies from regular defense where you wait for an existing system to generate an alarm and then react.

\n\n\n\n

MITRE new active defense framework, Shield, is being adopted by CISOs around the world and we see this approach being embraced by more and more security teams at insurance companies.

\n","excerpt":"Insurance companies are under siege from cyberattacks. We take a look at some of the key pieces of an insurer’s infrastructure the adversaries target and how you can use deception to build active defenses.\n","slug":"using-deception-to-shield-the-insurance-sector","date":"2021-01-26T12:23:04.000Z","status":"publish","modified":"2021-02-01T03:41:54.000Z","wordpress_id":18716,"featured_media":{"id":"906d7d6e-966b-59f3-9c9d-9b14d27d8746","source_url":"https://ss-website-content-prod.s3.ap-south-1.amazonaws.com/wp-content/uploads/2021/01/Shield-insurance.png","alt_text":"Active defense and deception for insurance","large":{"childImageSharp":{"fluid":{"base64":"data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAABQAAAALCAYAAAB/Ca1DAAAACXBIWXMAAAsTAAALEwEAmpwYAAACeElEQVQozz1Ta28SQRSdNGm1DaTE0oL0IQgFlncBeSwIC8tLHqUsUIRiRYqV2NZEU6OxNtUPxp99nHs/+OFkdmf2njn33LOiO55gPL+AMZnCrQTgC4URjEbx3OOB3+9HKpVCIpH4D13Xkc1m+czr9SISifB7oVBgiJRWgqpXUKjV4QtHEIrHET46ghIMIiiRy+VQKpVQr9dRqVTQarUQCASwurqKjY0NrK2t4eDgAB4pgFaRyBegxJOIpNLIFDW8UHNIS2QlEamj29PpNPL5PMrlMq+0T8UWiwVbW1sIhULw+XysVmjNFhzuQzj9CjSpcvb+EsbpKbKqimKxiEajgWazye2ocq/T6aDf77PSTCbD6mezGZbLJYbDIcTmUwceWZ7AvG3D400L9MYrLK+uYQwGGEicSvLRaATDMJhoMpGej8c4OztDrVbj58Vigel0ypaI4dsZ8tUaXP4Anh16kXlZQNfoo9PtcgEppBapJWq3Wq1yYTKZZC9dLheDOqAz8fXhF+7//MXHL7e4vfvJLauS1LqzA5PJBJvNxhBCYGVlBU6nkwkVRcHu7i4cDgf29vYQDofZb+GNHsEfi6NYb2Dybo75hyVC0RjcnkOeHKmiD6mILiA1pJymrmkax6jdbrM1ZJGIZFTYXW44fQpyZR0TacF4+gZD6dvx8TEbTxExm82IxWK8RyR0EUWKSGlQNJBerwfx6fsP9CWB3mpjIMPdkf6l5YeqBBWRSorGjrSAgk0k5J/VasX6+jrsdjt7R4rpIvH57h7fHn7j4uoGCzndy+sbTKXK0esxR2J/f5+LaDgnJyeshlTF5Q9AK03//Pwc8/mcU/APvBh2nCQ8QXsAAAAASUVORK5CYII=","aspectRatio":1.9047619047619047,"src":"/static/12a9f2eabb7e883c4f03074601938551/ee604/Shield-insurance.png","srcSet":"/static/12a9f2eabb7e883c4f03074601938551/69585/Shield-insurance.png 200w,\n/static/12a9f2eabb7e883c4f03074601938551/497c6/Shield-insurance.png 400w,\n/static/12a9f2eabb7e883c4f03074601938551/ee604/Shield-insurance.png 800w,\n/static/12a9f2eabb7e883c4f03074601938551/f3583/Shield-insurance.png 1200w,\n/static/12a9f2eabb7e883c4f03074601938551/5707d/Shield-insurance.png 1600w,\n/static/12a9f2eabb7e883c4f03074601938551/0ef64/Shield-insurance.png 2400w","srcWebp":"/static/12a9f2eabb7e883c4f03074601938551/58556/Shield-insurance.webp","srcSetWebp":"/static/12a9f2eabb7e883c4f03074601938551/61e93/Shield-insurance.webp 200w,\n/static/12a9f2eabb7e883c4f03074601938551/1f5c5/Shield-insurance.webp 400w,\n/static/12a9f2eabb7e883c4f03074601938551/58556/Shield-insurance.webp 800w,\n/static/12a9f2eabb7e883c4f03074601938551/99238/Shield-insurance.webp 1200w,\n/static/12a9f2eabb7e883c4f03074601938551/7c22d/Shield-insurance.webp 1600w,\n/static/12a9f2eabb7e883c4f03074601938551/f1e40/Shield-insurance.webp 2400w","sizes":"(max-width: 800px) 100vw, 800px"}}},"medium":{"childImageSharp":{"fluid":{"base64":"data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAABQAAAAKCAYAAAC0VX7mAAAACXBIWXMAAAsTAAALEwEAmpwYAAACR0lEQVQozy2S608aURDFrx8LiFjaqOWVKiCPFVjCc3mW54IgKPIuYgFtSU2NNa1pq239y0/vTPrhZncne39z5pwRWqWGcquNQk2HVzlCMKJCCYfh8XoRjUaRzWZRqVRQKpXQaDSQy+VgNBr5GAwGuFwuBAIB7O/v8xGqloVPjUJNaYhpGcQ1DfFUGslUColEAplMBpqslctlFAoFfifI1tYWzGYzDg4OGOTz+biZKDSasLk98IbC0E86uFiuUNUbSKXTrKperzMsJRvQs9vtotVqIZlMMnw8HmO1WqHX63FDsf3GjhfbVhheWmF+9Rr98QTL64/oyIvD4RD9fh+DwQCdTgfT6RSj0Qiz2QzNZhNnZ2cMm8/nqFar3FAMLhfISB/dSgjugIJSrY6u7KZLv+gn6krjhKWvdIFqaane7/fD7Xbz+KSU6vl8HuLu1xMe/jzj5v4bvj8+YfR+Bl8wiM1Nszyb7A8FIISAyWRin+LxOBwOB5xOJwNDoRBbcnh4COH0+fE2EES6WMLk8gMmF3OEZboBCaVQCEAKrVYrbDYbK278V1+r1dBut9lHsoIsENlqnYGeoxAqzWMMJlP0BkOcyIDo4u7uLjY2NmC32/mbQqJAVFVFLBaDruscFIHJZ3H/+BszGcJx7xzTxRKt01Nkcnm8kwnTHhJoZ2cHkUiEV4hgVKMd3Nvb4x2l1EkxBSVuf/zEw99nrO++4tOXW1x/vsFcgs9lugSxWCw8+mKx4LFITbFYxKlsTOleXV1hvV7zRiiKgn/xCVdoxa/hfwAAAABJRU5ErkJggg==","aspectRatio":1.9152542372881356,"src":"/static/12a9f2eabb7e883c4f03074601938551/62b1f/Shield-insurance.png","srcSet":"/static/12a9f2eabb7e883c4f03074601938551/e7519/Shield-insurance.png 113w,\n/static/12a9f2eabb7e883c4f03074601938551/7e7e9/Shield-insurance.png 225w,\n/static/12a9f2eabb7e883c4f03074601938551/62b1f/Shield-insurance.png 450w,\n/static/12a9f2eabb7e883c4f03074601938551/e2e7f/Shield-insurance.png 675w,\n/static/12a9f2eabb7e883c4f03074601938551/db955/Shield-insurance.png 900w,\n/static/12a9f2eabb7e883c4f03074601938551/0ef64/Shield-insurance.png 2400w","srcWebp":"/static/12a9f2eabb7e883c4f03074601938551/b8a88/Shield-insurance.webp","srcSetWebp":"/static/12a9f2eabb7e883c4f03074601938551/3a3bf/Shield-insurance.webp 113w,\n/static/12a9f2eabb7e883c4f03074601938551/975bf/Shield-insurance.webp 225w,\n/static/12a9f2eabb7e883c4f03074601938551/b8a88/Shield-insurance.webp 450w,\n/static/12a9f2eabb7e883c4f03074601938551/761da/Shield-insurance.webp 675w,\n/static/12a9f2eabb7e883c4f03074601938551/210c1/Shield-insurance.webp 900w,\n/static/12a9f2eabb7e883c4f03074601938551/f1e40/Shield-insurance.webp 2400w","sizes":"(max-width: 450px) 100vw, 450px"}}}},"author":{"id":"765e8417-7ed6-55b7-95a7-1d561141e760","name":"Sudarshan Pisupati"}}},{"node":{"id":"e68006e7-ad47-5422-b7f1-7966cba61573","title":"Finding active defense opportunities in a pentest report","content":"\n

Pentest reports tell a story. The story of how the team managed to break into your environment. In my experience, a critical component usually missing from these reports is the rationale behind the choices made by the pentesters who ran the assessment.

\n\n\n\n\n\n\n\n

Asking why allows you to deconstruct choices that real threat actors might make in your environment. Having a sense of those choices will give you some active defense opportunities.

\n\n\n\n

Let me demonstrate this with a little thought experiment. Let’s consider a pentest where the objective was to demonstrate access to the customer database. Here’s what the pentesters broadly did:

\n\n\n\n
  1. Established a C2 using PowerShell.
  2. Enumerated the Active Directory domain for users and groups, specifically privileged groups.
  3. Enumerated the domain to find computers.
  4. Attempted privilege escalation techniques and compromised the domain admin.
  5. Scanned a subset of computers to identify the customer DB.
  6. Used the domain admin account to login to the database server.
  7. Logged into the Customer DB.
\n\n\n\n

In each of these steps, the pentesters made some choices. As you’ll now see, deconstructing these choices can help build better defenses.

\n\n\n\n

Deconstructing the pentest report to find Active Defense plays

\n\n\n\n

The Active Defense matrix was released by MITRE to provide a framework for identifying opportunities where adversary behavior can be influenced to enable defenders to easily spot threats.

\n\n\n\n

The foundation of the Active Defense approach rests on three principles:

\n\n\n\n
  1. Beat the human behind the software
  2. Do simple things the adversary does not anticipate to encourage or complicate their operation.
  3. Make sure the things you do allows the corresponding telemetry to stand out i.e. collect more effective telemetry.
\n\n\n\n

So let’s begin by deconstructing each of the 7 steps in the report to identify Active Defense opportunities

\n\n\n\n

#1 – C2 using PowerShell

\n\n\n\n

Why PowerShell? 

\n\n\n\n
  1. Sophisticated off the shelf tooling
  2. PowerShell logging & blocking not widely implemented
  3. Great obfuscation capabilities
\n\n\n\n

Active Defense Opportunity

\n\n\n\n

Block PowerShell to force the adversary to use non-PowerShell options.

\n\n\n\n

Advantage

\n\n\n\n

Since PowerShell usage for C2 is fairly common, it reduces the risk of being hit with commodity malware that uses PowerShell even today.

\n\n\n\n

MITRE Shield Technique: Security Controls

\n\n\n\n

#2 – Enumerated the domain for users and groups

\n\n\n\n

Why enumerate the users?

\n\n\n\n
  1. Find privileged group members of groups like Domain and Enterprise Admin. Successful compromise of DA / EA will almost certainly result in customer DB access down the line, so it’s important to know who they are.
  2. Run keyword searches across attributes like username, SPN, description, etc. to find accounts that can be used for SQL logins. Example ‘SQL’, ‘DB’, ‘etc’. This will be useful down the line when it’s time to figure out how to login to the database, regardless of whether you have domain admin credentials or not.
\n\n\n\n

Active Defense Opportunity

\n\n\n\n

Setup attractive decoy accounts, assign attractive privileges, and setup attribute level auditing on description, SPN, etc. to monitor enumeration attempts. This has the added advantage of detecting password spraying regardless of intensity and staggering strategies.

\n\n\n\n

Advantage

\n\n\n\n

Gain insight into enumeration activities being conducted against the domain from a user perspective.

\n\n\n\n

(Note: Don’t ever use these accounts for any operations. There are ways to make this opsec safe)

\n\n\n\n

MITRE Shield Technique: Decoy Account

\n\n\n\n

#3 – Enumerated the domain for computers

\n\n\n\n

Why enumerate the computers?

\n\n\n\n
  1. Run keyword searches across attributes like hostname, SPN, description, etc. to find accounts that could be SQL servers. Example ‘SQL’, ‘DB’, ‘etc’. This will be useful down the line when it’s time to figure out where the DB is located.
\n\n\n\n

Active Defense Opportunity

\n\n\n\n

Setup decoy computers, assign attractive hostnames to databases, and setup attribute level auditing on description, SPN, etc. to monitor enumeration attempts.

\n\n\n\n

Advantage

\n\n\n\n

Gain insight into enumeration activities being conducted against the domain from a computer perspective.

\n\n\n\n

MITRE Shield Technique: Decoy System

\n\n\n\n

#4 – Privilege Escalation

\n\n\n\n

Why Privilege Escalation?

\n\n\n\n
  1. Get to a higher level of privilege. In this case, the target privilege level is the database/server administrator on the customer database.
  2. Escalated privileges can allow you admin access to one, few, many, or all systems on the network.
  3. With high privileges, you have the opportunity to log in to more systems and steal credentials.
\n\n\n\n

Let’s assume that Kerberoasting was the privilege escalation technique that worked. In this case, let’s also assume that the service account was a domain admin.

\n\n\n\n

Why Kerberoasting?

\n\n\n\n
  1. It targets service accounts i.e. accounts that have an SPN attribute configured.
  2. Service account passwords never expire.
  3. Sometimes, service accounts are granted DA privileges. At the very least, they have admin privileges somewhere.
  4. Some service accounts are so old that no one remembers they exist and have weak passwords.
  5. It’s really difficult to detect on the wire.
  6. Logs related to service ticket operations are not logged by default. If they are, it is difficult to tell the difference between legitimate and malicious service ticket operations.
\n\n\n\n

Active Defense Opportunity

\n\n\n\n
  1. Setup a decoy kerberoastable account, assign attractive usernames to databases (e.g. SQLAdmin), add a SQL-related SPN (e.g. MSSQLSvc/custdb.domain.com), and write a rule to capture Event ID 4769 for the decoy account.
  2. Remove the real domain admin service account from being kerberoastable or downgrade its privileges.
\n\n\n\n

Advantage

\n\n\n\n

Makes the adversary believe they have obtained hashes to the customer database SQL service account while at the same time removing the risk of kerberoasting a real domain admin account.

\n\n\n\n

A similar approach can be used for other popular privilege escalation techniques.

\n\n\n\n
  1. Tomcat Manager exploit – Plan a decoy system with Tomcat manager and monitor for connections and interactions towards this system.
  2. LLMNR poisoning – Use a tool like Conveigh to send decoy broadcasts over the subnet and monitor for responses to these broadcasts.
  3. Credential Dumping – Use Invoke-runas to plant fake domain admin credentials in memory using the /netonly technique.
\n\n\n\n

There are many techniques available for privilege escalation, and some of them lend themselves well to an Active Defense approach. However, in cases where that doesn’t work, focus on what the adversary intends to accomplish with those privileged credentials.

\n\n\n\n

MITRE Shield Technique: Decoy Account, Decoy System, Security Controls

\n\n\n\n

#5 – Scanned a subset of computers to identify the customer DB

\n\n\n\n

Why Scan?

\n\n\n\n
  1. Check if the database server is reachable from the target list compiled in #3.
  2. Check if the database port is open.
  3. Check if any banners reveal which might be the customer database.
  4. Check for default passwords on SQL servers for the ‘sa’ account.
\n\n\n\n

Active Defense Opportunities

\n\n\n\n
  1. Plant a decoy SQL server on the network. Alert when you see port enumeration.
  2. Make the real customer database accessible only from certain machines.
\n\n\n\n

Advantage

\n\n\n\n

Even a single port query against the decoy SQL server system is worth investigating while complicating access to the real customer database.

\n\n\n\n

MITRE Shield Technique: Network Diversity, Decoy Diversity, Network Manipulation

\n\n\n\n

#6 – Used the domain admin account to login to the customer database server

\n\n\n\n

Why log in to the customer database server?

\n\n\n\n
  1. With domain admin privileges, you can extract credentials from memory from the customer database.
  2. Helps you compromise the logged-on SQL administrator account (whether it’s a user or service doesn’t matter).
\n\n\n\n

Active Defense Opportunities

\n\n\n\n
  1. Implement a standard operating procedure to prevent a domain admin from ever logging into the database server. Implement the corresponding rule for this server alone in your SIEM.
  2. Plant decoy SQL administrator credentials in memory.
\n\n\n\n

Advantage

\n\n\n\n

Even a single port query against the decoy SQL server system is worth investigating while complicating access to the real customer database

\n\n\n\n

MITRE Shield Technique: Standard Operating Procedure, Decoy Credentials

\n\n\n\n

#7 – Login to the database itself

\n\n\n\n

Unfortunately, if the adversary has reached this point, detection difficulty increases. This is because, from an analytics perspective, you are looking for a legitimate account, logging into a legitimate database, and running possibly legitimate queries. However, there are still things we can do.

\n\n\n\n

Active Defense Opportunities

\n\n\n\n
  1. Setup query auditing on the SQL server for accounts with DB admin rights.
  2. Hunt for non-standard queries in the hope of spotting the adversary running ‘select *’ operations and join operations to fully extract the customer database.
\n\n\n\n

MITRE Shield Technique: Hunting, System Activity Monitoring

\n\n\n\n

Apply Active Defense Approach to any use case

\n\n\n\n

I present an abstracted approach to applying Active Defense use cases. It has 4 pieces:

\n\n\n\n
  1. Deceive – Can I do something to trick the adversary en route to/on the system?
  2. Standardize – Can I define how a particular system must be used/controlled?
  3. Analyze – Can I bubble-up anomalies against the system I am protecting?
  4. Control – Can I make it more difficult to reach and compromise the system?
\n\n\n\n

You can use the above as a combination to assess a use case beyond just analyzing pentest reports. The pentest report was just a means for me to present my idea.

\n\n\n\n

Closing Notes

\n\n\n\n

I would like you to note a few things.

\n\n\n\n
  1. Use of the Active Defense approach covers the kill-chain and encourages you to think about the ‘why’ to build better defenses and how your network, endpoints, and active directory are all interconnected.
  2. It reduces complexity otherwise introduced by large scale data analytics across GBs of logs a day.
  3. The active defense approach is not limited to decoys alone, but it is a significant component.
  4. You don’t have to baseline and standardize operating procedures across everything. Just the stuff that matters to you.
  5. You can tighten your hunt use cases with Active Defense, making hunting a lot more productive.
  6. You can take a targeted approach to apply controls, rather than spray controls all over the network that costs time and requires effort.
\n","excerpt":"Pentest reports tell a story. By asking why a pentester made certain choices, you can find opportunities to influence attacker behavior and actively defend your network.\n","slug":"finding-active-defense-opportunities-in-a-pentest-report","date":"2021-01-24T16:36:47.000Z","status":"publish","modified":"2021-02-01T04:52:23.000Z","wordpress_id":18707,"featured_media":{"id":"c2327fb5-d82c-5803-a242-8195b7731a09","source_url":"https://ss-website-content-prod.s3.ap-south-1.amazonaws.com/wp-content/uploads/2021/01/Finding-active-defense-opportunities.jpeg","alt_text":"active defense opportunities","large":{"childImageSharp":{"fluid":{"base64":"data:image/jpeg;base64,/9j/2wBDABALDA4MChAODQ4SERATGCgaGBYWGDEjJR0oOjM9PDkzODdASFxOQERXRTc4UG1RV19iZ2hnPk1xeXBkeFxlZ2P/2wBDARESEhgVGC8aGi9jQjhCY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2P/wgARCAANABQDASIAAhEBAxEB/8QAGAAAAgMAAAAAAAAAAAAAAAAAAAMBAgX/xAAUAQEAAAAAAAAAAAAAAAAAAAAB/9oADAMBAAIQAxAAAAHBIYiiwP8A/8QAGBABAQEBAQAAAAAAAAAAAAAAAQIAEBH/2gAIAQEAAQUCzKdm2cvr/8QAFBEBAAAAAAAAAAAAAAAAAAAAEP/aAAgBAwEBPwE//8QAFBEBAAAAAAAAAAAAAAAAAAAAEP/aAAgBAgEBPwE//8QAGBAAAgMAAAAAAAAAAAAAAAAAAAERICH/2gAIAQEABj8Crig//8QAHBABAAEEAwAAAAAAAAAAAAAAAQARITFREEFh/9oACAEBAAE/IQHyAVpbfODudjiEqA0T/9oADAMBAAIAAwAAABB8D//EABQRAQAAAAAAAAAAAAAAAAAAABD/2gAIAQMBAT8QP//EABcRAAMBAAAAAAAAAAAAAAAAAAEQEUH/2gAIAQIBAT8QE1f/xAAbEAEAAgIDAAAAAAAAAAAAAAABABExcRBBkf/aAAgBAQABPxBml2gBK+Bh5vBi4drZGyruUPZ//9k=","aspectRatio":1.5037593984962405,"src":"/static/7db01658f4566de6549893fda89ba90f/14b42/Finding-active-defense-opportunities.jpg","srcSet":"/static/7db01658f4566de6549893fda89ba90f/f836f/Finding-active-defense-opportunities.jpg 200w,\n/static/7db01658f4566de6549893fda89ba90f/2244e/Finding-active-defense-opportunities.jpg 400w,\n/static/7db01658f4566de6549893fda89ba90f/14b42/Finding-active-defense-opportunities.jpg 800w,\n/static/7db01658f4566de6549893fda89ba90f/47498/Finding-active-defense-opportunities.jpg 1200w,\n/static/7db01658f4566de6549893fda89ba90f/0e329/Finding-active-defense-opportunities.jpg 1600w,\n/static/7db01658f4566de6549893fda89ba90f/eeda9/Finding-active-defense-opportunities.jpg 1650w","srcWebp":"/static/7db01658f4566de6549893fda89ba90f/58556/Finding-active-defense-opportunities.webp","srcSetWebp":"/static/7db01658f4566de6549893fda89ba90f/61e93/Finding-active-defense-opportunities.webp 200w,\n/static/7db01658f4566de6549893fda89ba90f/1f5c5/Finding-active-defense-opportunities.webp 400w,\n/static/7db01658f4566de6549893fda89ba90f/58556/Finding-active-defense-opportunities.webp 800w,\n/static/7db01658f4566de6549893fda89ba90f/99238/Finding-active-defense-opportunities.webp 1200w,\n/static/7db01658f4566de6549893fda89ba90f/7c22d/Finding-active-defense-opportunities.webp 1600w,\n/static/7db01658f4566de6549893fda89ba90f/36d36/Finding-active-defense-opportunities.webp 1650w","sizes":"(max-width: 800px) 100vw, 800px"}}},"medium":{"childImageSharp":{"fluid":{"base64":"data:image/jpeg;base64,/9j/2wBDABALDA4MChAODQ4SERATGCgaGBYWGDEjJR0oOjM9PDkzODdASFxOQERXRTc4UG1RV19iZ2hnPk1xeXBkeFxlZ2P/2wBDARESEhgVGC8aGi9jQjhCY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2P/wgARCAANABQDASIAAhEBAxEB/8QAGAAAAgMAAAAAAAAAAAAAAAAAAAMBAgX/xAAUAQEAAAAAAAAAAAAAAAAAAAAB/9oADAMBAAIQAxAAAAHBIYiiwP8A/8QAGBABAQEBAQAAAAAAAAAAAAAAAQIAEBH/2gAIAQEAAQUCzKdm2cvr/8QAFBEBAAAAAAAAAAAAAAAAAAAAEP/aAAgBAwEBPwE//8QAFBEBAAAAAAAAAAAAAAAAAAAAEP/aAAgBAgEBPwE//8QAGBAAAgMAAAAAAAAAAAAAAAAAAAERICH/2gAIAQEABj8Crig//8QAHBABAAEEAwAAAAAAAAAAAAAAAQARITFREEFh/9oACAEBAAE/IQHyAVpbfODudjiEqA0T/9oADAMBAAIAAwAAABB8D//EABQRAQAAAAAAAAAAAAAAAAAAABD/2gAIAQMBAT8QP//EABcRAAMBAAAAAAAAAAAAAAAAAAEQEUH/2gAIAQIBAT8QE1f/xAAbEAEAAgIDAAAAAAAAAAAAAAABABExcRBBkf/aAAgBAQABPxBml2gBK+Bh5vBi4drZGyruUPZ//9k=","aspectRatio":1.5066666666666666,"src":"/static/7db01658f4566de6549893fda89ba90f/32fd5/Finding-active-defense-opportunities.jpg","srcSet":"/static/7db01658f4566de6549893fda89ba90f/06e94/Finding-active-defense-opportunities.jpg 113w,\n/static/7db01658f4566de6549893fda89ba90f/07ab6/Finding-active-defense-opportunities.jpg 225w,\n/static/7db01658f4566de6549893fda89ba90f/32fd5/Finding-active-defense-opportunities.jpg 450w,\n/static/7db01658f4566de6549893fda89ba90f/4a838/Finding-active-defense-opportunities.jpg 675w,\n/static/7db01658f4566de6549893fda89ba90f/9842e/Finding-active-defense-opportunities.jpg 900w,\n/static/7db01658f4566de6549893fda89ba90f/eeda9/Finding-active-defense-opportunities.jpg 1650w","srcWebp":"/static/7db01658f4566de6549893fda89ba90f/b8a88/Finding-active-defense-opportunities.webp","srcSetWebp":"/static/7db01658f4566de6549893fda89ba90f/3a3bf/Finding-active-defense-opportunities.webp 113w,\n/static/7db01658f4566de6549893fda89ba90f/975bf/Finding-active-defense-opportunities.webp 225w,\n/static/7db01658f4566de6549893fda89ba90f/b8a88/Finding-active-defense-opportunities.webp 450w,\n/static/7db01658f4566de6549893fda89ba90f/761da/Finding-active-defense-opportunities.webp 675w,\n/static/7db01658f4566de6549893fda89ba90f/210c1/Finding-active-defense-opportunities.webp 900w,\n/static/7db01658f4566de6549893fda89ba90f/36d36/Finding-active-defense-opportunities.webp 1650w","sizes":"(max-width: 450px) 100vw, 450px"}}}},"author":{"id":"765e8417-7ed6-55b7-95a7-1d561141e760","name":"Sudarshan Pisupati"}}},{"node":{"id":"e7f2f716-139d-5a7e-b47a-a996bcfc50f1","title":"Four MITRE Shield Techniques You Can Implement in 2021","content":"\n

For free, of course.

\n\n\n\n

At this point, I’m positive that you’ve heard of MITRE Shield. It’s a new active defense knowledge base released by MITRE – stuff they’ve been implementing for over a decade to engage adversaries and derail attacks. They’ve opened it up to everyone, and for the first time perhaps, the infosec community has a shared vocabulary and framework for actively defending against attacks instead of reacting to them.

\n\n\n\n

I’ve been having conversations about MITRE Shield and Active Defense with CISOs and customers. While some of the conversations are basic and around what is active defense and why does it matter, what I consistently hear from across the board is – “how do we even begin to implement this stuff?” That’s a fair question, but it’s only one part. What more folks aren’t asking is, where do we implement active defenses for the most impact.

\n\n\n\n

I’ve zeroed down on four active defense techniques from the MITRE Shield matrix that address both the questions – how do I get started with this and where should I be building active defenses first. Think of this as a soft launch guide for your Active Defense journey.

\n\n\n\n

I’ve selected techniques based on two factors:

\n\n\n\n
  1. Should be easy to implement without involving too many teams.
  2. Should have a very high impact on disrupting adversary actions.
\n\n\n\n

As a result, all four defenses are Active Directory exclusive. Active Directory has become an adversary favorite attack vector. By deploying active defenses in Active Directory, you’ll be able to make great strides in disrupting adversary actions.

\n\n\n\n

Are there any prerequisites?

\n\n\n\n

Only two:

\n\n\n\n
  1. You must be able to make some minor changes to your Active Directory server.
  2. You must have access to a test machine. This could be your own machine or one that’s given to you. It would be great if this machine was not network access restricted in any way to maximize engagement.
\n\n\n\n

Let’s dive right in.

\n\n\n\n

MITRE Shield Technique #1 – Decoy Account

\n\n\n\n

MITRE Shield Procedure – DPR002

\n\n\n\n

Plant decoy accounts in your Active Directory. Any interaction with these accounts is a high-confidence indicator of compromise. These accounts will also help you study the adversary’s actions, mislead attackers by putting these accounts in their path during enumeration, and use them to influence the attacker’s actions and next steps.

\n\n\n\n

Step 1 – Use case setup

\n\n\n\n

Set up a decoy account and give it “Domain Admin” privileges. This will make the account interesting to the adversary. 

\n\n\n\n
\n\n\n\n

Step 2 – Auditing Setup and Attack Demo

\n\n\n\n

In this video, we focus on detecting the operation. We show how to setup Windows Auditing so that we can capture the appropriate log. We also demonstrate an attack to test if the logs are captured appropriately.

\n\n\n\n
\n\n\n\n

Psuedo-code for detection rule:

\n\n\n\n
If login_activity observed for decoy_account then raise a high priority alert.
\n\n\n\n

MITRE Shield Technique #2 – Decoy Systems and Decoy Content

\n\n\n\n

MITRE Shield Procedures – DPR0022 and DPR0033

\n\n\n\n

Decoy systems are an excellent active defense tool because they act as a target to lure away attackers from legitimate assets. Decoy content could be anything ranging from fake files to browser shortcuts that act as breadcrumbs to point adversaries to decoy systems.

\n\n\n\n

Step 1 – Use Case Setup

\n\n\n\n

In this video, we set up a webserver on our test machine to channel an adversary towards interacting with it. We create a browser shortcut and place it in a publically accessible location on the Active Directory Server to make it easier for the adversary to discover.

\n\n\n\n
\n\n\n\n

Step 2 – Auditing Setup and Attack Demo

\n\n\n\n

We ensure that our web server is logging connections. If an adversary attempts to conduct reconnaissance against this webserver, we should see a logline in the webserver log.

\n\n\n\n
\n\n\n\n

Psuedo-code for detection rule:

\n\n\n\n
If REQUEST observed for /admin then raise a high priority alert.
\n\n\n\n

MITRE Shield Technique #3 – Decoy Credentials

\n\n\n\n

MITRE Shield Procedure – DPR0024

\n\n\n\n

Decoy credentials are fake usernames and passwords that can be planted in a variety of places including in the Active Directory. They act as silent alarms when interacted with and also as a means to delay the attacker.

\n\n\n\n

Step 1 – Use Case Setup

\n\n\n\n

In this video, we create a batch file planted with fake credentials and store it in a publically accessible location on the Active Directory Server to make it easier for the adversary to discover.

\n\n\n\n
\n\n\n\n

Step 2 – Auditing Setup and Attack Demo

\n\n\n\n

In this video, we show how to set up auditing on your test machine to capture attempts to use the credentials against your test machine.

\n\n\n\n
\n\n\n\n

Psuedo-code for detection rule:

\n\n\n\n
If login_event is 4625 AND username is admin
Then raise a high priority alert.
\n\n\n\n

MITRE Shield Technique 4 – Pocket Litter

\n\n\n\n

MITRE Shield Procedure – DPR0052

\n\n\n\n

Pocket litter is an active defense technique used to mislead attackers into thinking that the system and user they’re exploiting are legit. You plant fake documents, browser history, browser sessions, etc. to give adversaries the confidence that they are on the right track.

\n\n\n\n

Step 1 – Use Case Setup

\n\n\n\n

In this video, we will set up a file share on the test machine. We will plant a shortcut to this file share in a publically accessible location on the Active Directory Server to make it easier for the adversary to discover.

\n\n\n\n
\n\n\n\n

Step 2 – Auditing Setup and Attack Demo

\n\n\n\n

In this video, we show how to set up file share auditing on your test machine to capture attempts to access the file share on your machine.

\n\n\n\n
\n\n\n\n

Psuedo-code for detection rule:

\n\n\n\n
If login_event is 5140 AND share_name contains shared_folder_name\nThen raise a high priority alert.
\n\n\n\n

Why have you chosen the SYSVOL folder in your videos?

\n\n\n\n

These folders are accessible to all users within your environment. Over time, these folders accrue a lot of files and scripts that are interesting to adversaries. We wish to use these folders to misdirect the attacker, should the attacker go browsing through these folders. It is also uncommon for regular users to require to browse through this folder.

\n\n\n\n

Closing Notes

\n\n\n\n

The focus of this guide was to get your mind thinking about active defense. If there’s one thing I’d like you to walk away with, it’s that if any of these defenses trigger an alarm you will have discovered malicious activity for a couple of hours of effort. And it cost you nothing.

\n\n\n\n

At Smokescreen, we’ve been implementing active defense programs since before it was a thing. No wonder then that Smokescreen covered 95% of MITRE Shield when it launched in Sep 2020. If you’d like to see how we can help, hit us up. Here’s a mapping of Smokescreen to MITRE Shield if it’s helpful.

\n\n\n\n

We’re also running active defense workshops where we deconstruct MITRE Shield and talk about how you can implement it. Feel free to sign up.

\n","excerpt":"For free, of course. At this point, I’m positive that you’ve heard of MITRE Shield. It’s a new active defense knowledge base released by MITRE – stuff they’ve been implementing for over a decade to engage adversaries and derail attacks. They’ve opened it up to everyone, and for the first time perhaps, the infosec community […]\n","slug":"four-mitre-shield-techniques-you-can-implement-in-2021","date":"2020-12-30T16:48:39.000Z","status":"publish","modified":"2021-02-03T07:14:04.000Z","wordpress_id":18652,"featured_media":{"id":"3b48d9b0-598d-52ec-92d7-1eef58be5ea8","source_url":"https://ss-website-content-prod.s3.ap-south-1.amazonaws.com/wp-content/uploads/2020/12/Smokescreen-MITRE-Shield-Techniques.png","alt_text":"Smokescreen-MITRE-Shield-Techniques","large":{"childImageSharp":{"fluid":{"base64":"data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAABQAAAALCAYAAAB/Ca1DAAAACXBIWXMAAAsTAAALEwEAmpwYAAACQklEQVQoz0WSSW8TQRCF84s5IXFBHJEQ4g9wQggOkbhEBEEIS4xDMkZeEhzH8SITJ+N4tu4Zz+6xncerceIcamq6W/11Vb23ZU8mULYN33UxUx5mWsHXGjPfRxgECGezh+Ba9gOea8+Dchy4lgXn5gbCsUwTW/IZXHTR6w/RG11jMrV5mRcJiKIIcRw/BNdRGJZggfpKbaAboDkew6hWcWg0YHRGuDQtFFmKPMuQpSmSJEHKSEooH4jC8sHAlypdeLZF4HRT5ZbFn9HlGOOrK5gTEybXJl+8NDkK7SPP8xKWpMzZkrlgXjBWPFshZQ7DpISWwBuWuf3lKz7sf8f23jd8rBxit/obe8c1NLoXmOcZUsLiyIY3rUG755z5KbRlINZt5MEJVrkFz9UEmmvgzo8D7Faq2Cdk5+AXPlWPcNg6RWc4YtsJsjmQWAfQJ0/gd1/Bbz+D138L3XkO1XyE1PoJpWICr9ctN9pnaHXOcdYfoHXRw1/m7ugfivmcs0yR5bdInD8I2k+he68RCHT4Dqr3Brr1GJl7TGC0BopCmkoFVEwsEVNFmVnKEKWlwpSzy/0zJP0XSNw6YqeBePIZyfg90sFLFH4DygvvKmTL1UoFNcPA8dERDOZms4l6vY4Jh1wqTfi8KLBY3qIo5igWQLFkyN5ixVhQbXstijOlOgyXG4rmLk19Z+gsE0HW1pFqg4CmZhc+za/EMuzMEQ+KZe5tI/4Rujg/uIOJee/NLLCNFxmyJ+ez0tyKqrvlfeFIt/8BWgssJrC5KxYAAAAASUVORK5CYII=","aspectRatio":1.9047619047619047,"src":"/static/edada2176ce537fff9fc98c912eee812/ee604/Smokescreen-MITRE-Shield-Techniques.png","srcSet":"/static/edada2176ce537fff9fc98c912eee812/69585/Smokescreen-MITRE-Shield-Techniques.png 200w,\n/static/edada2176ce537fff9fc98c912eee812/497c6/Smokescreen-MITRE-Shield-Techniques.png 400w,\n/static/edada2176ce537fff9fc98c912eee812/ee604/Smokescreen-MITRE-Shield-Techniques.png 800w,\n/static/edada2176ce537fff9fc98c912eee812/f3583/Smokescreen-MITRE-Shield-Techniques.png 1200w,\n/static/edada2176ce537fff9fc98c912eee812/5707d/Smokescreen-MITRE-Shield-Techniques.png 1600w,\n/static/edada2176ce537fff9fc98c912eee812/0ef64/Smokescreen-MITRE-Shield-Techniques.png 2400w","srcWebp":"/static/edada2176ce537fff9fc98c912eee812/58556/Smokescreen-MITRE-Shield-Techniques.webp","srcSetWebp":"/static/edada2176ce537fff9fc98c912eee812/61e93/Smokescreen-MITRE-Shield-Techniques.webp 200w,\n/static/edada2176ce537fff9fc98c912eee812/1f5c5/Smokescreen-MITRE-Shield-Techniques.webp 400w,\n/static/edada2176ce537fff9fc98c912eee812/58556/Smokescreen-MITRE-Shield-Techniques.webp 800w,\n/static/edada2176ce537fff9fc98c912eee812/99238/Smokescreen-MITRE-Shield-Techniques.webp 1200w,\n/static/edada2176ce537fff9fc98c912eee812/7c22d/Smokescreen-MITRE-Shield-Techniques.webp 1600w,\n/static/edada2176ce537fff9fc98c912eee812/f1e40/Smokescreen-MITRE-Shield-Techniques.webp 2400w","sizes":"(max-width: 800px) 100vw, 800px"}}},"medium":{"childImageSharp":{"fluid":{"base64":"data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAABQAAAAKCAYAAAC0VX7mAAAACXBIWXMAAAsTAAALEwEAmpwYAAACFUlEQVQoz02SS0/bQBSF83f7A7rprpt22S5bqbtu6KpqEaiKUAuEgAgJIQhC0jyI4zi249f4NbZj0OkZJ0pZXM3Ynvl87rmnZhsGTF2HNp1iPtehGyZc10UoBKIwRBzHSLal9lEUVd+E7yPgOW+1gmNZUBxrsUBttVxWsItGA832LVr9R9iOhyKTyLMMaZruSqYx0oTwKEQkAgSeQ6BFoAnFUdBapZA1nkwxnc0w518WpgndtFgmshfQKF0jTApWDhGvkcgSMnumarlTWXN5aULY96Pf+PHnBAeNJg7OznHcucb+aRO261FpjlSmEF4fwh2w3TGE00UiBpDiDqVcwuM522DLLskTtvztVx37x6c4JHCvfoTD5gXOuj2sFDAv2K5AeP8Wwd17iNs38AafETx8QNB5BWn8hO/HBOobDy3W/fAvxjMNY22O4eMMQ+59mv/8VFJdhkxyIA/v4PUJGX5CMPiIYPQVfvc1pH0C34s2CiszWYamwaR/yk/XtuFzgg4nGIaCPuasFIWxh8w6QhbNkdgt7uvItS8oRYfAcAukhwvCri4vcd1u46rVQu/mBr1eD6PRqIqKlLIaSlECWfGELC+54v+areFQxG7KDqEqU2EQIGbO0iRhi5vYKJgkLOG7iGqVYhGoyDCDzqqKjL3tsgKqMKoHNXYV0sDzqgtVqAlXoJdZVM/qfbQNt7JGWVTNgqx/v9rh65njvVwAAAAASUVORK5CYII=","aspectRatio":1.9152542372881356,"src":"/static/edada2176ce537fff9fc98c912eee812/62b1f/Smokescreen-MITRE-Shield-Techniques.png","srcSet":"/static/edada2176ce537fff9fc98c912eee812/e7519/Smokescreen-MITRE-Shield-Techniques.png 113w,\n/static/edada2176ce537fff9fc98c912eee812/7e7e9/Smokescreen-MITRE-Shield-Techniques.png 225w,\n/static/edada2176ce537fff9fc98c912eee812/62b1f/Smokescreen-MITRE-Shield-Techniques.png 450w,\n/static/edada2176ce537fff9fc98c912eee812/e2e7f/Smokescreen-MITRE-Shield-Techniques.png 675w,\n/static/edada2176ce537fff9fc98c912eee812/db955/Smokescreen-MITRE-Shield-Techniques.png 900w,\n/static/edada2176ce537fff9fc98c912eee812/0ef64/Smokescreen-MITRE-Shield-Techniques.png 2400w","srcWebp":"/static/edada2176ce537fff9fc98c912eee812/b8a88/Smokescreen-MITRE-Shield-Techniques.webp","srcSetWebp":"/static/edada2176ce537fff9fc98c912eee812/3a3bf/Smokescreen-MITRE-Shield-Techniques.webp 113w,\n/static/edada2176ce537fff9fc98c912eee812/975bf/Smokescreen-MITRE-Shield-Techniques.webp 225w,\n/static/edada2176ce537fff9fc98c912eee812/b8a88/Smokescreen-MITRE-Shield-Techniques.webp 450w,\n/static/edada2176ce537fff9fc98c912eee812/761da/Smokescreen-MITRE-Shield-Techniques.webp 675w,\n/static/edada2176ce537fff9fc98c912eee812/210c1/Smokescreen-MITRE-Shield-Techniques.webp 900w,\n/static/edada2176ce537fff9fc98c912eee812/f1e40/Smokescreen-MITRE-Shield-Techniques.webp 2400w","sizes":"(max-width: 450px) 100vw, 450px"}}}},"author":{"id":"765e8417-7ed6-55b7-95a7-1d561141e760","name":"Sudarshan Pisupati"}}},{"node":{"id":"9d8a2f78-f1ee-581e-957c-2092fc5a0b66","title":"Active Defense – Incident Response’s New Best Friend","content":"\n

On Sep 14, 2020, MITRE, the federally funded R&D organization perhaps best known for its popular ATT&CK framework, announced Shield – an Active Defense knowledge base developed to arm cybersecurity defenders with a framework for actively dealing with threats instead of passively reacting to them. As MITRE puts it, Shield has been “derived from over 10 years of adversary engagement experience. It spans the range from high level, CISO ready considerations of opportunities and objectives, to practitioner friendly discussions of the TTPs available to defenders.”

\n\n\n\n

As an industry armed with protecting networks and IT infrastructures, we have been overly reliant on passive defenses. Given the rapid pace of technology development, shortage of skilled cybersecurity professionals, and the vendor community’s ‘assume breach’ schtick, we have become accustomed to dealing with threats on our turf, on the adversary’s terms, instead of actively smoking out the threat. We’re always reacting after the fact. Which is why Shield couldn’t have arrived sooner.

\n\n\n\n

Since then, I’ve had countless conversations with CISOs attempting to understand how Shield can inform their security posture and incident handlers/practitioners on what they can do today that might have an outsized impact on their ability to defend. I’ve also realized that there’s a fundamental conversation to be had about what ‘active defense’ in cybersecurity means, and why teams must adopt it as an integral part of their security program and best practices.

\n\n\n\n

Over the last 10 years, I have been a part of multiple incident response projects. The story usually unfolds in a similar fashion – evidence of compromise is on the network. Jump to the ‘Cotton Eye Joe’ problem – where did it come from, where does it go. And of course, what did it damage.

\n\n\n\n

Perhaps the most high-pressure scenarios are those where the threat is not just active but is actively moving around the network, say something like ransomware. Machine after machine is getting infected, and there is nothing you can do to stop it.

\n\n\n\n

Consider this nightmare scenario for a moment. You work security for a business with 1000 employees. You don’t have an anti-virus (AV) installed (hypothetical). You have been infected by ransomware. You immediately take a call to purchase an AV, the budget gets freed up, and you go to procure it. But it takes days, even weeks if not months to procure it and push it out to every single workstation and server. Your AV has now future proof-ed you in some way, but the adversary has already finished her attack. You are recovering from the disaster in some form. Maybe you are restoring backups. Maybe you just paid up the ransom. The response was required in minutes and hours. That battle was lost.

\n\n\n\n

The fallouts of such incidents can be brutal. There is intense pressure on security teams, and they carry heavy burdens. I have seen security folks stay up 96 hours at a stretch, trying to squeeze in a couple of minutes of sleep in offices amid thousands of messages, texts, and calls. I have seen top management in companies get involved and ask tough questions to which there are no good answers.

\n\n\n\n

If you are involved in any security function in your organization, at any level, this should be relatable. To some, something like this might have happened recently. For some, it’s been a while. And if it hasn’t happened to you yet, chances are, it will happen at some point – sooner rather than later.

\n\n\n\n

And then let’s talk money. It costs a lot of money. I’m talking serious cash. In the order of hundreds of thousands of dollars. All being spent in a matter of days. You are paying your vendors, service providers, advisors, and implementers. You are paying by the hour for everyone involved in the response, IT teams, security teams, and active directory teams. And then people wonder why cybersecurity is a $123 billion industry.

\n\n\n\n

It gets chaotic.

\n\n\n\n

In my experience, you can contain that chaos with an Active Defense mindset.

\n\n\n\n

Active defense isn’t really a new concept. For example, the armed forces and police have active defense protocols. If intelligence picks up an impending threat, the machinery kicks in to reflect the seriousness of the threat. Intensified checking at posts, barricades across high-value locations and roads, enhanced protective measures for ministers and other high-value targets, orders to restrict the movement of people and goods, frequent patrolling – you get the drift.

\n\n\n\n

Now notice this strategy for a moment. It includes a lot of tough calls because the threat has a material impact on the life of civilians. There’s a protocol in place. Also, notice that the strategy doesn’t involve waiting for the bad guy to move around as he pleases. It actively tries to smoke the threat out. The alternative is to play catch up. Always one step behind the threat. Ring any bells? Of course, it does because that’s exactly what we do in cybersecurity. 

\n\n\n\n

What I’m getting to is that when you are in the midst of an incident, you have ways to try to smoke out the threat, make life difficult for the adversary, and minimize the impact of the breach. One that can be measured in days (if not hours), will not be as costly and will reign in panic.

\n\n\n\n

It involves barricades, restriction of movement, enhanced patrolling, and of course, protecting the crown jewels.

\n\n\n\n

Here’s how it might look like in a real-life ‘incident’:

\n\n\n\n\n\n\n\n

This is, of course, a non-exhaustive list but all of these can be really quick to do! The biggest impediment is usually taking the tough calls as this may temporarily and disrupt services. It also happens because of poor team communication across the board. It is because of this that we forgo a defensive advantage and chase the threat for days and months on end.

\n\n\n\n

But hey, if you drill this out before things go wrong, you will already know and understand what the impact is going to be.

\n\n\n\n

Think about it this way. You have an existing set of software defenses. That should make life difficult for the software tactics of the threat. Active defense is you putting additional software defenses to attack the human behind the threat.

\n\n\n\n

This brings me back to why MITRE Shield couldn’t have come sooner. For the first time, defenders have a shared vocabulary and framework for what they can proactively do to defend their networks. It even maps out to MITRE ATT&CK, telling you exactly which defense can disrupt an attack tactic. I strongly urge you to check out Shield.

\n\n\n\n

If you need help with understanding this more, we are running 30 mins workshops to deconstruct MITRE Shield and breakdown how you can get started with active defense. Feel free to sign up here.

\n\n\n\n

We have also released our mapping to MITRE Shield. With Smokescreen, you can achieve 95% coverage of all the active defense techniques included in the framework. You can get the mapping from here. And if you want to see all of this in action, you can always ask for a demo.

\n\n\n\n

I’m very excited about all the conversations that are happening around MITRE Shield. As we help our customers implement Shield and achieve more active defense coverage, I will be sharing what I learn. Feel free to hit me up on LinkedIn or Twitter.

\n","excerpt":"Active defense provides defenders with a shared vocabulary and framework for actively dealing with threats instead of passively reacting to them.\n","slug":"active-defense-for-incident-responders","date":"2020-12-29T01:34:46.000Z","status":"publish","modified":"2021-01-24T16:42:40.000Z","wordpress_id":18639,"featured_media":{"id":"b7c5bd0f-1190-59a5-8777-52cae2404171","source_url":"https://ss-website-content-prod.s3.ap-south-1.amazonaws.com/wp-content/uploads/2020/12/Smokescreen-Active-defense-blog-post-scaled.jpeg","alt_text":"Active defense","large":{"childImageSharp":{"fluid":{"base64":"data:image/jpeg;base64,/9j/2wBDABALDA4MChAODQ4SERATGCgaGBYWGDEjJR0oOjM9PDkzODdASFxOQERXRTc4UG1RV19iZ2hnPk1xeXBkeFxlZ2P/2wBDARESEhgVGC8aGi9jQjhCY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2P/wgARCAAeABQDASIAAhEBAxEB/8QAGAAAAwEBAAAAAAAAAAAAAAAAAAMEBQL/xAAXAQEBAQEAAAAAAAAAAAAAAAAAAQID/9oADAMBAAIQAxAAAAHhjmc9wlhS3Z1SVGcH/8QAHBAAAgICAwAAAAAAAAAAAAAAAAECEhETITFB/9oACAEBAAEFAoRNaKEevMF1Y4Fhu5sP/8QAFBEBAAAAAAAAAAAAAAAAAAAAIP/aAAgBAwEBPwEf/8QAFBEBAAAAAAAAAAAAAAAAAAAAIP/aAAgBAgEBPwEf/8QAGhAAAQUBAAAAAAAAAAAAAAAAEAABERIgIf/aAAgBAQAGPwLUDrqx/8QAHBABAQEAAgMBAAAAAAAAAAAAAQARITFBUWHh/9oACAEBAAE/ITMnIySLEeluZy5+yTG+W8Q46l+yCjkukofy/9oADAMBAAIAAwAAABCYLEP/xAAVEQEBAAAAAAAAAAAAAAAAAAAgIf/aAAgBAwEBPxCD/8QAFhEBAQEAAAAAAAAAAAAAAAAAEBFB/9oACAECAQE/EKaf/8QAHhABAAICAgMBAAAAAAAAAAAAAQARITFBYVGBkeH/2gAIAQEAAT8QGCBw41FZqumrH9hlpvRdSkYcahaBVVt47I2YepIiqF88TCrrUCEM6mvuO7dUFejqPTcf/9k=","aspectRatio":0.6644518272425249,"src":"/static/4cdd14b89e9545a1913f042df0c033ec/14b42/Smokescreen-Active-defense-blog-post-scaled.jpg","srcSet":"/static/4cdd14b89e9545a1913f042df0c033ec/f836f/Smokescreen-Active-defense-blog-post-scaled.jpg 200w,\n/static/4cdd14b89e9545a1913f042df0c033ec/2244e/Smokescreen-Active-defense-blog-post-scaled.jpg 400w,\n/static/4cdd14b89e9545a1913f042df0c033ec/14b42/Smokescreen-Active-defense-blog-post-scaled.jpg 800w,\n/static/4cdd14b89e9545a1913f042df0c033ec/47498/Smokescreen-Active-defense-blog-post-scaled.jpg 1200w,\n/static/4cdd14b89e9545a1913f042df0c033ec/0e329/Smokescreen-Active-defense-blog-post-scaled.jpg 1600w,\n/static/4cdd14b89e9545a1913f042df0c033ec/4f4f6/Smokescreen-Active-defense-blog-post-scaled.jpg 1700w","srcWebp":"/static/4cdd14b89e9545a1913f042df0c033ec/58556/Smokescreen-Active-defense-blog-post-scaled.webp","srcSetWebp":"/static/4cdd14b89e9545a1913f042df0c033ec/61e93/Smokescreen-Active-defense-blog-post-scaled.webp 200w,\n/static/4cdd14b89e9545a1913f042df0c033ec/1f5c5/Smokescreen-Active-defense-blog-post-scaled.webp 400w,\n/static/4cdd14b89e9545a1913f042df0c033ec/58556/Smokescreen-Active-defense-blog-post-scaled.webp 800w,\n/static/4cdd14b89e9545a1913f042df0c033ec/99238/Smokescreen-Active-defense-blog-post-scaled.webp 1200w,\n/static/4cdd14b89e9545a1913f042df0c033ec/7c22d/Smokescreen-Active-defense-blog-post-scaled.webp 1600w,\n/static/4cdd14b89e9545a1913f042df0c033ec/35cfd/Smokescreen-Active-defense-blog-post-scaled.webp 1700w","sizes":"(max-width: 800px) 100vw, 800px"}}},"medium":{"childImageSharp":{"fluid":{"base64":"data:image/jpeg;base64,/9j/2wBDABALDA4MChAODQ4SERATGCgaGBYWGDEjJR0oOjM9PDkzODdASFxOQERXRTc4UG1RV19iZ2hnPk1xeXBkeFxlZ2P/2wBDARESEhgVGC8aGi9jQjhCY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2P/wgARCAAeABQDASIAAhEBAxEB/8QAGAAAAwEBAAAAAAAAAAAAAAAAAAMEBQL/xAAXAQEBAQEAAAAAAAAAAAAAAAAAAQID/9oADAMBAAIQAxAAAAHhjmc9wlhS3Z1SVGcH/8QAHBAAAgICAwAAAAAAAAAAAAAAAAECEhETITFB/9oACAEBAAEFAoRNaKEevMF1Y4Fhu5sP/8QAFBEBAAAAAAAAAAAAAAAAAAAAIP/aAAgBAwEBPwEf/8QAFBEBAAAAAAAAAAAAAAAAAAAAIP/aAAgBAgEBPwEf/8QAGhAAAQUBAAAAAAAAAAAAAAAAEAABERIgIf/aAAgBAQAGPwLUDrqx/8QAHBABAQEAAgMBAAAAAAAAAAAAAQARITFBUWHh/9oACAEBAAE/ITMnIySLEeluZy5+yTG+W8Q46l+yCjkukofy/9oADAMBAAIAAwAAABCYLEP/xAAVEQEBAAAAAAAAAAAAAAAAAAAgIf/aAAgBAwEBPxCD/8QAFhEBAQEAAAAAAAAAAAAAAAAAEBFB/9oACAECAQE/EKaf/8QAHhABAAICAgMBAAAAAAAAAAAAAQARITFBYVGBkeH/2gAIAQEAAT8QGCBw41FZqumrH9hlpvRdSkYcahaBVVt47I2YepIiqF88TCrrUCEM6mvuO7dUFejqPTcf/9k=","aspectRatio":0.6647058823529411,"src":"/static/4cdd14b89e9545a1913f042df0c033ec/32fd5/Smokescreen-Active-defense-blog-post-scaled.jpg","srcSet":"/static/4cdd14b89e9545a1913f042df0c033ec/06e94/Smokescreen-Active-defense-blog-post-scaled.jpg 113w,\n/static/4cdd14b89e9545a1913f042df0c033ec/07ab6/Smokescreen-Active-defense-blog-post-scaled.jpg 225w,\n/static/4cdd14b89e9545a1913f042df0c033ec/32fd5/Smokescreen-Active-defense-blog-post-scaled.jpg 450w,\n/static/4cdd14b89e9545a1913f042df0c033ec/4a838/Smokescreen-Active-defense-blog-post-scaled.jpg 675w,\n/static/4cdd14b89e9545a1913f042df0c033ec/9842e/Smokescreen-Active-defense-blog-post-scaled.jpg 900w,\n/static/4cdd14b89e9545a1913f042df0c033ec/4f4f6/Smokescreen-Active-defense-blog-post-scaled.jpg 1700w","srcWebp":"/static/4cdd14b89e9545a1913f042df0c033ec/b8a88/Smokescreen-Active-defense-blog-post-scaled.webp","srcSetWebp":"/static/4cdd14b89e9545a1913f042df0c033ec/3a3bf/Smokescreen-Active-defense-blog-post-scaled.webp 113w,\n/static/4cdd14b89e9545a1913f042df0c033ec/975bf/Smokescreen-Active-defense-blog-post-scaled.webp 225w,\n/static/4cdd14b89e9545a1913f042df0c033ec/b8a88/Smokescreen-Active-defense-blog-post-scaled.webp 450w,\n/static/4cdd14b89e9545a1913f042df0c033ec/761da/Smokescreen-Active-defense-blog-post-scaled.webp 675w,\n/static/4cdd14b89e9545a1913f042df0c033ec/210c1/Smokescreen-Active-defense-blog-post-scaled.webp 900w,\n/static/4cdd14b89e9545a1913f042df0c033ec/35cfd/Smokescreen-Active-defense-blog-post-scaled.webp 1700w","sizes":"(max-width: 450px) 100vw, 450px"}}}},"author":{"id":"765e8417-7ed6-55b7-95a7-1d561141e760","name":"Sudarshan Pisupati"}}},{"node":{"id":"34bde990-0a83-5088-90fc-ec45aea87b8a","title":"The curious case of “How many decoys do I need?”","content":"\r\n

Many an old sparring session has been witnessed on this subject here at Smokescreen. Buckle up, this is going to be a long read.

\r\n\r\n\r\n\r\n

When someone asks “How many decoys do I need?”, what they’re really asking is how many decoys do I need to make sure that I can catch the adversary.

\r\n\r\n\r\n\r\n

Deception has toed the industry line on this question. It seems natural to want comprehensive coverage. After all, you wouldn’t buy antivirus licenses for just 20% of your organisation. The technology, too, has been able to keep pace – you can literally place deception in every part of your environment. Notice I said, “you can”. Just because you can, doesn’t mean you should.

\r\n\r\n\r\n\r\n

That deception everywhere thinking might have made sense five years ago when deception technology was just hitting the market but does it hold today? To answer that, we’re going to dive into our experience of 80+ deception deployments to see if there’s a case to be made to rethink how we size, scope, and deploy deception in the enterprise. 

\r\n\r\n\r\n\r\n

We’re dropping our vendor hat and will analyse this problem from the perspective of the entity we hope to thwart using deception – the attacker / adversary. 

\r\n\r\n\r\n\r\n

The Adversary

\r\n\r\n\r\n\r\n

Colloquially, the APT. This is either an organised crime group or a nation-state grade attacker. They are targeted in their approach. They want something valuable you have – intel, a database, a transaction processing system, a formula, intellectual property, confidential non-public information, access to your CEOs email, etc. They will deploy specialised, customised malware, infrastructure, and tooling to achieve these means. They spend time understanding you and focus heavily on avoiding detection. If they do get detected, they count on the fact that you won’t do anything about it until they are already gone. 

\r\n\r\n\r\n\r\n

Assumptions

\r\n\r\n\r\n\r\n

Definition of a decoy: Any fake machine, file, credential, account or lure placed in the network. 

\r\n\r\n\r\n\r\n

Let’s assume that you do not have the ability to do the following in your network:

\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n

Let’s also assume that the initial entry point and the subnet on which the entry point machine resides has no deception whatsoever. It means, you are running blind at the point of first infection. 

\r\n\r\n\r\n\r\n

With these constraints, what does an effective deception deployment look like, so you can detect the adversary? 

\r\n\r\n\r\n\r\n

Let’s say the crown jewel here is the production customer database. 

\r\n\r\n\r\n\r\n

For an adversary to be able to access the database (actually, any database), they will need:

\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n

Let’s run a couple of scenarios to see how this plays out.

\r\n\r\n\r\n\r\n

Scenario 1: The adversary has all pieces of information because they were leaked on the Internet

\r\n\r\n\r\n\r\n

Does deception help in this scenario? The answer is no. In fact, you could cast reasonable doubt on whether any security product will be able to stop this.  

\r\n\r\n\r\n\r\n

Scenario 2: The adversary has the IP address but not the credentials 

\r\n\r\n\r\n\r\n

In such a scenario, the database server reconnaissance has already happened. The adversary will know exactly which set of account credentials are required to login to the server. 

\r\n\r\n\r\n\r\n

This scenario throws an interesting question. Where can one find the credentials? What are the options available? 

\r\n\r\n\r\n\r\n
    \r\n
  1. Guess OS passwords to the server (in windows, these can be local or domain accounts).
    2. \r\n
  2. Guess / brute force default account passwords configured on the database.
    3. \r\n
  3. Search the environment hoping someone has written down the passwords in an accessible file share.
    4. \r\n
  4. Find a way to backdoor the administrators of the server and steal their credentials to leverage access.
    5. \r\n
  5. Wait for an unauthenticated remote code execution zero-day to be released.
    6. \r\n
\r\n\r\n\r\n\r\n

Unmanaged accounts like in #1 & #2 should be hardened, especially since we are talking about a business-critical system. #5 is also a hard sell in this scenario. 

\r\n\r\n\r\n\r\n

How many decoys do you need? 

\r\n\r\n\r\n\r\n
    \r\n
  1. A fake account that from the username is made to look like it can login to the database server (dbserveradmin?) and the database itself (sqlserveradmin).
    2. \r\n
  2. Endpoint deception on the DB and DB server OS administrator machines.
    3. \r\n
  3. A decoy file share with data that looks like it contains information about the DB server. 
    4. \r\n
\r\n\r\n\r\n\r\n

So, if you have 10 OS administrators and 10 DB administrators, you’ll need 2 fake AD accounts + 1 network decoy hosting a file share + 20 endpoint decoys. 

\r\n\r\n\r\n\r\n

Scenario 3: The adversary does not have the IP / Hostname of the DB server

\r\n\r\n\r\n\r\n

How do you find the hostname or IP address of a database server? 

\r\n\r\n\r\n\r\n
    \r\n
  1. LDAP / Active Directory / DNS brute force: The phonebook of the internal network. The adversary could do something as simple as query the word “db” and build a list of potential databases. They could identify computers, groups, users, and a wealth of other information from Active Directory to at least build a potential list of targets (either DB admins, OS admins, or servers) 
    2. \r\n
  2. Let’s say your database server isn’t linked to any directory service. In this case, the adversary would have to hunt on the network to find information like asset information stored in open file shares or intranet portals. You can get really creative with how you look for this information. 
    3. \r\n
  3. Attack the users who are likely to have access to the database.
    4. \r\n
  4. Short of finding the hostname / IP address directly in the directory or using creative logic to attack likely locations where this information is stored, the only remaining option is to scan the entire private IP range for the DB server based on its port. Once you have that, you eliminate it one by one. 
    5. \r\n
\r\n\r\n\r\n\r\n

Considering the above, the following are the four deception possibilities: 

\r\n\r\n\r\n\r\n
    \r\n
  1. Add entries into your Active Directory that are likely to be triggered on searches for databases. 
    2. \r\n
  2. Create file shares that seem to contain asset information about the database. 
    3. \r\n
  3. Create fake accounts and drop endpoint deception on actual database administrators. 
    4. \r\n
  4. Place a database decoy preceding and succeeding the IP address of the actual database server. 
    5. \r\n
\r\n\r\n\r\n\r\n

How many decoys do you need? 

\r\n\r\n\r\n\r\n

A couple of Active Directory entries for databases + A network decoy hosting a file share + 2 network decoys hosting decoy databases + the deception in Scenario 2. 

\r\n\r\n\r\n\r\n

All in all, at this point, you’ll add around 5 additional decoys. 

\r\n\r\n\r\n\r\n

How many Network Decoys do I need? 

\r\n\r\n\r\n\r\n

Network decoys require special consideration as they are the hottest topic of debate because the process of deploying them requires VLAN trunking. The questions are:

\r\n\r\n\r\n\r\n
    \r\n
  1. Which VLANs do I trunk?
    2. \r\n
  2. How many VLANs do I trunk?
    3. \r\n
  3. I can’t trunk all VLANs, what do I do?
    4. \r\n
\r\n\r\n\r\n\r\n

In our proposed strategy, it is possible for you to avoid trunking entirely. Just add a file share in the same subnet as your real file share. Place a database decoy preceding and succeeding the IP address of the actual database server. 

\r\n\r\n\r\n\r\n

If we consider only the “production” version in our database server scenario, we need a total of 3 network decoys (a decoy file share and two fake database servers) to achieve a reasonable strategy that covers the most likely outcomes.

\r\n\r\n\r\n\r\n

If it makes you feel comfortable, you can double this up and it’s still only 6 network decoys. 

\r\n\r\n\r\n\r\n

If you want to cover your test and UAT environments for the database server, that’s 9 network decoys. 

\r\n\r\n\r\n\r\n

If you want to cover an additional scenario, that’s 18 network decoys. 

\r\n\r\n\r\n\r\n

Closing Thoughts

\r\n\r\n\r\n\r\n

There is a cogent case to be made here that it is certainly not necessary to deploy decoys everywhere and yo’ll still achieve effectiveness. Our example scenario needed no more than 6 network decoys, a couple of fake accounts, fake computer entries in Active Directory, and endpoint deception deployed to a very targeted group. 

\r\n\r\n\r\n\r\n

With a focused deployment, you will understand exactly what tactics you are attempting to cover with deception and you can sleep well knowing you have achieved that outcome. If you find yourself attempting to blanket your network with deception, it is likely you are adopting the spray and pray approach which usually has little value. You’ll be chasing sheep when you have the opportunity to catch the wolves.

\r\n","excerpt":"Decoys can be deployed everywhere in your network – current-gen deception technology makes that possible. There are however no free lunches and pervasive deception might come with a cost. So the question is, should you?\n","slug":"how-many-decoys-do-i-need","date":"2020-07-20T06:03:16.000Z","status":"publish","modified":"2020-09-11T02:19:17.000Z","wordpress_id":18421,"featured_media":{"id":"e924a8d1-d814-5487-8d67-de66a2f7b385","source_url":"https://ss-website-content-prod.s3.ap-south-1.amazonaws.com/wp-content/uploads/2020/07/How-many-decoys-do-I-need.png","alt_text":"decoys","large":{"childImageSharp":{"fluid":{"base64":"data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAABQAAAALCAYAAAB/Ca1DAAAACXBIWXMAAAsTAAALEwEAmpwYAAACy0lEQVQozz2SXUiTURjHz76k1Mxmtc3N6TY1/CzX2pyrJnPNPqAvjUbQNygVCV1FdNFFEF0WZBB0IY2KIjMLiqgEr72wD+3jShPS2YZpTS2d/TrvS/rAw/O+nPP8zv9/niMM1ZtQMmO9F13VRvSVbgxqlVm+AW1JBSK/CFFUit5Vhs5ZisbmRJjsCLNMUwFidT7CaJbVglCB6zehqXCzTNaMag96h2w229DaXWRWuYmeaaOwLoiQ/1p7CTkeN5ad9eTWbiTX68YU8mOJBMj1VCOW1fgQJZXsOdXG2w8DhPfsQwhBhk6nVld5BcnxcZ68eKkCNTYXqzb7KDt7gKLodsw7t1DQ1IAp4sdYV4PQVXmkMi/vP37iXX8/JcUuFbSYWZnL6evrY2FhgdJgg7RlxRQMUHPqII79ETa0HsBaX0eWxUGmzSF7iis4fekySjzu6qKltZVYLIbf7ycnJwenw0Hdlq2k0/Pcvv8AscJIWTDM/mMt2N21hJuj7D58jH3HT1Ls9SNWejfzLT4Of/8SCoXoktDe3l56enro7u7mZns7RouVh0+fqYcG9jYj8sxkrytHV+BAay1EZ7WjMVmlejmYax0xdWPsUSfLs7NJ/frF1NQUo6OjTMo6m0rhDTdS2biL9Pw88e8J7L4AIisXvd2pAjWWAjTKEBWoAnv/+QvW4DYuXLmqwtPyvuLxON8TCRbSaXYcOSGt5rH7RIu6Pij3H207J5+TXQKL0CpVQlVgYmJCXmpE2rCyxu3j6/Cw2jQyMsLQ0BCzMzMEmg4iLMqbs/H8TQ+Lsf3QYfn+1mJQrCtAqVLc636GpynKkfMXud5xh2QyydzcHClpdUIe9lPa7h8Y4Omr18Q6u3g3OLgEvBW7K4ewGoNi/b9KodzXvAQsxvT0NAlpdXJykrGxMYal4h8/JpbW//z5zczsrPp9QwoQq6TCQteS9X+wd+nDk8Ie7wAAAABJRU5ErkJggg==","aspectRatio":1.9047619047619047,"src":"/static/33b83b27cd195b73256e62ee8a884b72/ee604/How-many-decoys-do-I-need.png","srcSet":"/static/33b83b27cd195b73256e62ee8a884b72/69585/How-many-decoys-do-I-need.png 200w,\n/static/33b83b27cd195b73256e62ee8a884b72/497c6/How-many-decoys-do-I-need.png 400w,\n/static/33b83b27cd195b73256e62ee8a884b72/ee604/How-many-decoys-do-I-need.png 800w,\n/static/33b83b27cd195b73256e62ee8a884b72/f3583/How-many-decoys-do-I-need.png 1200w,\n/static/33b83b27cd195b73256e62ee8a884b72/5707d/How-many-decoys-do-I-need.png 1600w,\n/static/33b83b27cd195b73256e62ee8a884b72/0ef64/How-many-decoys-do-I-need.png 2400w","srcWebp":"/static/33b83b27cd195b73256e62ee8a884b72/58556/How-many-decoys-do-I-need.webp","srcSetWebp":"/static/33b83b27cd195b73256e62ee8a884b72/61e93/How-many-decoys-do-I-need.webp 200w,\n/static/33b83b27cd195b73256e62ee8a884b72/1f5c5/How-many-decoys-do-I-need.webp 400w,\n/static/33b83b27cd195b73256e62ee8a884b72/58556/How-many-decoys-do-I-need.webp 800w,\n/static/33b83b27cd195b73256e62ee8a884b72/99238/How-many-decoys-do-I-need.webp 1200w,\n/static/33b83b27cd195b73256e62ee8a884b72/7c22d/How-many-decoys-do-I-need.webp 1600w,\n/static/33b83b27cd195b73256e62ee8a884b72/f1e40/How-many-decoys-do-I-need.webp 2400w","sizes":"(max-width: 800px) 100vw, 800px"}}},"medium":{"childImageSharp":{"fluid":{"base64":"data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAABQAAAAKCAYAAAC0VX7mAAAACXBIWXMAAAsTAAALEwEAmpwYAAAChklEQVQozz2RS0gUUBSG78yokaWWOs44D2d8p6OOU76LbApxUZj4gGiVitgm0UWrRKimtZaboqcgWcFsohxdREVDbtJFFlLio2wjvlIcc3z0db1qBw73wDn/f///HBGak0+YswCR6UKk56BzHCU0+Qih9lRESgaW46fIKT+LSEgmJCldZhrRJwqIyncR7sgk8piTwwUuDjoy0BhMiH25hYjULC60XsXb58PiyEYIQZhOp952zy3m5+Z2SI0J7M9wkN5URUpdBeYKN/baMqxVp9G7pahYI0IjFcUUnWTyx08G+vrQx8Yoor2sralhOzy3uxBReiKyc8hurCGpupzMukqMp4o4YEkiwpaCiDFITHImbR13FKijs5Pm5mY8Hg82mw273Y7JbKa7p4fllRX0zjzC0xxU1TfhPFNOyblKWTdSeamexDzp9JAUYyot489akF/T0xQWFjI6Okp/fz9+vx+v10tDQwNZRSXqw0fPXkiQnhCpRmtNlOAENPEWhD5e2jWg3X57Xr5Swy3X2ih1u1U9NTXF/Pw8K1KVz+dTwPu9z1Wv9fpNRGQ0WosdnUyt7GklqdZgRrNNuD3U+9pHuKuIu0+6FSgYDDIpSdnaYuDde4TckTDZePtxUPUf9DzF5MpHxJnRmW2S0LpDGCev/GnkKyIjVzatFJ+vZn1tTYHGxsYISIVvPvgx5BWjTUzj4pUW9qLr4WN1hBBpXak07qgUXt8Al9tvcE/uZ2jkC78XFwkEAiwvLzM7O8viwgLfxsf5PjHJ8OcRNjY2FOGwnA2xJaORCpVKZd2KWJf29mJrc5OlpSVmZmbUDicmJpiWx1pdDexO/JX1qqoGh4bRScL/u9wl/QdHt8WNhvW2hQAAAABJRU5ErkJggg==","aspectRatio":1.9152542372881356,"src":"/static/33b83b27cd195b73256e62ee8a884b72/62b1f/How-many-decoys-do-I-need.png","srcSet":"/static/33b83b27cd195b73256e62ee8a884b72/e7519/How-many-decoys-do-I-need.png 113w,\n/static/33b83b27cd195b73256e62ee8a884b72/7e7e9/How-many-decoys-do-I-need.png 225w,\n/static/33b83b27cd195b73256e62ee8a884b72/62b1f/How-many-decoys-do-I-need.png 450w,\n/static/33b83b27cd195b73256e62ee8a884b72/e2e7f/How-many-decoys-do-I-need.png 675w,\n/static/33b83b27cd195b73256e62ee8a884b72/db955/How-many-decoys-do-I-need.png 900w,\n/static/33b83b27cd195b73256e62ee8a884b72/0ef64/How-many-decoys-do-I-need.png 2400w","srcWebp":"/static/33b83b27cd195b73256e62ee8a884b72/b8a88/How-many-decoys-do-I-need.webp","srcSetWebp":"/static/33b83b27cd195b73256e62ee8a884b72/3a3bf/How-many-decoys-do-I-need.webp 113w,\n/static/33b83b27cd195b73256e62ee8a884b72/975bf/How-many-decoys-do-I-need.webp 225w,\n/static/33b83b27cd195b73256e62ee8a884b72/b8a88/How-many-decoys-do-I-need.webp 450w,\n/static/33b83b27cd195b73256e62ee8a884b72/761da/How-many-decoys-do-I-need.webp 675w,\n/static/33b83b27cd195b73256e62ee8a884b72/210c1/How-many-decoys-do-I-need.webp 900w,\n/static/33b83b27cd195b73256e62ee8a884b72/f1e40/How-many-decoys-do-I-need.webp 2400w","sizes":"(max-width: 450px) 100vw, 450px"}}}},"author":{"id":"765e8417-7ed6-55b7-95a7-1d561141e760","name":"Sudarshan Pisupati"}}},{"node":{"id":"13ba7811-8420-5fbe-afba-edab7cde09f4","title":"Open Source Honeypots That Detect Threats For Free","content":"

If you’re a target for either financially motivated cyber criminals, or nation state grade attackers, chances are your security team feels outgunned. Deception technology excels at detecting these attacks by shifting the cognitive, economic and time costs of the attack back onto the attacker. The principles of deception have been around for years, and recently, they’ve become the secret weapon of purple teams and threat hunters worldwide. Here’s the good new — You can start seeing the benefits of deception for free using open source honeypots that can be deployed immediately.

\n

Deception is so crucial to detecting lateral movement, uncovering privilege escalation, and building threat intelligence, that any deception, even open-source honeypots are valuable. Whenever we’re on the road, we make it a point to give a shout-out to some of these tools, and will happily help you plan how you can use them. And we’ll do this for free, no strings attached. Just get in touch!

\n

Caveat Emptor: You get what you pay for — Some of these tools may no longer be supported, and will require leg-work to setup and see results. However, they’re a great way to get familiar with deception. They’re also emulations, not real systems, so don’t expect high-interaction activity. While we’ll offer friendly advice around how you can use them, we don’t officially support them.

\n

For more on planning effective deception, check out our strategy focused blog-posts:

\n\n

Network services honeypots

\n\n

IOT (Internet of Things) honeypots

\n\n

SCADA/ICS honeypots

\n\n

Database and NoSQL honeypots

\n\n

Credential honeypots and honeytokens

\n\n

Honeyclients and malware analysis

\n\n

All-in-One

\n\n

Setting up most of these open source honeypots in a lab should be a fairly simple weekend project for seasoned security professionals. You can then run red-team style attacks against them to understand what sort of telemetry you can expect. Finally, you can tweak the source to reduce how easily they can be fingerprinted (don’t forget to submit patches to the authors if you do).

\n

If you’d like to take the next step with professional deception technology, check out our IllusionBLACK platform by seeing a live demo.

\n","excerpt":"If you’re a target for either financially motivated cyber-criminals, or nation-state grade attackers, chances are your security team feels outgunned. Deception technology excels at detecting these attacks by shifting the cognitive, economic and time costs of the attack back onto the attacker.\n","slug":"practical-honeypots-a-list-of-open-source-deception-tools-that-detect-threats-for-free","date":"2017-09-20T12:18:42.000Z","status":"publish","modified":"2020-09-14T06:17:12.000Z","wordpress_id":16927,"featured_media":{"id":"fe9a8c35-b0a3-525e-b272-29dd6f0cbf3b","source_url":"https://ss-website-content-prod.s3.ap-south-1.amazonaws.com/wp-content/uploads/2017/09/Open-source-honeypots-Smokescreen.jpeg","alt_text":"Open source honeypots","large":{"childImageSharp":{"fluid":{"base64":"data:image/jpeg;base64,/9j/2wBDABALDA4MChAODQ4SERATGCgaGBYWGDEjJR0oOjM9PDkzODdASFxOQERXRTc4UG1RV19iZ2hnPk1xeXBkeFxlZ2P/2wBDARESEhgVGC8aGi9jQjhCY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2P/wgARCAANABQDASIAAhEBAxEB/8QAFwAAAwEAAAAAAAAAAAAAAAAAAAIDBf/EABQBAQAAAAAAAAAAAAAAAAAAAAD/2gAMAwEAAhADEAAAAdyTzAUP/8QAFhABAQEAAAAAAAAAAAAAAAAAEAEC/9oACAEBAAEFAq6f/8QAFBEBAAAAAAAAAAAAAAAAAAAAEP/aAAgBAwEBPwE//8QAFBEBAAAAAAAAAAAAAAAAAAAAEP/aAAgBAgEBPwE//8QAFBABAAAAAAAAAAAAAAAAAAAAIP/aAAgBAQAGPwJf/8QAGBAAAwEBAAAAAAAAAAAAAAAAAAERECH/2gAIAQEAAT8haFudDef/2gAMAwEAAgADAAAAEEPP/8QAFBEBAAAAAAAAAAAAAAAAAAAAEP/aAAgBAwEBPxA//8QAFBEBAAAAAAAAAAAAAAAAAAAAEP/aAAgBAgEBPxA//8QAGhAAAwADAQAAAAAAAAAAAAAAAAERECFBMf/aAAgBAQABPxCSvwlLzgno0R4Ez//Z","aspectRatio":1.5037593984962405,"src":"/static/03cd33bfc3eac071715696dc4b64baf3/14b42/Open-source-honeypots-Smokescreen.jpg","srcSet":"/static/03cd33bfc3eac071715696dc4b64baf3/f836f/Open-source-honeypots-Smokescreen.jpg 200w,\n/static/03cd33bfc3eac071715696dc4b64baf3/2244e/Open-source-honeypots-Smokescreen.jpg 400w,\n/static/03cd33bfc3eac071715696dc4b64baf3/14b42/Open-source-honeypots-Smokescreen.jpg 800w,\n/static/03cd33bfc3eac071715696dc4b64baf3/47498/Open-source-honeypots-Smokescreen.jpg 1200w,\n/static/03cd33bfc3eac071715696dc4b64baf3/0e329/Open-source-honeypots-Smokescreen.jpg 1600w,\n/static/03cd33bfc3eac071715696dc4b64baf3/eeda9/Open-source-honeypots-Smokescreen.jpg 1650w","srcWebp":"/static/03cd33bfc3eac071715696dc4b64baf3/58556/Open-source-honeypots-Smokescreen.webp","srcSetWebp":"/static/03cd33bfc3eac071715696dc4b64baf3/61e93/Open-source-honeypots-Smokescreen.webp 200w,\n/static/03cd33bfc3eac071715696dc4b64baf3/1f5c5/Open-source-honeypots-Smokescreen.webp 400w,\n/static/03cd33bfc3eac071715696dc4b64baf3/58556/Open-source-honeypots-Smokescreen.webp 800w,\n/static/03cd33bfc3eac071715696dc4b64baf3/99238/Open-source-honeypots-Smokescreen.webp 1200w,\n/static/03cd33bfc3eac071715696dc4b64baf3/7c22d/Open-source-honeypots-Smokescreen.webp 1600w,\n/static/03cd33bfc3eac071715696dc4b64baf3/36d36/Open-source-honeypots-Smokescreen.webp 1650w","sizes":"(max-width: 800px) 100vw, 800px"}}},"medium":{"childImageSharp":{"fluid":{"base64":"data:image/jpeg;base64,/9j/2wBDABALDA4MChAODQ4SERATGCgaGBYWGDEjJR0oOjM9PDkzODdASFxOQERXRTc4UG1RV19iZ2hnPk1xeXBkeFxlZ2P/2wBDARESEhgVGC8aGi9jQjhCY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2P/wgARCAANABQDASIAAhEBAxEB/8QAFwAAAwEAAAAAAAAAAAAAAAAAAAIDBf/EABQBAQAAAAAAAAAAAAAAAAAAAAD/2gAMAwEAAhADEAAAAdyTzAUP/8QAFhABAQEAAAAAAAAAAAAAAAAAEAEC/9oACAEBAAEFAq6f/8QAFBEBAAAAAAAAAAAAAAAAAAAAEP/aAAgBAwEBPwE//8QAFBEBAAAAAAAAAAAAAAAAAAAAEP/aAAgBAgEBPwE//8QAFBABAAAAAAAAAAAAAAAAAAAAIP/aAAgBAQAGPwJf/8QAGBAAAwEBAAAAAAAAAAAAAAAAAAERECH/2gAIAQEAAT8haFudDef/2gAMAwEAAgADAAAAEEPP/8QAFBEBAAAAAAAAAAAAAAAAAAAAEP/aAAgBAwEBPxA//8QAFBEBAAAAAAAAAAAAAAAAAAAAEP/aAAgBAgEBPxA//8QAGhAAAwADAQAAAAAAAAAAAAAAAAERECFBMf/aAAgBAQABPxCSvwlLzgno0R4Ez//Z","aspectRatio":1.5066666666666666,"src":"/static/03cd33bfc3eac071715696dc4b64baf3/32fd5/Open-source-honeypots-Smokescreen.jpg","srcSet":"/static/03cd33bfc3eac071715696dc4b64baf3/06e94/Open-source-honeypots-Smokescreen.jpg 113w,\n/static/03cd33bfc3eac071715696dc4b64baf3/07ab6/Open-source-honeypots-Smokescreen.jpg 225w,\n/static/03cd33bfc3eac071715696dc4b64baf3/32fd5/Open-source-honeypots-Smokescreen.jpg 450w,\n/static/03cd33bfc3eac071715696dc4b64baf3/4a838/Open-source-honeypots-Smokescreen.jpg 675w,\n/static/03cd33bfc3eac071715696dc4b64baf3/9842e/Open-source-honeypots-Smokescreen.jpg 900w,\n/static/03cd33bfc3eac071715696dc4b64baf3/eeda9/Open-source-honeypots-Smokescreen.jpg 1650w","srcWebp":"/static/03cd33bfc3eac071715696dc4b64baf3/b8a88/Open-source-honeypots-Smokescreen.webp","srcSetWebp":"/static/03cd33bfc3eac071715696dc4b64baf3/3a3bf/Open-source-honeypots-Smokescreen.webp 113w,\n/static/03cd33bfc3eac071715696dc4b64baf3/975bf/Open-source-honeypots-Smokescreen.webp 225w,\n/static/03cd33bfc3eac071715696dc4b64baf3/b8a88/Open-source-honeypots-Smokescreen.webp 450w,\n/static/03cd33bfc3eac071715696dc4b64baf3/761da/Open-source-honeypots-Smokescreen.webp 675w,\n/static/03cd33bfc3eac071715696dc4b64baf3/210c1/Open-source-honeypots-Smokescreen.webp 900w,\n/static/03cd33bfc3eac071715696dc4b64baf3/36d36/Open-source-honeypots-Smokescreen.webp 1650w","sizes":"(max-width: 450px) 100vw, 450px"}}}},"author":{"id":"9257cd1e-ca7f-578b-a2dd-9c2e74282caf","name":"Smokescreen Team"}}},{"node":{"id":"ea4f620c-95dd-5361-8f79-ff8b1fa8ff02","title":"7 Ways to Fail At Implementing Deception Technology","content":"

Distributed Deception Platforms are a hot topic today. Most CISOs are thinking of implementing deception technology or road-mapping it into their evaluations and budgets. The promises sound great:

\n\n

Unfortunately, due to the unique secretive nature of deception (after all, you may not want people to know about it), there’s precious little information on how a security team can implement deception tecnology successfully and make it useful.

\n

If you’re being pushed to power-up a sleek appliance and kiss your cybersecurity woes goodbye, don’t believe the marketing hype — that’s not going to happen.

\n

After implementing deception technology campaigns for the better part of a decade, we’ve compiled a list of the 7 deadly sins that will guarantee that your deception investment will disappoint you. Here we go:

\n

1. You’re Not Sure What You’re Protecting

\n

It’s quite obvious that for a deception technology deployment to be successful, you need an objective and a strategy. At a minimum, make sure you know what assets you’re trying to protect (they’re not all equal to the hacker). The best deception campaigns are extremely goal-oriented (e.g.: “Catch targeted attacks against my SWIFT servers, especially focused on breaches from third-party networks.”).

\n

The Fix: Make a list of your top 3 nightmare scenarios, and identify the assets (endpoints / servers / people / credentials / network zones) that are a part of those nightmares.

\n

 

\n

2. You Don’t Know Your Enemy

\n

There’s a reason some of the best deception specialists moonlight as threat hunters or red-teamers. Deception is an ‘active defence‘ capability — where deep knowledge of the attacker’s modus operandi is crucial. Knowing the critical paths an attacker will follow will massively boost the effectiveness of your deception capabilities.

\n

The Fix: Have your in-house / external red-team build attack trees to the assets you’ve identified at risk. Train your blue-team on how to think adversarially.

\n

 

\n

3. You’re Not Prepared for Deception Alerts

\n

One of the best things about deception technology is that the alerts are low false positive and real-time. That’s great, but when the metaphorical (or literal) phone rings, do you have a plan for how to respond? The attacker is very likely still ‘live and squirming’ on your infrastructure. This leads to interesting new opportunities and questions:

\n\n

The Fix: Have a specific set of incident response play-books for responding to deception alerts. War-game the scenarios end-to-end, ideally without your DFIR / blue-team being aware. Start basic and build a roadmap to advanced deception use cases.

\n

 

\n

4. You Haven’t Tested Your Deception Strategy

\n

Confident and experienced deception specialists will encourage (even insist) that you test the deception realism in your environment after you implement it. Not only does this validate that the deception is ‘working’ to meet your business objectives, but it will give you useful metrics like time-to-decieve, deception engagement time, coverage, and kill-chain hit ratios.

\n

The Fix: Blind test the strategy underlying your deception technology deployment. See how ‘real’ your simulated adversary believes the decoys are. Did you miss something? This is worth doing regularly.

\n

 

\n

5. Your Deception is Not Customised

\n

The best way to increase deception engagement time is to customise the decoys to your environment. There are a number of nifty tricks here (our MirageMaker feature does a lot of this for you), but never underestimate the power of human ingenuity.

\n

The Fix: Find the most devious folks in your infosec team and brainstorm how you can decieve, degrade, deny, disrupt, and dazzle an attacker even better. You want your deception to maximise the economic burden to the attacker in terms of time, effort, and cognitive load.

\n

 

\n

6. You Don’t Know the ‘Deception Trifecta’

\n

Well planned deception systems unify three perspectives to quickly arrive at the root cause of an incident:

\n
    \n
  1. What is happening? (decoy telemetry)
    2. \n
  2. How is it happening? (endpoint forensics)
    3. \n
  3. Where else is it happening? (estate integrations / correlation)
    4. \n
\n

We call this the ‘deception trifecta’, and your entire strategy must be built around it.

\n

The Fix: Study the deception trifecta and determine how weak or strong you are on each side. Improve visibility, collection, and analysis speed for each perspective. Ensure supporting systems can flesh out context when deception systems alert you (e.g. do you have an updated asset inventory?)

\n

 

\n

7. Your Deception Provider Doesn’t ‘Get’ Strategy

\n

Remember IDS? DLP? NAC? cough SIEM cough?

\n

The success of cybersecurity technologies is pretty binary: Either they’re well implemented by people who knew how to do it right, or far more often, they’re a mess of false promises and mismatched expectations. If you’re just being sold a box, AMC, and product training, there’s a lot missing. Sure, you might make it work, but the onus should be on the vendor to ensure you operationalise deception capabilities and see success for stuff that matters to you (we do this for every customer, big or small).

\n

The Fix: Talk to your provider to understand the depth of their knowledge on deception technology deployments, adversarial thinking, and most importantly, how they’ll make it all work for you. Get into specifics. Speak to their people. Hint: if their title says ‘Sales’… well… caveat emptor 🙂

\n

 

\n

In Summary – How To Get It Right

\n
\n
    \n
  1. Identify what will hurt you, and where those assets reside
    2. \n
  2. Know how your enemy will likely traverse your environment
    3. \n
  3. Create a tactical plan for handling deception alerts
    4. \n
  4. Blind test your deception strategy regularly
    5. \n
  5. Customise your deception environment ‘by hand’
    6. \n
  6. Know the ‘Deception Trifecta’ and improve how you use it
    7. \n
  7. Choose a provider who will build a capability, not sell a box
    8. \n
\n

Deception technology is more than just a new way to detect lateral movement, privilege escalation, ransomware, data-theft or solve any other current cybersecurity woes. It’s a fundamentally different way of thinking about how you defend your organisation, irrespective of shiny boxes (ours or anybody else’s)!

\n

Avoid the mistakes above, and your security team will really see the benefits behind the hype. We have customers that now use deception as their ‘concertmaster‘ — the single most important pillar in their security stack, with everything else supporting it.

\n

At Smokescreen, we believe we’ve solved these problems through our technology, support, and experience. If you’d like to learn more about how we think it should be done, get in touch for a chat with our specialists!

\n

If you’re in the process of evaluating deception technology vendors, read our blog post on 10 questions you need to ask them or download our guide that dives deep into capabilities that make for a great deception solution.

\n\n\n

\n","excerpt":"Since there’s precious little information on how security teams can make deception implementations successful (some folks like to keep it a secret), there’s plenty that can go wrong. Here are 7 ways to completely botch your deployment of deception technology.\n","slug":"7-deadly-sins-how-to-fail-at-implementing-deception-technology","date":"2017-09-18T14:01:05.000Z","status":"publish","modified":"2020-01-05T09:25:57.000Z","wordpress_id":16912,"featured_media":{"id":"940f3e3f-92f9-56f6-91a1-525330dda41c","source_url":"https://ss-website-content-prod.s3.ap-south-1.amazonaws.com/wp-content/uploads/2017/09/failwin.png","alt_text":"Fail At Deception Technology","large":{"childImageSharp":{"fluid":{"base64":"data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAABQAAAAMCAIAAADtbgqsAAAACXBIWXMAABYlAAAWJQFJUiTwAAABqklEQVQoz41SW0sCURCeWf9E1FMEvUWa1/VumpnXzdveLFN3VZDKCsmgf9BT4ENkQUpBUA/9xObsLrpUD8HHYc4538x85zsD6OL/hZ0gW52BZeziwbrb9lsXtFL8M9k4pBx3yCD7bMlOP4ZSkKuDoEJOxEjaKmSCYiePyQKWj6DWQqGB8axJAFaSNrLmkHWOoOgo65jML/sTL1uDRp/OHQZQ7WNaIAKgN0r1QNLgsAl5iaF6AvU2+mPGE3wY3gOlB5VjdpUTGSpNkLvIJ4CL7lO0UpJOr8bth1lnMl3rXVA5LpFjzT0RzItI5dpD9/3z5XQ+eJytdoeMkCoCF8tQ8kZJap2Puk+vN/P3zbMxNedIOTnE76KgctSqf+2bvNx9fN2+fa4PRoyQFgB9MRIJogZlki1DQWayRQ0DcSZ7y4tUXe0xqUUFCgYoVrrMY2Y1CVB0TtIYZJ1dkB8Lw6l/SaVno9gxOUCG0VucAbD8jB1ASYFqk35r8RNLt91hpI8UOyC2mZeZsnluGxJarRn4NSTm5HgjGEyiJ2wQArYJc9mmzxX8e0LNEjZR32MQjkf1g0MQAAAAAElFTkSuQmCC","aspectRatio":1.680672268907563,"src":"/static/741aacdb6ba2e8df1b88b93b521715a6/ee604/failwin.png","srcSet":"/static/741aacdb6ba2e8df1b88b93b521715a6/69585/failwin.png 200w,\n/static/741aacdb6ba2e8df1b88b93b521715a6/497c6/failwin.png 400w,\n/static/741aacdb6ba2e8df1b88b93b521715a6/ee604/failwin.png 800w,\n/static/741aacdb6ba2e8df1b88b93b521715a6/a8378/failwin.png 1024w","srcWebp":"/static/741aacdb6ba2e8df1b88b93b521715a6/58556/failwin.webp","srcSetWebp":"/static/741aacdb6ba2e8df1b88b93b521715a6/61e93/failwin.webp 200w,\n/static/741aacdb6ba2e8df1b88b93b521715a6/1f5c5/failwin.webp 400w,\n/static/741aacdb6ba2e8df1b88b93b521715a6/58556/failwin.webp 800w,\n/static/741aacdb6ba2e8df1b88b93b521715a6/cc834/failwin.webp 1024w","sizes":"(max-width: 800px) 100vw, 800px"}}},"medium":{"childImageSharp":{"fluid":{"base64":"data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAABQAAAAMCAIAAADtbgqsAAAACXBIWXMAABYlAAAWJQFJUiTwAAABqklEQVQoz41SW0sCURCeWf9E1FMEvUWa1/VumpnXzdveLFN3VZDKCsmgf9BT4ENkQUpBUA/9xObsLrpUD8HHYc4538x85zsD6OL/hZ0gW52BZeziwbrb9lsXtFL8M9k4pBx3yCD7bMlOP4ZSkKuDoEJOxEjaKmSCYiePyQKWj6DWQqGB8axJAFaSNrLmkHWOoOgo65jML/sTL1uDRp/OHQZQ7WNaIAKgN0r1QNLgsAl5iaF6AvU2+mPGE3wY3gOlB5VjdpUTGSpNkLvIJ4CL7lO0UpJOr8bth1lnMl3rXVA5LpFjzT0RzItI5dpD9/3z5XQ+eJytdoeMkCoCF8tQ8kZJap2Puk+vN/P3zbMxNedIOTnE76KgctSqf+2bvNx9fN2+fa4PRoyQFgB9MRIJogZlki1DQWayRQ0DcSZ7y4tUXe0xqUUFCgYoVrrMY2Y1CVB0TtIYZJ1dkB8Lw6l/SaVno9gxOUCG0VucAbD8jB1ASYFqk35r8RNLt91hpI8UOyC2mZeZsnluGxJarRn4NSTm5HgjGEyiJ2wQArYJc9mmzxX8e0LNEjZR32MQjkf1g0MQAAAAAElFTkSuQmCC","aspectRatio":1.6865671641791045,"src":"/static/741aacdb6ba2e8df1b88b93b521715a6/62b1f/failwin.png","srcSet":"/static/741aacdb6ba2e8df1b88b93b521715a6/e7519/failwin.png 113w,\n/static/741aacdb6ba2e8df1b88b93b521715a6/7e7e9/failwin.png 225w,\n/static/741aacdb6ba2e8df1b88b93b521715a6/62b1f/failwin.png 450w,\n/static/741aacdb6ba2e8df1b88b93b521715a6/e2e7f/failwin.png 675w,\n/static/741aacdb6ba2e8df1b88b93b521715a6/db955/failwin.png 900w,\n/static/741aacdb6ba2e8df1b88b93b521715a6/a8378/failwin.png 1024w","srcWebp":"/static/741aacdb6ba2e8df1b88b93b521715a6/b8a88/failwin.webp","srcSetWebp":"/static/741aacdb6ba2e8df1b88b93b521715a6/3a3bf/failwin.webp 113w,\n/static/741aacdb6ba2e8df1b88b93b521715a6/975bf/failwin.webp 225w,\n/static/741aacdb6ba2e8df1b88b93b521715a6/b8a88/failwin.webp 450w,\n/static/741aacdb6ba2e8df1b88b93b521715a6/761da/failwin.webp 675w,\n/static/741aacdb6ba2e8df1b88b93b521715a6/210c1/failwin.webp 900w,\n/static/741aacdb6ba2e8df1b88b93b521715a6/cc834/failwin.webp 1024w","sizes":"(max-width: 450px) 100vw, 450px"}}}},"author":{"id":"9257cd1e-ca7f-578b-a2dd-9c2e74282caf","name":"Smokescreen Team"}}},{"node":{"id":"faa742a1-4c12-586e-9304-8a6f65d02427","title":"10 Questions To Ask Deception Technology Vendors","content":"

In order for you to cut through the marketing hype, here’s a set of evaluation questions to ask deception technology vendors that will help you better understand disparate offerings.

\n
    \n
  1. Are their decoys individually unique?
    \nWhile this seems like a no-brainer, there are many deception technology vendors that don’t actually have solutions with the ability to run individually unique application services. In other words, if you deploy 100 FTP decoys, they’re all really pointing to the same FTP servers over and over again! Not very realistic is it? A modern platform will use advances in virtualisation technology to create unique, real decoy services that can be customised individually. Some providers rely on emulations (not the real thing!) in order for them to scale. They then ‘hand off’ the attacker’s interaction to a real virtual machine. Why compromise with emulations when the capability to offer real services at scale exists?
    2. \n
  2. How do they create fake content in their decoys?
    \nIt’s great to see a couple of perfectly configured decoys in a proof-of-concept, but how do different deception technology vendors create fake content and realistic application layer data for hundreds or thousands of decoys? If you try to configure these many systems by hand, you’ll either take forever, or will have mediocre deception realism. Human’s (especially short-staffed security teams) aren’t good at creating mass fake, believable content, and attackers are great at identifying stuff that’s poorly created.
    3. \n
  3. What parts of the kill-chain do they really cover?
    \nKill-chain coverage is an often touted feature, but you need to dig a bit deeper to understand what’s really going on. A good platform will do everything from recon phase, front-of-firewall decoys (that don’t trigger on every random Internet probe), to fake personas (email addresses), and fake data. Deception is far more than a few network decoys and breadcrumbs, so make sure the deception technology vendor you select is truly full-stack.
    4. \n
  4. How do they deploy deception at scale, such as in multi-geography environments?
    \nDo you need a large number of appliances to cover different branches, or do you have to modify your network to create GRE tunnels / VPNs? Some deception technology vendors avoid the multi-location problem altogether by claiming endpoint lures are sufficient (they’re not). A good platform will allow you to deploy decoy network services in remote locations without any of these hassles.
    5. \n
  5. Do they require agents or administrative rights?
    \nDo you need to run agents on all or most of your endpoint fleet in order to benefit from many of the features? Additionally, do you have to have administrative rights to deploy endpoint features? None of these are required for effective deception.
    6. \n
  6. How real are their decoys?
    \nIf it isn’t fooling you, it isn’t fooling the bad-guy. The decoys should be so real that your in-house red-team should fall for them. In fact, we encourage you to do exactly that when comparing solutions — have your own folks rate how ‘real’ the deception looks. This also means that there should be high-interaction environments like RDP and SSH, where a human attacker (not just commodity malware) can run whatever code they like, while you have full telemetry and visibility into their actions.
    7. \n
  7. What is their experience running actual deception campaigns?
    \nNo matter what anyone tells you, deception is more than just the technology. This is actually just common sense; the technology exists to implement a believable deception strategy and overall campaign. Speak to your provider to evaluate their experience with planning, setting up, and managing these campaigns. Good providers will have the expertise and experience of what works in the real world, and what doesn’t. If you plug a deception platform into any reasonably large network, you’ll get hits from commodity infections such as legacy worms scanning subnets and so on. This sounds great, but it’s not really what you’re trying to stop. Ask them about the heritage of their platform. Where has it succeeded for other people?
    8. \n
  8. How good is their offensive R&D?
    \nIt’s no surprise that most deception technology proponents come from either a red team or threat hunting background. The technology is the red teamer’s answer to ‘what would work best against you?’. An active red team practice means that the provider is up to date with (or even inventing) what the bad guy does next, and their ability to ‘think adversarially’ is the difference between deploying deception that doesn’t really hurt the bad guys, versus dirty tricks that really cause them pain.
    9. \n
  9. How good is the security of their deception platform?
    \nWhen an attacker moves laterally and attacks a decoy system, you want them to be successful so that you can collect threat intelligence and indicators of compromise. What you don’t want them to do is to exploit the decoys to target other systems. This means platform security of the deception solution is extremely important. The architecture of some providers even ends up routing VLANs, meaning an attacker can bypass your access control through the decoy! You also must evaluate the base operating platform security to ensure the attacker cannot compromise the decoy host appliance. Container virtualisation is often used to create decoys insecurely, this can lead to the attacker escalating privileges out of the decoy and onto the deception appliance.
    10. \n
  10. What do they do to contain and remediate?
    \nSo now you’re getting meaningful alerts with low false positives. What’s the logical next step? You want to investigate the root-cause of the alert through digital forensics, and likely move to containment. Does the deception platform you’re evaluating only support forensics and containment through third-party products? If so, you’ll need to purchase another tool just to respond to the alerts. Do they offer quality DFIR capabilities for your endpoints out of the box?
    11. \n
  11. [Bonus!] How will they help you build a deception capability, not just implement a technology?
    \nDeception is very similar to threat-hunting; the technology exists to automate and help implement decoys, traps, lures, bait and honeypots, but if you’re not planning your overall strategy around deception, then you’re investing in a box, not a capability. A truly effective deception capability covers the technology, risk-modelling, deception story-building, and post-deception alert management. Make sure you’re not just buying a technology, but are building a fundamentally new capability in your security team.
    12. \n
\n

If you’re currently evaluating deception technology vendors, we’ve written a guide that goes deeper into some of the questions that we’ve listed above. You can download it here.

\n","excerpt":"Deception technology is a major buzzword today. In order for you to cut through the marketing hype, here’s a set of evaluation questions that will help you better understand disparate deception offerings and identify vendors that know what they’re doing.\n","slug":"10-questions-to-ask-your-deception-technology-provider","date":"2017-09-18T12:58:47.000Z","status":"publish","modified":"2020-01-05T09:26:06.000Z","wordpress_id":16901,"featured_media":{"id":"cbfa76e5-6c88-57a7-a370-c16bd4df05ad","source_url":"https://ss-website-content-prod.s3.ap-south-1.amazonaws.com/wp-content/uploads/2017/09/10questions-1.png","alt_text":"Deception technology vendors","large":{"childImageSharp":{"fluid":{"base64":"data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAABQAAAANCAYAAACpUE5eAAAACXBIWXMAABYlAAAWJQFJUiTwAAACrklEQVQ4y51TS0+TURCdyyNpXBjUoEaNJG40UWIiMcbyKPZNH7bFttDSUqSFlvKwhdIGKOVRKUVolYiiGNSNG1f+w+NMrzFx62Lud7/7nTnfnZlzqPOJCWS0gIacIIsXZA+AXCGQNwLyT4ACcdDopA7Z+/jMO64xguUcJblPzTBwUKeRl0E7lNkDJQB3mJOimiD0EjSWAo3P6JC9nMk3wQiWcyRXOAwDNibkRQ2PgKw+0EgQ9DyqbxJOgqKzoNgcRxYU55jIaGL5JhjB8k2Vzdeq0DDkALUP8mLyot3Jt/NwKb6YToww2eQCKJkHpVdBMyugWX6mlvW3aFqTCqFUxmF45gJddVqxWX2AlZ1HCBcGQFPLUNvvQOUjULEGanwF1T6BDs9Bm0293zkGrR2Att7ys65xi2UYzG5Qx7ALx427OPt4j0n7QEuboPoZqPkdtM/J57/0e+Mb6OALkzZApz9BpX1+5/P3PzSuuAeDjwfZZnLhTsgO27wZvSmecjjTuqFa2dU3qjShqh84TqA2DqFyW/zTMmj1NVSmCMW9VckcaDoHg3OUhyJ1W3lj5f65uSfBKT3NCR7GtPSvCJrf4FjXPZSz+LzuY4Cn7R4D2fygYTf3kEvu5An3z+XRl83DW6nhYW4dxnINpt0Gest12Juf8XjvGP31E9iOTmE/OEFvqQrL9hsYSzsYLFTgWa/ifmIOFywsnw6e8iVPGN3BBG7FM7gSS+PiZBY9CyV0pQu4vrSBa6/K6Clso2e5gpuLa7icyqMrkUU342/EZnE7kmxxGER+okMS6Yg4W8LmEvzijoTWXITlEc3okDJFg0EWtz+msZIjpQ7YtQ61UxzaKY5RKFa/YheoFwkodoXifiomboXsQ9NQ7JQWRrCOANrEsn+d8sfL6n+9bP7Xy78B/QzPO9OV/CAAAAAASUVORK5CYII=","aspectRatio":1.5267175572519085,"src":"/static/b18c94100d3b034bc59158680ab07e07/ee604/10questions-1.png","srcSet":"/static/b18c94100d3b034bc59158680ab07e07/69585/10questions-1.png 200w,\n/static/b18c94100d3b034bc59158680ab07e07/497c6/10questions-1.png 400w,\n/static/b18c94100d3b034bc59158680ab07e07/ee604/10questions-1.png 800w,\n/static/b18c94100d3b034bc59158680ab07e07/a8378/10questions-1.png 1024w","srcWebp":"/static/b18c94100d3b034bc59158680ab07e07/58556/10questions-1.webp","srcSetWebp":"/static/b18c94100d3b034bc59158680ab07e07/61e93/10questions-1.webp 200w,\n/static/b18c94100d3b034bc59158680ab07e07/1f5c5/10questions-1.webp 400w,\n/static/b18c94100d3b034bc59158680ab07e07/58556/10questions-1.webp 800w,\n/static/b18c94100d3b034bc59158680ab07e07/cc834/10questions-1.webp 1024w","sizes":"(max-width: 800px) 100vw, 800px"}}},"medium":{"childImageSharp":{"fluid":{"base64":"data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAABQAAAANCAYAAACpUE5eAAAACXBIWXMAABYlAAAWJQFJUiTwAAACrklEQVQ4y51TS0+TURCdyyNpXBjUoEaNJG40UWIiMcbyKPZNH7bFttDSUqSFlvKwhdIGKOVRKUVolYiiGNSNG1f+w+NMrzFx62Lud7/7nTnfnZlzqPOJCWS0gIacIIsXZA+AXCGQNwLyT4ACcdDopA7Z+/jMO64xguUcJblPzTBwUKeRl0E7lNkDJQB3mJOimiD0EjSWAo3P6JC9nMk3wQiWcyRXOAwDNibkRQ2PgKw+0EgQ9DyqbxJOgqKzoNgcRxYU55jIaGL5JhjB8k2Vzdeq0DDkALUP8mLyot3Jt/NwKb6YToww2eQCKJkHpVdBMyugWX6mlvW3aFqTCqFUxmF45gJddVqxWX2AlZ1HCBcGQFPLUNvvQOUjULEGanwF1T6BDs9Bm0293zkGrR2Att7ys65xi2UYzG5Qx7ALx427OPt4j0n7QEuboPoZqPkdtM/J57/0e+Mb6OALkzZApz9BpX1+5/P3PzSuuAeDjwfZZnLhTsgO27wZvSmecjjTuqFa2dU3qjShqh84TqA2DqFyW/zTMmj1NVSmCMW9VckcaDoHg3OUhyJ1W3lj5f65uSfBKT3NCR7GtPSvCJrf4FjXPZSz+LzuY4Cn7R4D2fygYTf3kEvu5An3z+XRl83DW6nhYW4dxnINpt0Gest12Juf8XjvGP31E9iOTmE/OEFvqQrL9hsYSzsYLFTgWa/ifmIOFywsnw6e8iVPGN3BBG7FM7gSS+PiZBY9CyV0pQu4vrSBa6/K6Clso2e5gpuLa7icyqMrkUU342/EZnE7kmxxGER+okMS6Yg4W8LmEvzijoTWXITlEc3okDJFg0EWtz+msZIjpQ7YtQ61UxzaKY5RKFa/YheoFwkodoXifiomboXsQ9NQ7JQWRrCOANrEsn+d8sfL6n+9bP7Xy78B/QzPO9OV/CAAAAAASUVORK5CYII=","aspectRatio":1.527027027027027,"src":"/static/b18c94100d3b034bc59158680ab07e07/62b1f/10questions-1.png","srcSet":"/static/b18c94100d3b034bc59158680ab07e07/e7519/10questions-1.png 113w,\n/static/b18c94100d3b034bc59158680ab07e07/7e7e9/10questions-1.png 225w,\n/static/b18c94100d3b034bc59158680ab07e07/62b1f/10questions-1.png 450w,\n/static/b18c94100d3b034bc59158680ab07e07/e2e7f/10questions-1.png 675w,\n/static/b18c94100d3b034bc59158680ab07e07/db955/10questions-1.png 900w,\n/static/b18c94100d3b034bc59158680ab07e07/a8378/10questions-1.png 1024w","srcWebp":"/static/b18c94100d3b034bc59158680ab07e07/b8a88/10questions-1.webp","srcSetWebp":"/static/b18c94100d3b034bc59158680ab07e07/3a3bf/10questions-1.webp 113w,\n/static/b18c94100d3b034bc59158680ab07e07/975bf/10questions-1.webp 225w,\n/static/b18c94100d3b034bc59158680ab07e07/b8a88/10questions-1.webp 450w,\n/static/b18c94100d3b034bc59158680ab07e07/761da/10questions-1.webp 675w,\n/static/b18c94100d3b034bc59158680ab07e07/210c1/10questions-1.webp 900w,\n/static/b18c94100d3b034bc59158680ab07e07/cc834/10questions-1.webp 1024w","sizes":"(max-width: 450px) 100vw, 450px"}}}},"author":{"id":"9257cd1e-ca7f-578b-a2dd-9c2e74282caf","name":"Smokescreen Team"}}},{"node":{"id":"fc7069d9-c995-5ef5-8b85-8a6eef403d37","title":"Improving Cybersecurity With Adversarial Thinking","content":"
\n

People often ask me about ‘adversarial thinking’ — that somewhat amorphous concept that defines security folk with the uncanny ability to mentally model how things can break.

\n

Whenever this conversation comes up, I’m reminded of an anecdote by Bruce Schneier:

\n

Uncle Milton Industries has been selling ant farms to children since 1956. Some years ago, I remember opening one up with a friend. There were no actual ants included in the box. Instead, there was a card that you filled in with your address, and the company would mail you some ants. My friend expressed surprise that you could get ants sent to you in the mail.

\n

I replied: “What’s really interesting is that these people will send a tube of live ants to anyone you tell them to.”

\n

I had a similar epiphany in my childhood with barcodes in supermarkets. After learning how to read them (back then, my reference material was a random ‘zine on a long-defunct BBS), I immediately wrote a program to print my own.

\n
\n
\n
\n
\n
The forgotten skill of BBS ANSI artwork (source: textfiles.com)
\n

My curiosity was to see how the scanners would react, but I quickly realized that you could swap a legitimate barcode for a product with a much cheaper price (like most innovative criminal enterprises, this has already been done).

\n
\n
\n
\n
\n
An ISSN Barcode Explained
\n

‘Adversarial thinking’, the ‘security mindset’, whatever you call it, it’s apparent that some folks are naturally better at breaking things than others. The gulf is vast — professional red-teamers and bug hunters can immediately find glaring vulnerabilities in systems and processes that others have built and used for years without noticing them.

\n

You can’t even ascribe the difference to some sort of training; most hackers never formally ‘learned’ this stuff.

\n

Embracing adversarial thinking is not just a ‘good to have’, but a ‘must-have’. Without it being the foundation of your defense, you’re doomed to failure. This is far more than hiring a couple of pentesters every quarter, you have to have defenders who think this way. It’s more important than any technology you can buy, or process you can document.

\n

Done right, it’s the single greatest way to improve your security.

\n

Dunning-Kruger and the Cybersecurity Defender

\n

Unfortunately, the cybersecurity industry has built stark schisms between the types of people who can break systems, and those that build or defend them.

\n

The difference is represented in our primary color nomenclature — The ‘red team’ versus the ‘blue team’. Many of the people playing team blue don’t come with the adversarial thinking mindset. They may have transitioned into security from an IT operations role, or just don’t have (or tap into) that way of looking at the world. The differences extend beyond color right into the vocabulary they use. Many blue-teams have the equivalent of elementary school security vocabulary.

\n
\n
\n
\n
\n
\n
\n
\n
\n
\n
\n

Worryingly, they don’t ‘see it’, yet they believe they understand it. Their knowledge of how security systems break is superficial, and their confidence in the tenuous defenses they construct is high. They’re at the early phase of a form of security Dunning-Kruger Effect

\n
\n
\n
\n
\n
The Dunning-Kruger Effect
\n

The Dunning-Kruger effect, occurs where people fail to adequately assess their level of competence — or specifically, their incompetence — at a task and thus consider themselves much more competent than everyone else.

\n

This lack of awareness is attributed to their lower level of competence robbing them of the ability to critically analyse their performance, leading to a significant overestimation of themselves.

\n

The breakers, on the other hand, live, breathe, and sleep this stuff. They view even the physical world in terms of postally-delivered insects and in-store label replacement. It’s not a job, it’s a default world view.

\n

For those amongst you who think like this, you’ll find yourself face-palming in frustration when you hear things like:

\n

Nothing to worry about, we’ve blacklisted all the characters that cause SQL injection.

\n

…

\n

Nobody can break into this server, we’ve firewall-ed every port except HTTP!

\n

…

\n

You have to pen-test my environment only through the firewall, don’t spear-phish my staff, and only target this specific IP address. You must break in under 30 minutes, while standing on a donkey, with your dominant hand tied behind your back.

\n

(The last one is from an actual engagement. Promise).

\n
\n
\n
\n
\n
“Though shalt not limit assessment scope”
\n

This schism leads to defenders complaining that red-teams have huge egos (well okay, many do), and all they do is break in, throw down a report, and ride into the sunset. The onus has been placed on offensive teams to learn to couch their language in order to have their findings accepted.

\n

Hacker subculture values intellectual honesty over political correctness and forced authority figures, so you can imagine how well this tends to go with the typical red team personality who (often rightly) wants to call his defender counterpart a negligent <expletive>, but is constrained from doing so.

\n

The Maker / Breaker Myth

\n

As an aside, there’s another falsehood that must be addressed. Some people assume that breakers are only good at tearing things down. This fits nicely into the black and white, good v/s evil narrative that often accompanies hyped cybersecurity headlines in the news.

\n

The reality couldn’t be further from the truth. Most people who excel in adversarial thinking are also great at making things.

\n

This extends far beyond their Github repositories (though there’s plenty of evidence of creation there), they write, the woodwork, they build companies.

\n

Can Adversarial Thinking Be Learned?

\n

Yes.

\n

Now that we’ve broken Betteridge’s law of headlines, the answer is more nuanced. It can be learned, but I don’t believe it can be taught.

\n

For example, a neophyte quality assurance tester (a great place to find budding penetration testers) may come into the job like Neo in The Matrix; never really aware of their latent abilities until their awakening. Over time, they discover ‘the knack’, and before you know it, you have a version of IBM’s infamous “Black Team”.

\n

This bodes badly for the legions of training programs that promise to remold you into some variant of an OCH (Officially Certified Hacker) in five days or your money back (not).

\n

Those certifications either favor the lowest common denominator of tool-teaching over thought-application or if they do have strong practical testing, the people who do well likely already had the mindset in the first place. The course served to teach them the tradecraft, not the art.

\n

There are notable exceptions, such as the excellent Pentester Academy, where the focus is foundational concepts over tools, and the delivery medium requires a personal passion that often (but not always) goes hand-in-hand with the security mindset.

\n

In the spirit of helpful lists, here are some ways to tickle the adversarial thinking funny bone. If you find these fun, you may just ‘have it’:

\n
    \n
  1. Deconstruct something outside of computer security
    \nLook for the postal-mailed ants in the world around you.
    2. \n
  2. Try lock-picking
    \nLet’s see. An exercise in early-stage frustration requires dedication to master, succeeding is it’s own reward, requires black-box reverse engineering skills. Sounds very much like computer security. Look no further than the amazing Deviant Ollam’s books to start.
    3. \n
  3. Play a Strategy Board Game
    \nAs cliched as it may sound, games like chess, Chinese checkers, and go have strong adversarial thinking precepts including ‘if this, then that’ thinking, and pattern identification.
    4. \n
\n
\n
\n
\n
\n
Lock-picking: Adversarial thinking in meatspace. (source: gizmodo.com)
\n

Hiring Adversarial Thinkers

\n

Since certifications are a bad metric for identifying the skill-set, analyzing experience is a better way to look for the right stuff.

\n

This doesn’t mean hire the person who did 6 years of ‘VA/PT’ at $CONSULTING_COMPANY, instead, ask about how he or she got started with security (look for ant-mailer thinking), and transition into the war-stories of their hardest real-life and computer security hacks.

\n

If they enthusiastically delve into the time they had to balance a nutmeg on a data-center door in order to prevent the fire alarm from sounding, you might have the right person.

\n

Bonus Points: If they reveal confidential information like client names, you can stop right there — they may be good, but you don’t want someone who’s a talker.

\n

If you’re hiring fresh off the boat, you can’t count on past experience, so a far less scientific process will have to suffice. Lateral thinking questions (‘list 10 ways to switch off a light bulb without touching the switch’) are alright, but can quickly end up being dubiously effective.

\n

We’ve always favored giving prospects a really difficult practical challenge, well outside of the realm of their existing domain knowledge. The challenge has different levels, ranging from elementary to either unsolvable or with multiple correct answers. Look for those who:

\n
    \n
  1. Take the time to learn the fundamental concepts of the problem
    2. \n
  2. Apply creative solutions, even if they are wrong (much of adversarial thinking involves extensive trial and error).
    3. \n
  3. Talk enthusiastically about the levels they could not solve and how they approached them (as opposed to those who try to downplay the failure).
    4. \n
\n

Adversarial Thinking in Summary

\n\n

Caveats and Clarifications

\n\n
\n","excerpt":"People often ask me about ‘adversarial thinking’ — that somewhat amorphous\nconcept that defines security folk with the uncanny ability to mentally model\nhow things can break. Here’s how you approach it.\n","slug":"adversarial-thinking-improving-cybersecurity-with-ants-and-barcodes","date":"2017-06-04T10:10:10.000Z","status":"publish","modified":"2021-01-24T16:41:15.000Z","wordpress_id":16808,"featured_media":{"id":"dc204b81-dfa5-5df7-aa16-140453e82d43","source_url":"https://ss-website-content-prod.s3.ap-south-1.amazonaws.com/wp-content/uploads/2017/06/1-R44NpCbrGBxhkiawvPzpew.jpeg","alt_text":"Adversarial Thinking","large":{"childImageSharp":{"fluid":{"base64":"data:image/jpeg;base64,/9j/2wBDABALDA4MChAODQ4SERATGCgaGBYWGDEjJR0oOjM9PDkzODdASFxOQERXRTc4UG1RV19iZ2hnPk1xeXBkeFxlZ2P/2wBDARESEhgVGC8aGi9jQjhCY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2P/wgARCAAMABQDASIAAhEBAxEB/8QAGAAAAgMAAAAAAAAAAAAAAAAAAAUCAwT/xAAUAQEAAAAAAAAAAAAAAAAAAAAA/9oADAMBAAIQAxAAAAHVakmMxOH/xAAYEAEBAQEBAAAAAAAAAAAAAAABAgAhA//aAAgBAQABBQKEqa9Jk44tM8zav//EABQRAQAAAAAAAAAAAAAAAAAAABD/2gAIAQMBAT8BP//EABQRAQAAAAAAAAAAAAAAAAAAABD/2gAIAQIBAT8BP//EABoQAAICAwAAAAAAAAAAAAAAAAABETEQIkH/2gAIAQEABj8C1g4VA0iVeP/EABkQAQEBAQEBAAAAAAAAAAAAAAERACFBYf/aAAgBAQABPyHlQnLN3gnwysr8seyFzs5Rcsrv/9oADAMBAAIAAwAAABAAz//EABQRAQAAAAAAAAAAAAAAAAAAABD/2gAIAQMBAT8QP//EABQRAQAAAAAAAAAAAAAAAAAAABD/2gAIAQIBAT8QP//EAB4QAQADAAICAwAAAAAAAAAAAAEAESExYVFxkaHR/9oACAEBAAE/EGYo96Y7KtY6F1+po3OG2zz1D8J8eIoA5PuNCr7f2f/Z","aspectRatio":1.6666666666666667,"src":"/static/473b37d13c8bf726e6a6d073872a81bf/14b42/1-R44NpCbrGBxhkiawvPzpew.jpg","srcSet":"/static/473b37d13c8bf726e6a6d073872a81bf/f836f/1-R44NpCbrGBxhkiawvPzpew.jpg 200w,\n/static/473b37d13c8bf726e6a6d073872a81bf/2244e/1-R44NpCbrGBxhkiawvPzpew.jpg 400w,\n/static/473b37d13c8bf726e6a6d073872a81bf/14b42/1-R44NpCbrGBxhkiawvPzpew.jpg 800w,\n/static/473b37d13c8bf726e6a6d073872a81bf/47498/1-R44NpCbrGBxhkiawvPzpew.jpg 1200w,\n/static/473b37d13c8bf726e6a6d073872a81bf/0e329/1-R44NpCbrGBxhkiawvPzpew.jpg 1600w","srcWebp":"/static/473b37d13c8bf726e6a6d073872a81bf/58556/1-R44NpCbrGBxhkiawvPzpew.webp","srcSetWebp":"/static/473b37d13c8bf726e6a6d073872a81bf/61e93/1-R44NpCbrGBxhkiawvPzpew.webp 200w,\n/static/473b37d13c8bf726e6a6d073872a81bf/1f5c5/1-R44NpCbrGBxhkiawvPzpew.webp 400w,\n/static/473b37d13c8bf726e6a6d073872a81bf/58556/1-R44NpCbrGBxhkiawvPzpew.webp 800w,\n/static/473b37d13c8bf726e6a6d073872a81bf/99238/1-R44NpCbrGBxhkiawvPzpew.webp 1200w,\n/static/473b37d13c8bf726e6a6d073872a81bf/7c22d/1-R44NpCbrGBxhkiawvPzpew.webp 1600w","sizes":"(max-width: 800px) 100vw, 800px"}}},"medium":{"childImageSharp":{"fluid":{"base64":"data:image/jpeg;base64,/9j/2wBDABALDA4MChAODQ4SERATGCgaGBYWGDEjJR0oOjM9PDkzODdASFxOQERXRTc4UG1RV19iZ2hnPk1xeXBkeFxlZ2P/2wBDARESEhgVGC8aGi9jQjhCY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2P/wgARCAAMABQDASIAAhEBAxEB/8QAGAAAAgMAAAAAAAAAAAAAAAAAAAUCAwT/xAAUAQEAAAAAAAAAAAAAAAAAAAAA/9oADAMBAAIQAxAAAAHVakmMxOH/xAAYEAEBAQEBAAAAAAAAAAAAAAABAgAhA//aAAgBAQABBQKEqa9Jk44tM8zav//EABQRAQAAAAAAAAAAAAAAAAAAABD/2gAIAQMBAT8BP//EABQRAQAAAAAAAAAAAAAAAAAAABD/2gAIAQIBAT8BP//EABoQAAICAwAAAAAAAAAAAAAAAAABETEQIkH/2gAIAQEABj8C1g4VA0iVeP/EABkQAQEBAQEBAAAAAAAAAAAAAAERACFBYf/aAAgBAQABPyHlQnLN3gnwysr8seyFzs5Rcsrv/9oADAMBAAIAAwAAABAAz//EABQRAQAAAAAAAAAAAAAAAAAAABD/2gAIAQMBAT8QP//EABQRAQAAAAAAAAAAAAAAAAAAABD/2gAIAQIBAT8QP//EAB4QAQADAAICAwAAAAAAAAAAAAEAESExYVFxkaHR/9oACAEBAAE/EGYo96Y7KtY6F1+po3OG2zz1D8J8eIoA5PuNCr7f2f/Z","aspectRatio":1.661764705882353,"src":"/static/473b37d13c8bf726e6a6d073872a81bf/32fd5/1-R44NpCbrGBxhkiawvPzpew.jpg","srcSet":"/static/473b37d13c8bf726e6a6d073872a81bf/06e94/1-R44NpCbrGBxhkiawvPzpew.jpg 113w,\n/static/473b37d13c8bf726e6a6d073872a81bf/07ab6/1-R44NpCbrGBxhkiawvPzpew.jpg 225w,\n/static/473b37d13c8bf726e6a6d073872a81bf/32fd5/1-R44NpCbrGBxhkiawvPzpew.jpg 450w,\n/static/473b37d13c8bf726e6a6d073872a81bf/4a838/1-R44NpCbrGBxhkiawvPzpew.jpg 675w,\n/static/473b37d13c8bf726e6a6d073872a81bf/9842e/1-R44NpCbrGBxhkiawvPzpew.jpg 900w,\n/static/473b37d13c8bf726e6a6d073872a81bf/0e329/1-R44NpCbrGBxhkiawvPzpew.jpg 1600w","srcWebp":"/static/473b37d13c8bf726e6a6d073872a81bf/b8a88/1-R44NpCbrGBxhkiawvPzpew.webp","srcSetWebp":"/static/473b37d13c8bf726e6a6d073872a81bf/3a3bf/1-R44NpCbrGBxhkiawvPzpew.webp 113w,\n/static/473b37d13c8bf726e6a6d073872a81bf/975bf/1-R44NpCbrGBxhkiawvPzpew.webp 225w,\n/static/473b37d13c8bf726e6a6d073872a81bf/b8a88/1-R44NpCbrGBxhkiawvPzpew.webp 450w,\n/static/473b37d13c8bf726e6a6d073872a81bf/761da/1-R44NpCbrGBxhkiawvPzpew.webp 675w,\n/static/473b37d13c8bf726e6a6d073872a81bf/210c1/1-R44NpCbrGBxhkiawvPzpew.webp 900w,\n/static/473b37d13c8bf726e6a6d073872a81bf/7c22d/1-R44NpCbrGBxhkiawvPzpew.webp 1600w","sizes":"(max-width: 450px) 100vw, 450px"}}}},"author":{"id":"9257cd1e-ca7f-578b-a2dd-9c2e74282caf","name":"Smokescreen Team"}}},{"node":{"id":"0b6fe724-d0b1-5b1a-a31b-daeeb17e0310","title":"Deception and Kerckhoffs’s Cryptographic Principle","content":"

Conceptually, deception is an incredibly intuitive approach to cybersecurity. The parallels between deception in the real-world, and deception in cyberspace are clear and easy to understand. However, in the digital battlefield it’s far more nuanced — it’s easy to do it badly, and far harder to get it right. Which makes it rather similar to a more traditional security practice — cryptography.

\n

Cryptographers are familiar with a well-known axiom called Kerckhoff’s principle, which states:

\n

A cryptosystem should be secure even if everything about the system, except the key, is public knowledge.

\n

This was famously paraphrased by Claude Shannon in what is known as Shannon’s Maxim:

\n

“The enemy knows the system“, i.e., “one ought to design systems under the assumption that the enemy will immediately gain full familiarity with them“

\n

The applicability to deception is immediately apparent. It should remain effective, even when an attacker:

\n\n

However, the exact map of the minefield — the specific placement of decoys, their running services, and their content is not known. This deception map is the equivalent of the secret key in a crypto-system. As long as the map is not known to the attacker, the illusion should still remain extremely effective, despite the attacker having complete visibility into the rest of the system.

\n

At Smokescreen, we are laser focused on making sure deception is ‘done right’ — with the necessary rigour and formal reasoning to hold up in real-world conditions. How do we do this? Our depth of experience in related cybersecurity disciplines is our secret weapon. We apply hard earned knowledge from red-teaming, asymmetric thinking, threat hunting, cryptography and incident response to build the most formidable and effective deception system available.

\n","excerpt":"The parallels between deception in the real-world, and deception in cyberspace are clear and easy to understand. However, deception in the digital battlefield is far more nuanced — it’s easy to do it badly, and far harder to get it right. Which makes it rather similar to a more traditional security practice — cryptography.\n","slug":"deception-and-kerckhoffss-cryptographic-principle","date":"2017-02-16T10:50:52.000Z","status":"publish","modified":"2020-01-06T07:05:07.000Z","wordpress_id":16772,"featured_media":{"id":"c7ca7a31-c5f1-5880-8111-9cbfd1198f24","source_url":"https://ss-website-content-prod.s3.ap-south-1.amazonaws.com/wp-content/uploads/2017/02/Enigma-plugboard.jpg","alt_text":"Deception","large":{"childImageSharp":{"fluid":{"base64":"data:image/jpeg;base64,/9j/2wBDABALDA4MChAODQ4SERATGCgaGBYWGDEjJR0oOjM9PDkzODdASFxOQERXRTc4UG1RV19iZ2hnPk1xeXBkeFxlZ2P/2wBDARESEhgVGC8aGi9jQjhCY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2P/wgARCAAOABQDASIAAhEBAxEB/8QAFwAAAwEAAAAAAAAAAAAAAAAAAAMEBf/EABYBAQEBAAAAAAAAAAAAAAAAAAIAAf/aAAwDAQACEAMQAAABQ6NgWaUG3//EABoQAAIDAQEAAAAAAAAAAAAAAAECAAMRBBL/2gAIAQEAAQUC5l8LaodDWwK7DsKHf//EABURAQEAAAAAAAAAAAAAAAAAAAAR/9oACAEDAQE/AUf/xAAVEQEBAAAAAAAAAAAAAAAAAAAAEf/aAAgBAgEBPwFX/8QAGRABAAIDAAAAAAAAAAAAAAAAAQAhAhIg/9oACAEBAAY/AryLibnP/8QAGhABAAMBAQEAAAAAAAAAAAAAAQARITFBYf/aAAgBAQABPyEVqOqJ0KesQFX9GbGx0OTQKn//2gAMAwEAAgADAAAAEDzP/8QAFREBAQAAAAAAAAAAAAAAAAAAARD/2gAIAQMBAT8QCf/EABURAQEAAAAAAAAAAAAAAAAAAAEQ/9oACAECAQE/EFn/xAAbEAEBAAMBAQEAAAAAAAAAAAABEQAhMcFxkf/aAAgBAQABPxAAdtioQ7gVpEDn5kg4eBH5gNDyQ5wxJMSOmeY1IR3LfM//2Q==","aspectRatio":1.4705882352941178,"src":"/static/33488cec05051fdb0cde315fb03b25b1/14b42/Enigma-plugboard.jpg","srcSet":"/static/33488cec05051fdb0cde315fb03b25b1/f836f/Enigma-plugboard.jpg 200w,\n/static/33488cec05051fdb0cde315fb03b25b1/2244e/Enigma-plugboard.jpg 400w,\n/static/33488cec05051fdb0cde315fb03b25b1/14b42/Enigma-plugboard.jpg 800w,\n/static/33488cec05051fdb0cde315fb03b25b1/a1fc1/Enigma-plugboard.jpg 921w","srcWebp":"/static/33488cec05051fdb0cde315fb03b25b1/58556/Enigma-plugboard.webp","srcSetWebp":"/static/33488cec05051fdb0cde315fb03b25b1/61e93/Enigma-plugboard.webp 200w,\n/static/33488cec05051fdb0cde315fb03b25b1/1f5c5/Enigma-plugboard.webp 400w,\n/static/33488cec05051fdb0cde315fb03b25b1/58556/Enigma-plugboard.webp 800w,\n/static/33488cec05051fdb0cde315fb03b25b1/147d5/Enigma-plugboard.webp 921w","sizes":"(max-width: 800px) 100vw, 800px"}}},"medium":{"childImageSharp":{"fluid":{"base64":"data:image/jpeg;base64,/9j/2wBDABALDA4MChAODQ4SERATGCgaGBYWGDEjJR0oOjM9PDkzODdASFxOQERXRTc4UG1RV19iZ2hnPk1xeXBkeFxlZ2P/2wBDARESEhgVGC8aGi9jQjhCY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2P/wgARCAAOABQDASIAAhEBAxEB/8QAFwAAAwEAAAAAAAAAAAAAAAAAAAMEBf/EABYBAQEBAAAAAAAAAAAAAAAAAAIAAf/aAAwDAQACEAMQAAABQ6NgWaUG3//EABoQAAIDAQEAAAAAAAAAAAAAAAECAAMRBBL/2gAIAQEAAQUC5l8LaodDWwK7DsKHf//EABURAQEAAAAAAAAAAAAAAAAAAAAR/9oACAEDAQE/AUf/xAAVEQEBAAAAAAAAAAAAAAAAAAAAEf/aAAgBAgEBPwFX/8QAGRABAAIDAAAAAAAAAAAAAAAAAQAhAhIg/9oACAEBAAY/AryLibnP/8QAGhABAAMBAQEAAAAAAAAAAAAAAQARITFBYf/aAAgBAQABPyEVqOqJ0KesQFX9GbGx0OTQKn//2gAMAwEAAgADAAAAEDzP/8QAFREBAQAAAAAAAAAAAAAAAAAAARD/2gAIAQMBAT8QCf/EABURAQEAAAAAAAAAAAAAAAAAAAEQ/9oACAECAQE/EFn/xAAbEAEBAAMBAQEAAAAAAAAAAAABEQAhMcFxkf/aAAgBAQABPxAAdtioQ7gVpEDn5kg4eBH5gNDyQ5wxJMSOmeY1IR3LfM//2Q==","aspectRatio":1.4675324675324675,"src":"/static/33488cec05051fdb0cde315fb03b25b1/32fd5/Enigma-plugboard.jpg","srcSet":"/static/33488cec05051fdb0cde315fb03b25b1/06e94/Enigma-plugboard.jpg 113w,\n/static/33488cec05051fdb0cde315fb03b25b1/07ab6/Enigma-plugboard.jpg 225w,\n/static/33488cec05051fdb0cde315fb03b25b1/32fd5/Enigma-plugboard.jpg 450w,\n/static/33488cec05051fdb0cde315fb03b25b1/4a838/Enigma-plugboard.jpg 675w,\n/static/33488cec05051fdb0cde315fb03b25b1/9842e/Enigma-plugboard.jpg 900w,\n/static/33488cec05051fdb0cde315fb03b25b1/a1fc1/Enigma-plugboard.jpg 921w","srcWebp":"/static/33488cec05051fdb0cde315fb03b25b1/b8a88/Enigma-plugboard.webp","srcSetWebp":"/static/33488cec05051fdb0cde315fb03b25b1/3a3bf/Enigma-plugboard.webp 113w,\n/static/33488cec05051fdb0cde315fb03b25b1/975bf/Enigma-plugboard.webp 225w,\n/static/33488cec05051fdb0cde315fb03b25b1/b8a88/Enigma-plugboard.webp 450w,\n/static/33488cec05051fdb0cde315fb03b25b1/761da/Enigma-plugboard.webp 675w,\n/static/33488cec05051fdb0cde315fb03b25b1/210c1/Enigma-plugboard.webp 900w,\n/static/33488cec05051fdb0cde315fb03b25b1/147d5/Enigma-plugboard.webp 921w","sizes":"(max-width: 450px) 100vw, 450px"}}}},"author":{"id":"9257cd1e-ca7f-578b-a2dd-9c2e74282caf","name":"Smokescreen Team"}}},{"node":{"id":"1aadbf65-a42d-51d9-a616-d1e125eaef18","title":"Gartner identifies deception as a top 10 security technology for 2016","content":"

Industry research and advisory firm Gartner has been tracking deception technology for a while now. Research Director Lawrence Pingree (Twitter) had written about it in 2015. Now, Gartner identifies deception as a top security technology for 2016 in a list it has released.

\n

The researtch firm just released its list of the ‘Top 10 Technologies for Information Security in 2016‘ and deception technology is one of the technologies they recommend. Here’s what they have to say:

\n

Deception technologies are defined by the use of deceits and/or tricks designed to thwart, or throw off, an attacker’s cognitive processes, disrupt an attacker’s automation tools, delay an attacker’s activities or disrupt breach progression. Deception technologies are emerging for network, application, endpoint and data, with the best systems combing multiple techniques. By 2018, Gartner predicts that 10 percent of enterprises will use deception tools and tactics, and actively participate in deception operations against attackers.

\n

The other technologies that made the list are:

\n\n

The growing interest in deception platforms is a result of the realisation that legacy detection systems are too focused on the ever-changing tools of the attacker, and do not deploy defences that are unique from organisation to organisation. As a result, attackers can easily modify their tools to evade these static defences. The evidence is the number of high-profile breaches that have succeeded in spite of antivirus, SIEM, sandboxing and other traditional defences being in place.

\n

Deception technology is now in it’s 3rd generation. If you want to learn about how it offers greatly improved cross kill-chain threat detection along with response mechanisms, read this this blog post.

\n","excerpt":"Gartner lists deception as a top 10 cybersecurity technology for 2016\n","slug":"gartner-identifies-deception-as-a-top-10-security-technology-for-2016","date":"2016-06-15T15:04:50.000Z","status":"publish","modified":"2020-01-06T04:09:26.000Z","wordpress_id":16518,"featured_media":{"id":"3ea00f25-6499-58f4-b977-4cb5dfcd2fbb","source_url":"https://ss-website-content-prod.s3.ap-south-1.amazonaws.com/wp-content/uploads/2016/08/1258.gartnerLogo_Blue_WEB.jpg","alt_text":"Gartner identifies deception","large":{"childImageSharp":{"fluid":{"base64":"data:image/jpeg;base64,/9j/2wBDABALDA4MChAODQ4SERATGCgaGBYWGDEjJR0oOjM9PDkzODdASFxOQERXRTc4UG1RV19iZ2hnPk1xeXBkeFxlZ2P/2wBDARESEhgVGC8aGi9jQjhCY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2P/wgARCAAKABQDASIAAhEBAxEB/8QAFwABAAMAAAAAAAAAAAAAAAAAAAIDBf/EABQBAQAAAAAAAAAAAAAAAAAAAAH/2gAMAwEAAhADEAAAAdqN5AH/xAAXEAEBAQEAAAAAAAAAAAAAAAABAhIg/9oACAEBAAEFAqaHV8//xAAUEQEAAAAAAAAAAAAAAAAAAAAQ/9oACAEDAQE/AT//xAAUEQEAAAAAAAAAAAAAAAAAAAAQ/9oACAECAQE/AT//xAAaEAAABwAAAAAAAAAAAAAAAAAAAhEgITKh/9oACAEBAAY/AoKoprf/xAAZEAACAwEAAAAAAAAAAAAAAAABMRARICH/2gAIAQEAAT8hTRHBC+HH/9oADAMBAAIAAwAAABBwz//EABcRAAMBAAAAAAAAAAAAAAAAAAEQEVH/2gAIAQMBAT8Qh1f/xAAXEQADAQAAAAAAAAAAAAAAAAABEBFR/9oACAECAQE/EKMX/8QAGxABAAICAwAAAAAAAAAAAAAAAREhAFEgQXH/2gAIAQEAAT8QVTx1CEvuIb30MasJCzXD/9k=","aspectRatio":2.0618556701030926,"src":"/static/7f61a0900c89de5dc348fa315eaa944c/14b42/1258.gartnerLogo_Blue_WEB.jpg","srcSet":"/static/7f61a0900c89de5dc348fa315eaa944c/f836f/1258.gartnerLogo_Blue_WEB.jpg 200w,\n/static/7f61a0900c89de5dc348fa315eaa944c/2244e/1258.gartnerLogo_Blue_WEB.jpg 400w,\n/static/7f61a0900c89de5dc348fa315eaa944c/14b42/1258.gartnerLogo_Blue_WEB.jpg 800w,\n/static/7f61a0900c89de5dc348fa315eaa944c/1d3b0/1258.gartnerLogo_Blue_WEB.jpg 1095w","srcWebp":"/static/7f61a0900c89de5dc348fa315eaa944c/58556/1258.gartnerLogo_Blue_WEB.webp","srcSetWebp":"/static/7f61a0900c89de5dc348fa315eaa944c/61e93/1258.gartnerLogo_Blue_WEB.webp 200w,\n/static/7f61a0900c89de5dc348fa315eaa944c/1f5c5/1258.gartnerLogo_Blue_WEB.webp 400w,\n/static/7f61a0900c89de5dc348fa315eaa944c/58556/1258.gartnerLogo_Blue_WEB.webp 800w,\n/static/7f61a0900c89de5dc348fa315eaa944c/c921d/1258.gartnerLogo_Blue_WEB.webp 1095w","sizes":"(max-width: 800px) 100vw, 800px"}}},"medium":{"childImageSharp":{"fluid":{"base64":"data:image/jpeg;base64,/9j/2wBDABALDA4MChAODQ4SERATGCgaGBYWGDEjJR0oOjM9PDkzODdASFxOQERXRTc4UG1RV19iZ2hnPk1xeXBkeFxlZ2P/2wBDARESEhgVGC8aGi9jQjhCY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2P/wgARCAAKABQDASIAAhEBAxEB/8QAFwABAAMAAAAAAAAAAAAAAAAAAAIDBf/EABQBAQAAAAAAAAAAAAAAAAAAAAH/2gAMAwEAAhADEAAAAdqN5AH/xAAXEAEBAQEAAAAAAAAAAAAAAAABAhIg/9oACAEBAAEFAqaHV8//xAAUEQEAAAAAAAAAAAAAAAAAAAAQ/9oACAEDAQE/AT//xAAUEQEAAAAAAAAAAAAAAAAAAAAQ/9oACAECAQE/AT//xAAaEAAABwAAAAAAAAAAAAAAAAAAAhEgITKh/9oACAEBAAY/AoKoprf/xAAZEAACAwEAAAAAAAAAAAAAAAABMRARICH/2gAIAQEAAT8hTRHBC+HH/9oADAMBAAIAAwAAABBwz//EABcRAAMBAAAAAAAAAAAAAAAAAAEQEVH/2gAIAQMBAT8Qh1f/xAAXEQADAQAAAAAAAAAAAAAAAAABEBFR/9oACAECAQE/EKMX/8QAGxABAAICAwAAAAAAAAAAAAAAAREhAFEgQXH/2gAIAQEAAT8QVTx1CEvuIb30MasJCzXD/9k=","aspectRatio":2.0545454545454547,"src":"/static/7f61a0900c89de5dc348fa315eaa944c/32fd5/1258.gartnerLogo_Blue_WEB.jpg","srcSet":"/static/7f61a0900c89de5dc348fa315eaa944c/06e94/1258.gartnerLogo_Blue_WEB.jpg 113w,\n/static/7f61a0900c89de5dc348fa315eaa944c/07ab6/1258.gartnerLogo_Blue_WEB.jpg 225w,\n/static/7f61a0900c89de5dc348fa315eaa944c/32fd5/1258.gartnerLogo_Blue_WEB.jpg 450w,\n/static/7f61a0900c89de5dc348fa315eaa944c/4a838/1258.gartnerLogo_Blue_WEB.jpg 675w,\n/static/7f61a0900c89de5dc348fa315eaa944c/9842e/1258.gartnerLogo_Blue_WEB.jpg 900w,\n/static/7f61a0900c89de5dc348fa315eaa944c/1d3b0/1258.gartnerLogo_Blue_WEB.jpg 1095w","srcWebp":"/static/7f61a0900c89de5dc348fa315eaa944c/b8a88/1258.gartnerLogo_Blue_WEB.webp","srcSetWebp":"/static/7f61a0900c89de5dc348fa315eaa944c/3a3bf/1258.gartnerLogo_Blue_WEB.webp 113w,\n/static/7f61a0900c89de5dc348fa315eaa944c/975bf/1258.gartnerLogo_Blue_WEB.webp 225w,\n/static/7f61a0900c89de5dc348fa315eaa944c/b8a88/1258.gartnerLogo_Blue_WEB.webp 450w,\n/static/7f61a0900c89de5dc348fa315eaa944c/761da/1258.gartnerLogo_Blue_WEB.webp 675w,\n/static/7f61a0900c89de5dc348fa315eaa944c/210c1/1258.gartnerLogo_Blue_WEB.webp 900w,\n/static/7f61a0900c89de5dc348fa315eaa944c/c921d/1258.gartnerLogo_Blue_WEB.webp 1095w","sizes":"(max-width: 450px) 100vw, 450px"}}}},"author":{"id":"9257cd1e-ca7f-578b-a2dd-9c2e74282caf","name":"Smokescreen Team"}}},{"node":{"id":"a88fcb7f-3bf0-5a47-9ada-d4cfbf6e2ab9","title":"Why Deception Matters in Cybersecurity","content":"

A History of Deception

\n

Deception has a centuries-old successful history in military warfare. Military doctrine from Sun Tzu, Genghis Khan, Clausewitz, Machiavelli and Chanakya, all the way through the Second World War has stressed the importance of deceiving the enemy to know their plans and thwart their objectives. Clearly, deception matters.

\n

Military history is rife with examples of crucial victories, won through subterfuge:

\n\n\n\n\n

Information today is the coin of the realm, and as such, using deception and misinformation have never been more topical to modern conflict.

\n

Old Strategies, New Battles

\n

Early in computer security, many attacks were famously thwarted through ingenious deception by the defenders. The most famous examples are Clifford Stoll’s tracking a Russian hacker in the 80’s. The story is told best in his book, The Cuckoo’s Egg

\n

\n

However, as computing evolved and became more complex, this form of active defence was superceded by protective measures — firewalls and antivirus.

\n

Unfortunately, today’s attacks on computer security have shown that protection is both overrated, and impossible to achieve. The largest organisations, from Target Corp. to J.P. Morgan and Sony have been victims of massive hacks, despite
\nhaving every conceivable protection mechanism.

\n

Hackers themselves rely heavily on deception. Social-engineering, or hacking the human, is the number one mechanism used to gain a foothold in the organisation.

\n

\"\"

\n

Why then don’t defenders deploy deception? Up until now it was too hard. Too complex to maintain. That has changed now. Active defence is the future of cyber-security, and organisations that forget the foundational principles of warfare will be on the back-foot in dealing with the most modern form of war.

\n","excerpt":"Deception has a centuries-old successful history in military warfare. Military doctrine from Sun Tzu, Genghis Khan, and Machiavelli, all the way through the Second World War has stressed the importance of deceiving the enemy to know their plans and thwart their objectives.\n","slug":"why-deception-matters","date":"2016-01-10T15:26:16.000Z","status":"publish","modified":"2020-04-20T03:58:10.000Z","wordpress_id":16536,"featured_media":{"id":"e2ba9fa4-3a90-5b34-8703-e21ac1e41a0d","source_url":"https://ss-website-content-prod.s3.ap-south-1.amazonaws.com/wp-content/uploads/2016/08/Theprocessionofthetrojanhorseintroybygiovannidomenicotiepolo.jpg","alt_text":"Deception matters","large":{"childImageSharp":{"fluid":{"base64":"data:image/jpeg;base64,/9j/2wBDABALDA4MChAODQ4SERATGCgaGBYWGDEjJR0oOjM9PDkzODdASFxOQERXRTc4UG1RV19iZ2hnPk1xeXBkeFxlZ2P/2wBDARESEhgVGC8aGi9jQjhCY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2P/wgARCAASABQDASIAAhEBAxEB/8QAGQABAQADAQAAAAAAAAAAAAAAAAQBAgMF/8QAFgEBAQEAAAAAAAAAAAAAAAAAAQAC/9oADAMBAAIQAxAAAAHebl0zu95yc1EWAf/EABoQAAIDAQEAAAAAAAAAAAAAAAECAAMREiP/2gAIAQEAAQUCR/NS1lvUdsi9FeTLgNUAEAZ//8QAFhEAAwAAAAAAAAAAAAAAAAAAABAR/9oACAEDAQE/ASP/xAAWEQADAAAAAAAAAAAAAAAAAAAAEBH/2gAIAQIBAT8BK//EABwQAAICAgMAAAAAAAAAAAAAAAABAiEQMRESYf/aAAgBAQAGPwJ+I7OuMJRG4lpsVGjR/8QAGhABAQEBAQEBAAAAAAAAAAAAAREAITFhgf/aAAgBAQABPyExp0E77r1R7DTuFVnVxcifMIqpcaAL80QA/NI43//aAAwDAQACAAMAAAAQtCB+/8QAFxEBAAMAAAAAAAAAAAAAAAAAEAERQf/aAAgBAwEBPxCoGn//xAAYEQACAwAAAAAAAAAAAAAAAAAAEQEQQf/aAAgBAgEBPxByMZX/xAAcEAEBAAICAwAAAAAAAAAAAAABEQAhYaFRkcH/2gAIAQEAAT8QbbbxFNPmDZbV9HDl9tOHT3htM9pATcneL6OGibAPeVUgXZifabgLowIKtgDONHjP/9k=","aspectRatio":1.1049723756906078,"src":"/static/581ea041147a2c712100ab856de90452/dcf4f/Theprocessionofthetrojanhorseintroybygiovannidomenicotiepolo.jpg","srcSet":"/static/581ea041147a2c712100ab856de90452/f836f/Theprocessionofthetrojanhorseintroybygiovannidomenicotiepolo.jpg 200w,\n/static/581ea041147a2c712100ab856de90452/2244e/Theprocessionofthetrojanhorseintroybygiovannidomenicotiepolo.jpg 400w,\n/static/581ea041147a2c712100ab856de90452/dcf4f/Theprocessionofthetrojanhorseintroybygiovannidomenicotiepolo.jpg 774w","srcWebp":"/static/581ea041147a2c712100ab856de90452/e9050/Theprocessionofthetrojanhorseintroybygiovannidomenicotiepolo.webp","srcSetWebp":"/static/581ea041147a2c712100ab856de90452/61e93/Theprocessionofthetrojanhorseintroybygiovannidomenicotiepolo.webp 200w,\n/static/581ea041147a2c712100ab856de90452/1f5c5/Theprocessionofthetrojanhorseintroybygiovannidomenicotiepolo.webp 400w,\n/static/581ea041147a2c712100ab856de90452/e9050/Theprocessionofthetrojanhorseintroybygiovannidomenicotiepolo.webp 774w","sizes":"(max-width: 774px) 100vw, 774px"}}},"medium":{"childImageSharp":{"fluid":{"base64":"data:image/jpeg;base64,/9j/2wBDABALDA4MChAODQ4SERATGCgaGBYWGDEjJR0oOjM9PDkzODdASFxOQERXRTc4UG1RV19iZ2hnPk1xeXBkeFxlZ2P/2wBDARESEhgVGC8aGi9jQjhCY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2P/wgARCAASABQDASIAAhEBAxEB/8QAGQABAQADAQAAAAAAAAAAAAAAAAQBAgMF/8QAFgEBAQEAAAAAAAAAAAAAAAAAAQAC/9oADAMBAAIQAxAAAAHebl0zu95yc1EWAf/EABoQAAIDAQEAAAAAAAAAAAAAAAECAAMREiP/2gAIAQEAAQUCR/NS1lvUdsi9FeTLgNUAEAZ//8QAFhEAAwAAAAAAAAAAAAAAAAAAABAR/9oACAEDAQE/ASP/xAAWEQADAAAAAAAAAAAAAAAAAAAAEBH/2gAIAQIBAT8BK//EABwQAAICAgMAAAAAAAAAAAAAAAABAiEQMRESYf/aAAgBAQAGPwJ+I7OuMJRG4lpsVGjR/8QAGhABAQEBAQEBAAAAAAAAAAAAAREAITFhgf/aAAgBAQABPyExp0E77r1R7DTuFVnVxcifMIqpcaAL80QA/NI43//aAAwDAQACAAMAAAAQtCB+/8QAFxEBAAMAAAAAAAAAAAAAAAAAEAERQf/aAAgBAwEBPxCoGn//xAAYEQACAwAAAAAAAAAAAAAAAAAAEQEQQf/aAAgBAgEBPxByMZX/xAAcEAEBAAICAwAAAAAAAAAAAAABEQAhYaFRkcH/2gAIAQEAAT8QbbbxFNPmDZbV9HDl9tOHT3htM9pATcneL6OGibAPeVUgXZifabgLowIKtgDONHjP/9k=","aspectRatio":1.107843137254902,"src":"/static/581ea041147a2c712100ab856de90452/32fd5/Theprocessionofthetrojanhorseintroybygiovannidomenicotiepolo.jpg","srcSet":"/static/581ea041147a2c712100ab856de90452/06e94/Theprocessionofthetrojanhorseintroybygiovannidomenicotiepolo.jpg 113w,\n/static/581ea041147a2c712100ab856de90452/07ab6/Theprocessionofthetrojanhorseintroybygiovannidomenicotiepolo.jpg 225w,\n/static/581ea041147a2c712100ab856de90452/32fd5/Theprocessionofthetrojanhorseintroybygiovannidomenicotiepolo.jpg 450w,\n/static/581ea041147a2c712100ab856de90452/4a838/Theprocessionofthetrojanhorseintroybygiovannidomenicotiepolo.jpg 675w,\n/static/581ea041147a2c712100ab856de90452/dcf4f/Theprocessionofthetrojanhorseintroybygiovannidomenicotiepolo.jpg 774w","srcWebp":"/static/581ea041147a2c712100ab856de90452/b8a88/Theprocessionofthetrojanhorseintroybygiovannidomenicotiepolo.webp","srcSetWebp":"/static/581ea041147a2c712100ab856de90452/3a3bf/Theprocessionofthetrojanhorseintroybygiovannidomenicotiepolo.webp 113w,\n/static/581ea041147a2c712100ab856de90452/975bf/Theprocessionofthetrojanhorseintroybygiovannidomenicotiepolo.webp 225w,\n/static/581ea041147a2c712100ab856de90452/b8a88/Theprocessionofthetrojanhorseintroybygiovannidomenicotiepolo.webp 450w,\n/static/581ea041147a2c712100ab856de90452/761da/Theprocessionofthetrojanhorseintroybygiovannidomenicotiepolo.webp 675w,\n/static/581ea041147a2c712100ab856de90452/e9050/Theprocessionofthetrojanhorseintroybygiovannidomenicotiepolo.webp 774w","sizes":"(max-width: 450px) 100vw, 450px"}}}},"author":{"id":"9257cd1e-ca7f-578b-a2dd-9c2e74282caf","name":"Smokescreen Team"}}},{"node":{"id":"db664d04-8c4b-5790-b53c-822001975be9","title":"How to stop attacks – 5 ways Top CSOs do it","content":"
\n
\n
\n
\n
\n

Leading companies are changing their approach to cyber-security.
\nHere are the top 5 ways successful CSOs stop attacks:

\n
    \n
  1. \n

    Focusing on detection and response

    \n

    Preventive controls are ineffective against modern attacks that always find a foot in the door. Modern practitioners assume compromise has occurred, and build detection & response capabilities, instead of trying to plug every single loop-hole. Changing their mindset from prevention to detection is then perhaps the #1 way in which CSOs stop attacks.

    2. \n
  2. \n

    Making security alerts actionable

    \n

    In an average week, companies face 17,000 security alerts, most of which are false alarms that lead to real problems not being dealt with in time. CISOs are opting for technologies with very low false positives (less than 1% of alerts), freeing security teams to act on real threats instead of false positives.

    3. \n
  3. \n

    Increasing internal network visibility

    \n

    ‘Dwell time’ (how long an attacker is undetected in the internal network) is usually measured in months or years. Top security leaders are focusing on internal network visibility to reduce the dwell time to minutes and thwart attacks faster.

    4. \n
  4. \n

    Removing the human element in monitoring

    \n

    Analysts monitoring screens in shifts has proved ineffective as people can’t find suspicious patterns in huge volumes of security data. CISOs of leading companies now favour automated attack detection which reduces dependence on human analysts and lowers operational costs.

    5. \n
  5. \n

    Catching attacks early with threat intelligence

    \n

    Detecting an attack during the planning stage is incredibly powerful as it can be mitigated before it even begins. CISOs are setting up early warning systems to detect when they are targeted and give the security team the time advantage.

    6. \n
\n

Sources: Analysis of targeted attacks in the last 3 years, surveys of C-level executives tasked with security, and 2014 – 2015 industry research reports.

\n
\n
\n
\n
\n
\n","excerpt":"Leading companies are changing their approach to cybersecurity. Here’s how – (1) Focusing on detection and response, (2) Making security alerts actionable, (3) Increasing internal network visibility, (4) Removing the human element in monitoring, and (5) Catching attacks early with threat intelligence.\n","slug":"5-ways-the-most-successful-csos-stop-attacks","date":"2015-11-18T13:16:28.000Z","status":"publish","modified":"2020-01-06T04:52:27.000Z","wordpress_id":16527,"featured_media":{"id":"405fe446-2858-5fc4-9168-1b72fe66c827","source_url":"https://ss-website-content-prod.s3.ap-south-1.amazonaws.com/wp-content/uploads/2016/08/Junction_5.png","alt_text":"CSOs stop attacks","large":{"childImageSharp":{"fluid":{"base64":"data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAABQAAAAOCAYAAAAvxDzwAAAACXBIWXMAAAh9AAAIfQH6tBDfAAABgUlEQVQ4y61Tu65BQRQdj6g9gj/Qikfn/oBOq5KQ0FBqqNUi1GqFhETiC0SNRqNRiCtaEc3MMnvHTLhOcnKSO8nKnsfaa+9ZmRHr9fqeTCYRiURULBZDNBq1oHU8Hv+AE4dyE4kEVqvVXSwWCwghlMZ79AKbO51OIZbLJW/4fD6lAQPaC4fDKJVKKJfLjEqlglQqxWd+v99y9Zw15vO5IsGvqkSmWCwWQeN6veJ4POLxeKBarfJZIBCwfGqG4mw2cxYMBoMcm80mbrcbexUKhT6KvcNV0FQfjUbc4W63w+l0QqfTcfTRVdB4OBwOcT6fUa/X0W63WZy69nxlJz8J4/EY2+3We4cG1FmtVrPryWSCzWbjKvj1Bk1X/X6fr9nr9TAYDHjeaDRcryxfBEUgMSIbH7vdLg6HA/b7PVqtli34Bs57vUNpfor8h58i+adoky+FQgHpdFpms1lkMhkLWufzeY65XM7O/3IolzS0v79C2/KjcVFKkUUS3od85V5I6wnFquOAlttu4wAAAABJRU5ErkJggg==","aspectRatio":1.3986013986013985,"src":"/static/478b35568c2fe570845b94f1863fc66d/2a4de/Junction_5.png","srcSet":"/static/478b35568c2fe570845b94f1863fc66d/69585/Junction_5.png 200w,\n/static/478b35568c2fe570845b94f1863fc66d/497c6/Junction_5.png 400w,\n/static/478b35568c2fe570845b94f1863fc66d/2a4de/Junction_5.png 600w","srcWebp":"/static/478b35568c2fe570845b94f1863fc66d/ad85c/Junction_5.webp","srcSetWebp":"/static/478b35568c2fe570845b94f1863fc66d/61e93/Junction_5.webp 200w,\n/static/478b35568c2fe570845b94f1863fc66d/1f5c5/Junction_5.webp 400w,\n/static/478b35568c2fe570845b94f1863fc66d/ad85c/Junction_5.webp 600w","sizes":"(max-width: 600px) 100vw, 600px"}}},"medium":{"childImageSharp":{"fluid":{"base64":"data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAABQAAAAOCAYAAAAvxDzwAAAACXBIWXMAAAh9AAAIfQH6tBDfAAABgUlEQVQ4y61Tu65BQRQdj6g9gj/Qikfn/oBOq5KQ0FBqqNUi1GqFhETiC0SNRqNRiCtaEc3MMnvHTLhOcnKSO8nKnsfaa+9ZmRHr9fqeTCYRiURULBZDNBq1oHU8Hv+AE4dyE4kEVqvVXSwWCwghlMZ79AKbO51OIZbLJW/4fD6lAQPaC4fDKJVKKJfLjEqlglQqxWd+v99y9Zw15vO5IsGvqkSmWCwWQeN6veJ4POLxeKBarfJZIBCwfGqG4mw2cxYMBoMcm80mbrcbexUKhT6KvcNV0FQfjUbc4W63w+l0QqfTcfTRVdB4OBwOcT6fUa/X0W63WZy69nxlJz8J4/EY2+3We4cG1FmtVrPryWSCzWbjKvj1Bk1X/X6fr9nr9TAYDHjeaDRcryxfBEUgMSIbH7vdLg6HA/b7PVqtli34Bs57vUNpfor8h58i+adoky+FQgHpdFpms1lkMhkLWufzeY65XM7O/3IolzS0v79C2/KjcVFKkUUS3od85V5I6wnFquOAlttu4wAAAABJRU5ErkJggg==","aspectRatio":1.3950617283950617,"src":"/static/478b35568c2fe570845b94f1863fc66d/62b1f/Junction_5.png","srcSet":"/static/478b35568c2fe570845b94f1863fc66d/e7519/Junction_5.png 113w,\n/static/478b35568c2fe570845b94f1863fc66d/7e7e9/Junction_5.png 225w,\n/static/478b35568c2fe570845b94f1863fc66d/62b1f/Junction_5.png 450w,\n/static/478b35568c2fe570845b94f1863fc66d/2a4de/Junction_5.png 600w","srcWebp":"/static/478b35568c2fe570845b94f1863fc66d/b8a88/Junction_5.webp","srcSetWebp":"/static/478b35568c2fe570845b94f1863fc66d/3a3bf/Junction_5.webp 113w,\n/static/478b35568c2fe570845b94f1863fc66d/975bf/Junction_5.webp 225w,\n/static/478b35568c2fe570845b94f1863fc66d/b8a88/Junction_5.webp 450w,\n/static/478b35568c2fe570845b94f1863fc66d/ad85c/Junction_5.webp 600w","sizes":"(max-width: 450px) 100vw, 450px"}}}},"author":{"id":"9257cd1e-ca7f-578b-a2dd-9c2e74282caf","name":"Smokescreen Team"}}},{"node":{"id":"1d2ea42d-0050-51fc-ba1d-1764bdcbceaa","title":"Malware Detection is a Failing Strategy","content":"

Malware detection is a whack-a-mole game. Like the mythical hydra, when you chop off one head, three more appear, But that’s just half the issue.

\n

Bypassing anti-malware systems is so trivial that attackers don’t treat it as a major obstacle. Even newbie pen-testers know how to go from off-the-shelf malware to “fully undetectable”. Believe me, the attackers have it automated, and commoditised.

\n

Worse still, savvy attackers don’t even rely on malware to accomplish their mission objectives. Nowadays, they get by fine with:

\n

Powershell
\nProvides practically any functionality an attacker wants. See the exemplary work by Matt Graeber on Powersploit and  Nikhil Mittal with Nishang. When you can build tools on the box, why risk dropping a binary?

\n

Legitimate administrative tools
\nTeamviewer, pstools, AmmyAdmin and the like. Organisations use these tools to legitimately administer their systems. Well, so do modern attackers. You’re unlikely to find an anti-malware solution that takes a chance blocking something that might be a critical tool for your IT ops team. Attackers know and exploit this free pass. Application white-listing, sandboxing, heuristics, and signatures all go for a toss.

\n

Stolen credentials
\nThe FIN-4 APT attacks exemplify how devastating malware-free attacks can be. Through the use of stolen credentials and legitimate access channels alone, an attacker has more than enough to succeed.

\n

Dmitri Alperovitch of CrowdStrike said it well in his recent article:

\n

Malware is responsible for only 40 percent of breaches and external attackers are increasingly leveraging malware-free intrusion approaches in order to blend in and fly under the radar by assuming insider credentials within victim organizations… Once the adversary was inside the network, they were able to move around using legitimate credentials and windows system administration tools, without actual use of malware.

\n

As we said in the beginning, malware detection is a failing startegy. Stop solving the symptoms, and start solving the problem.

\n","excerpt":"Bypassing anti-malware systems is so trivial that attackers don’t treat it as a major obstacle. Even newbie pen-testers know how to go from off-the-shelf malware to “fully undetectable”. Attackers have it automated. Stop solving the symptoms, and start solving the problem.\n","slug":"malware-detection-is-a-failing-strategy","date":"2015-09-10T15:23:21.000Z","status":"publish","modified":"2020-01-06T04:56:20.000Z","wordpress_id":16533,"featured_media":{"id":"0ade6974-5504-5406-a330-9ecc8c86a91d","source_url":"https://ss-website-content-prod.s3.ap-south-1.amazonaws.com/wp-content/uploads/2016/08/1417280716_malware.jpg","alt_text":"Malware detection","large":{"childImageSharp":{"fluid":{"base64":"data:image/jpeg;base64,/9j/2wBDABALDA4MChAODQ4SERATGCgaGBYWGDEjJR0oOjM9PDkzODdASFxOQERXRTc4UG1RV19iZ2hnPk1xeXBkeFxlZ2P/2wBDARESEhgVGC8aGi9jQjhCY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2P/wgARCAALABQDASIAAhEBAxEB/8QAFwAAAwEAAAAAAAAAAAAAAAAAAAIDBP/EABUBAQEAAAAAAAAAAAAAAAAAAAED/9oADAMBAAIQAxAAAAHQrXtFyQP/xAAaEAEBAAIDAAAAAAAAAAAAAAACARESAAMz/9oACAEBAAEFApMnrVr14fMg5Su3/8QAFxEBAAMAAAAAAAAAAAAAAAAAAAISMf/aAAgBAwEBPwGOKv/EABgRAAIDAAAAAAAAAAAAAAAAAAABAhEx/9oACAECAQE/AZaWz//EAB0QAAECBwAAAAAAAAAAAAAAAAEAEQIQISIxQXH/2gAIAQEABj8CBGlfEDybtVZX/8QAGxABAAIDAQEAAAAAAAAAAAAAAQARITFBUWH/2gAIAQEAAT8hX6LXrMkfYDUQ5jRU9JYUW7DoI//aAAwDAQACAAMAAAAQJw//xAAWEQEBAQAAAAAAAAAAAAAAAAAAESH/2gAIAQMBAT8Q2Q//xAAWEQEBAQAAAAAAAAAAAAAAAAABABH/2gAIAQIBAT8QWKML/8QAHRABAAIDAAMBAAAAAAAAAAAAAQARITFRYYGR0f/aAAgBAQABPxBzNE56Ma9/ZWaAaJS7vw4qO4bjkg0WcsnIYei38j4gNAE//9k=","aspectRatio":1.7857142857142858,"src":"/static/4c2a301349b977538dce5b534799d5fc/14b42/1417280716_malware.jpg","srcSet":"/static/4c2a301349b977538dce5b534799d5fc/f836f/1417280716_malware.jpg 200w,\n/static/4c2a301349b977538dce5b534799d5fc/2244e/1417280716_malware.jpg 400w,\n/static/4c2a301349b977538dce5b534799d5fc/14b42/1417280716_malware.jpg 800w,\n/static/4c2a301349b977538dce5b534799d5fc/67316/1417280716_malware.jpg 950w","srcWebp":"/static/4c2a301349b977538dce5b534799d5fc/58556/1417280716_malware.webp","srcSetWebp":"/static/4c2a301349b977538dce5b534799d5fc/61e93/1417280716_malware.webp 200w,\n/static/4c2a301349b977538dce5b534799d5fc/1f5c5/1417280716_malware.webp 400w,\n/static/4c2a301349b977538dce5b534799d5fc/58556/1417280716_malware.webp 800w,\n/static/4c2a301349b977538dce5b534799d5fc/ba86a/1417280716_malware.webp 950w","sizes":"(max-width: 800px) 100vw, 800px"}}},"medium":{"childImageSharp":{"fluid":{"base64":"data:image/jpeg;base64,/9j/2wBDABALDA4MChAODQ4SERATGCgaGBYWGDEjJR0oOjM9PDkzODdASFxOQERXRTc4UG1RV19iZ2hnPk1xeXBkeFxlZ2P/2wBDARESEhgVGC8aGi9jQjhCY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2P/wgARCAALABQDASIAAhEBAxEB/8QAFwAAAwEAAAAAAAAAAAAAAAAAAAIDBP/EABUBAQEAAAAAAAAAAAAAAAAAAAED/9oADAMBAAIQAxAAAAHQrXtFyQP/xAAaEAEBAAIDAAAAAAAAAAAAAAACARESAAMz/9oACAEBAAEFApMnrVr14fMg5Su3/8QAFxEBAAMAAAAAAAAAAAAAAAAAAAISMf/aAAgBAwEBPwGOKv/EABgRAAIDAAAAAAAAAAAAAAAAAAABAhEx/9oACAECAQE/AZaWz//EAB0QAAECBwAAAAAAAAAAAAAAAAEAEQIQISIxQXH/2gAIAQEABj8CBGlfEDybtVZX/8QAGxABAAIDAQEAAAAAAAAAAAAAAQARITFBUWH/2gAIAQEAAT8hX6LXrMkfYDUQ5jRU9JYUW7DoI//aAAwDAQACAAMAAAAQJw//xAAWEQEBAQAAAAAAAAAAAAAAAAAAESH/2gAIAQMBAT8Q2Q//xAAWEQEBAQAAAAAAAAAAAAAAAAABABH/2gAIAQIBAT8QWKML/8QAHRABAAIDAAMBAAAAAAAAAAAAAQARITFRYYGR0f/aAAgBAQABPxBzNE56Ma9/ZWaAaJS7vw4qO4bjkg0WcsnIYei38j4gNAE//9k=","aspectRatio":1.765625,"src":"/static/4c2a301349b977538dce5b534799d5fc/32fd5/1417280716_malware.jpg","srcSet":"/static/4c2a301349b977538dce5b534799d5fc/06e94/1417280716_malware.jpg 113w,\n/static/4c2a301349b977538dce5b534799d5fc/07ab6/1417280716_malware.jpg 225w,\n/static/4c2a301349b977538dce5b534799d5fc/32fd5/1417280716_malware.jpg 450w,\n/static/4c2a301349b977538dce5b534799d5fc/4a838/1417280716_malware.jpg 675w,\n/static/4c2a301349b977538dce5b534799d5fc/9842e/1417280716_malware.jpg 900w,\n/static/4c2a301349b977538dce5b534799d5fc/67316/1417280716_malware.jpg 950w","srcWebp":"/static/4c2a301349b977538dce5b534799d5fc/b8a88/1417280716_malware.webp","srcSetWebp":"/static/4c2a301349b977538dce5b534799d5fc/3a3bf/1417280716_malware.webp 113w,\n/static/4c2a301349b977538dce5b534799d5fc/975bf/1417280716_malware.webp 225w,\n/static/4c2a301349b977538dce5b534799d5fc/b8a88/1417280716_malware.webp 450w,\n/static/4c2a301349b977538dce5b534799d5fc/761da/1417280716_malware.webp 675w,\n/static/4c2a301349b977538dce5b534799d5fc/210c1/1417280716_malware.webp 900w,\n/static/4c2a301349b977538dce5b534799d5fc/ba86a/1417280716_malware.webp 950w","sizes":"(max-width: 450px) 100vw, 450px"}}}},"author":{"id":"9257cd1e-ca7f-578b-a2dd-9c2e74282caf","name":"Smokescreen Team"}}},{"node":{"id":"b6cfef25-eb71-5b78-b2b3-78990af2fe3b","title":"Lenny Zeltser on Protean Security Tactics","content":"

We’re big fans of the SANS team, and specifically of Lenny Zeltser. It’s gratifying then, to see him discussing deception and active defence in his recent  series  of blog posts, and we highly recommend reading his history of deception in computer security.

\n

Lenny Zeltser is right about deception and active defence on all account. Here, we’d like to extend a couple of his main arguments:

\n
    \n
  1. Thinking asymmetrically
    \nCyber-security has always been a form of asymmetric warfare. The defenders have expensive, monolithic defences, are slow to adapt, and are hampered by ‘terrain’ such as geographical boundaries. The attacker are quick to change tactics, rely heavily on deception, and make use of terrain. This is guerilla warfare, and only an asymmetrical defence will yield results.
    2. \n
  2. Support costs of honeypots
    \n    Honeypots in the traditional sense are expensive to deploy and difficult to maintain. They also increase attack surface for an attacker. However, virtual decoys solve all these problems. They are easy to deploy, administer and monitor, and they do not create vulnerabilities.
    3. \n
\n

When you integrate decoys and active defence into the fabric of the environment, you asymmetrically turn the tables on even the most advanced attackers. They are human after all.

\n","excerpt":"We’re big fans of the SANS team and of Lenny Zelster. Lenny has discussed deception in his recent series of blog posts, and we highly recommend reading his history of deception. Here we extend a couple of his main arguments.\n","slug":"lenny-zeltser-on-protean-security-tactics","date":"2015-05-10T13:57:39.000Z","status":"publish","modified":"2020-01-06T07:05:17.000Z","wordpress_id":16431,"featured_media":{"id":"4c6ca115-85db-5bad-a8a7-05e1bd3a85b4","source_url":"https://ss-website-content-prod.s3.ap-south-1.amazonaws.com/wp-content/uploads/2016/06/bg.jpg","alt_text":"Lenny Zeltser","large":{"childImageSharp":{"fluid":{"base64":"data:image/jpeg;base64,/9j/2wBDABALDA4MChAODQ4SERATGCgaGBYWGDEjJR0oOjM9PDkzODdASFxOQERXRTc4UG1RV19iZ2hnPk1xeXBkeFxlZ2P/2wBDARESEhgVGC8aGi9jQjhCY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2P/wgARCAALABQDASIAAhEBAxEB/8QAFwAAAwEAAAAAAAAAAAAAAAAAAAECBf/EABUBAQEAAAAAAAAAAAAAAAAAAAAB/9oADAMBAAIQAxAAAAHAqGiAX//EABQQAQAAAAAAAAAAAAAAAAAAACD/2gAIAQEAAQUCX//EABQRAQAAAAAAAAAAAAAAAAAAABD/2gAIAQMBAT8BP//EABQRAQAAAAAAAAAAAAAAAAAAABD/2gAIAQIBAT8BP//EABQQAQAAAAAAAAAAAAAAAAAAACD/2gAIAQEABj8CX//EABgQAAIDAAAAAAAAAAAAAAAAAAABIDFB/9oACAEBAAE/IUXkf//aAAwDAQACAAMAAAAQr8//xAAUEQEAAAAAAAAAAAAAAAAAAAAQ/9oACAEDAQE/ED//xAAUEQEAAAAAAAAAAAAAAAAAAAAQ/9oACAECAQE/ED//xAAZEAEBAAMBAAAAAAAAAAAAAAABABEhMUH/2gAIAQEAAT8QQmHk8ADHs6YZWVe3/9k=","aspectRatio":1.7699115044247788,"src":"/static/4bd58c20282a97532a0586a6a69e308a/14b42/bg.jpg","srcSet":"/static/4bd58c20282a97532a0586a6a69e308a/f836f/bg.jpg 200w,\n/static/4bd58c20282a97532a0586a6a69e308a/2244e/bg.jpg 400w,\n/static/4bd58c20282a97532a0586a6a69e308a/14b42/bg.jpg 800w,\n/static/4bd58c20282a97532a0586a6a69e308a/47498/bg.jpg 1200w,\n/static/4bd58c20282a97532a0586a6a69e308a/0e329/bg.jpg 1600w,\n/static/4bd58c20282a97532a0586a6a69e308a/d8255/bg.jpg 1920w","srcWebp":"/static/4bd58c20282a97532a0586a6a69e308a/58556/bg.webp","srcSetWebp":"/static/4bd58c20282a97532a0586a6a69e308a/61e93/bg.webp 200w,\n/static/4bd58c20282a97532a0586a6a69e308a/1f5c5/bg.webp 400w,\n/static/4bd58c20282a97532a0586a6a69e308a/58556/bg.webp 800w,\n/static/4bd58c20282a97532a0586a6a69e308a/99238/bg.webp 1200w,\n/static/4bd58c20282a97532a0586a6a69e308a/7c22d/bg.webp 1600w,\n/static/4bd58c20282a97532a0586a6a69e308a/25f09/bg.webp 1920w","sizes":"(max-width: 800px) 100vw, 800px"}}},"medium":{"childImageSharp":{"fluid":{"base64":"data:image/jpeg;base64,/9j/2wBDABALDA4MChAODQ4SERATGCgaGBYWGDEjJR0oOjM9PDkzODdASFxOQERXRTc4UG1RV19iZ2hnPk1xeXBkeFxlZ2P/2wBDARESEhgVGC8aGi9jQjhCY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2P/wgARCAALABQDASIAAhEBAxEB/8QAFwAAAwEAAAAAAAAAAAAAAAAAAAECBf/EABUBAQEAAAAAAAAAAAAAAAAAAAAB/9oADAMBAAIQAxAAAAHAqGiAX//EABQQAQAAAAAAAAAAAAAAAAAAACD/2gAIAQEAAQUCX//EABQRAQAAAAAAAAAAAAAAAAAAABD/2gAIAQMBAT8BP//EABQRAQAAAAAAAAAAAAAAAAAAABD/2gAIAQIBAT8BP//EABQQAQAAAAAAAAAAAAAAAAAAACD/2gAIAQEABj8CX//EABgQAAIDAAAAAAAAAAAAAAAAAAABIDFB/9oACAEBAAE/IUXkf//aAAwDAQACAAMAAAAQr8//xAAUEQEAAAAAAAAAAAAAAAAAAAAQ/9oACAEDAQE/ED//xAAUEQEAAAAAAAAAAAAAAAAAAAAQ/9oACAECAQE/ED//xAAZEAEBAAMBAAAAAAAAAAAAAAABABEhMUH/2gAIAQEAAT8QQmHk8ADHs6YZWVe3/9k=","aspectRatio":1.765625,"src":"/static/4bd58c20282a97532a0586a6a69e308a/32fd5/bg.jpg","srcSet":"/static/4bd58c20282a97532a0586a6a69e308a/06e94/bg.jpg 113w,\n/static/4bd58c20282a97532a0586a6a69e308a/07ab6/bg.jpg 225w,\n/static/4bd58c20282a97532a0586a6a69e308a/32fd5/bg.jpg 450w,\n/static/4bd58c20282a97532a0586a6a69e308a/4a838/bg.jpg 675w,\n/static/4bd58c20282a97532a0586a6a69e308a/9842e/bg.jpg 900w,\n/static/4bd58c20282a97532a0586a6a69e308a/d8255/bg.jpg 1920w","srcWebp":"/static/4bd58c20282a97532a0586a6a69e308a/b8a88/bg.webp","srcSetWebp":"/static/4bd58c20282a97532a0586a6a69e308a/3a3bf/bg.webp 113w,\n/static/4bd58c20282a97532a0586a6a69e308a/975bf/bg.webp 225w,\n/static/4bd58c20282a97532a0586a6a69e308a/b8a88/bg.webp 450w,\n/static/4bd58c20282a97532a0586a6a69e308a/761da/bg.webp 675w,\n/static/4bd58c20282a97532a0586a6a69e308a/210c1/bg.webp 900w,\n/static/4bd58c20282a97532a0586a6a69e308a/25f09/bg.webp 1920w","sizes":"(max-width: 450px) 100vw, 450px"}}}},"author":{"id":"9257cd1e-ca7f-578b-a2dd-9c2e74282caf","name":"Smokescreen Team"}}}]}},"pageContext":{"id":"0aaaa4e2-c9fd-5357-95d2-3884b38b33c0"}},"staticQueryHashes":["1478079672"]}