![\"Deception](\"https://internal-wp.smokescreen.io/wp-content/uploads/2020/02/Kill-chain-decoys-1024x441.png\")
It’s been heartening to see businesses come forward to help others. We took some time to study how Smokescreen could have the most positive impact. We analysed 500,000+ decoy interactions in our deception platform to see where businesses face the greatest threats.
\n\n\n\nHere’s what we found:
\n\n\n\nYou can read the white paper here.
\n\n\n\nWith a massive increase in Internet-exposed assets and employees working from home, security teams are dealing with a new set of threats. VPN portals, Citrix servers, and other Internet-facing infrastructure are under siege, and COVID themed phishing campaigns are more effective than they’ve ever been.
\n\n\n\nYou’re overworked and need a simple solution to a complex problem that is useful right NOW! We believe perimeter deception can help. You can deploy Internet-facing decoys in under an hour and they will immediately start detecting a variety of Internet-facing threats including:
\n\n\n\nDeception alerts are low false positive so your security team doesn’t have to deal with another dashboard. And since these are high-confidence detections, you can orchestrate responses to automatically contain the threats.
\n\n\n\nWe urge you to set up these decoys because of how low touch and effective they are (our team will do the heavy lifting).
\n\n\n\nWe will openly share the IOCs (indicators of compromise) from this initiative with the broader security community for the greater good.
\n\n\n\nWrite to covid19@smokescreen.io requesting access or fill up this form and my team will set you up asap.
\n\n\n\n\n\n\n\nPentest reports tell a story. The story of how the team managed to break into your environment. In my experience, a critical component usually missing from these reports is the rationale behind the choices made by the pentesters who ran the assessment.
\n\n\n\nAsking why allows you to deconstruct choices that real threat actors might make in your environment. Having a sense of those choices will give you some active defense opportunities.
\n\n\n\nLet me demonstrate this with a little thought experiment. Let’s consider a pentest where the objective was to demonstrate access to the customer database. Here’s what the pentesters broadly did:
\n\n\n\nIn each of these steps, the pentesters made some choices. As you’ll now see, deconstructing these choices can help build better defenses.
\n\n\n\nThe Active Defense matrix was released by MITRE to provide a framework for identifying opportunities where adversary behavior can be influenced to enable defenders to easily spot threats.
\n\n\n\nThe foundation of the Active Defense approach rests on three principles:
\n\n\n\nSo let’s begin by deconstructing each of the 7 steps in the report to identify Active Defense opportunities
\n\n\n\nBlock PowerShell to force the adversary to use non-PowerShell options.
\n\n\n\nSince PowerShell usage for C2 is fairly common, it reduces the risk of being hit with commodity malware that uses PowerShell even today.
\n\n\n\nMITRE Shield Technique: Security Controls
\n\n\n\nSetup attractive decoy accounts, assign attractive privileges, and setup attribute level auditing on description, SPN, etc. to monitor enumeration attempts. This has the added advantage of detecting password spraying regardless of intensity and staggering strategies.
\n\n\n\nGain insight into enumeration activities being conducted against the domain from a user perspective.
\n\n\n\n(Note: Don’t ever use these accounts for any operations. There are ways to make this opsec safe)
\n\n\n\nMITRE Shield Technique: Decoy Account
\n\n\n\nSetup decoy computers, assign attractive hostnames to databases, and setup attribute level auditing on description, SPN, etc. to monitor enumeration attempts.
\n\n\n\nGain insight into enumeration activities being conducted against the domain from a computer perspective.
\n\n\n\nMITRE Shield Technique: Decoy System
\n\n\n\nLet’s assume that Kerberoasting was the privilege escalation technique that worked. In this case, let’s also assume that the service account was a domain admin.
\n\n\n\nMakes the adversary believe they have obtained hashes to the customer database SQL service account while at the same time removing the risk of kerberoasting a real domain admin account.
\n\n\n\nA similar approach can be used for other popular privilege escalation techniques.
\n\n\n\nThere are many techniques available for privilege escalation, and some of them lend themselves well to an Active Defense approach. However, in cases where that doesn’t work, focus on what the adversary intends to accomplish with those privileged credentials.
\n\n\n\nMITRE Shield Technique: Decoy Account, Decoy System, Security Controls
\n\n\n\nEven a single port query against the decoy SQL server system is worth investigating while complicating access to the real customer database.
\n\n\n\nMITRE Shield Technique: Network Diversity, Decoy Diversity, Network Manipulation
\n\n\n\nEven a single port query against the decoy SQL server system is worth investigating while complicating access to the real customer database
\n\n\n\nMITRE Shield Technique: Standard Operating Procedure, Decoy Credentials
\n\n\n\nUnfortunately, if the adversary has reached this point, detection difficulty increases. This is because, from an analytics perspective, you are looking for a legitimate account, logging into a legitimate database, and running possibly legitimate queries. However, there are still things we can do.
\n\n\n\nMITRE Shield Technique: Hunting, System Activity Monitoring
\n\n\n\nI present an abstracted approach to applying Active Defense use cases. It has 4 pieces:
\n\n\n\nYou can use the above as a combination to assess a use case beyond just analyzing pentest reports. The pentest report was just a means for me to present my idea.
\n\n\n\nI would like you to note a few things.
\n\n\n\nFor free, of course.
\n\n\n\nAt this point, I’m positive that you’ve heard of MITRE Shield. It’s a new active defense knowledge base released by MITRE – stuff they’ve been implementing for over a decade to engage adversaries and derail attacks. They’ve opened it up to everyone, and for the first time perhaps, the infosec community has a shared vocabulary and framework for actively defending against attacks instead of reacting to them.
\n\n\n\nI’ve been having conversations about MITRE Shield and Active Defense with CISOs and customers. While some of the conversations are basic and around what is active defense and why does it matter, what I consistently hear from across the board is – “how do we even begin to implement this stuff?” That’s a fair question, but it’s only one part. What more folks aren’t asking is, where do we implement active defenses for the most impact.
\n\n\n\nI’ve zeroed down on four active defense techniques from the MITRE Shield matrix that address both the questions – how do I get started with this and where should I be building active defenses first. Think of this as a soft launch guide for your Active Defense journey.
\n\n\n\nI’ve selected techniques based on two factors:
\n\n\n\nAs a result, all four defenses are Active Directory exclusive. Active Directory has become an adversary favorite attack vector. By deploying active defenses in Active Directory, you’ll be able to make great strides in disrupting adversary actions.
\n\n\n\nOnly two:
\n\n\n\nLet’s dive right in.
\n\n\n\nMITRE Shield Procedure – DPR002
\n\n\n\nPlant decoy accounts in your Active Directory. Any interaction with these accounts is a high-confidence indicator of compromise. These accounts will also help you study the adversary’s actions, mislead attackers by putting these accounts in their path during enumeration, and use them to influence the attacker’s actions and next steps.
\n\n\n\nSet up a decoy account and give it “Domain Admin” privileges. This will make the account interesting to the adversary.
\n\n\n\nIn this video, we focus on detecting the operation. We show how to setup Windows Auditing so that we can capture the appropriate log. We also demonstrate an attack to test if the logs are captured appropriately.
\n\n\n\nPsuedo-code for detection rule:
\n\n\n\nIf login_activity observed for decoy_account then raise a high priority alert.\n\n\n\n
MITRE Shield Procedures – DPR0022 and DPR0033
\n\n\n\nDecoy systems are an excellent active defense tool because they act as a target to lure away attackers from legitimate assets. Decoy content could be anything ranging from fake files to browser shortcuts that act as breadcrumbs to point adversaries to decoy systems.
\n\n\n\nIn this video, we set up a webserver on our test machine to channel an adversary towards interacting with it. We create a browser shortcut and place it in a publically accessible location on the Active Directory Server to make it easier for the adversary to discover.
\n\n\n\nWe ensure that our web server is logging connections. If an adversary attempts to conduct reconnaissance against this webserver, we should see a logline in the webserver log.
\n\n\n\nPsuedo-code for detection rule:
\n\n\n\nIf REQUEST observed for /admin then raise a high priority alert.\n\n\n\n
MITRE Shield Procedure – DPR0024
\n\n\n\nDecoy credentials are fake usernames and passwords that can be planted in a variety of places including in the Active Directory. They act as silent alarms when interacted with and also as a means to delay the attacker.
\n\n\n\nIn this video, we create a batch file planted with fake credentials and store it in a publically accessible location on the Active Directory Server to make it easier for the adversary to discover.
\n\n\n\nIn this video, we show how to set up auditing on your test machine to capture attempts to use the credentials against your test machine.
\n\n\n\nPsuedo-code for detection rule:
\n\n\n\nIf login_event is 4625 AND username is admin\n\n\n\n
Then raise a high priority alert.
MITRE Shield Procedure – DPR0052
\n\n\n\nPocket litter is an active defense technique used to mislead attackers into thinking that the system and user they’re exploiting are legit. You plant fake documents, browser history, browser sessions, etc. to give adversaries the confidence that they are on the right track.
\n\n\n\nIn this video, we will set up a file share on the test machine. We will plant a shortcut to this file share in a publically accessible location on the Active Directory Server to make it easier for the adversary to discover.
\n\n\n\nIn this video, we show how to set up file share auditing on your test machine to capture attempts to access the file share on your machine.
\n\n\n\nPsuedo-code for detection rule:
\n\n\n\nIf login_event is 5140 AND share_name contains shared_folder_name\nThen raise a high priority alert.\n\n\n\n
These folders are accessible to all users within your environment. Over time, these folders accrue a lot of files and scripts that are interesting to adversaries. We wish to use these folders to misdirect the attacker, should the attacker go browsing through these folders. It is also uncommon for regular users to require to browse through this folder.
\n\n\n\nThe focus of this guide was to get your mind thinking about active defense. If there’s one thing I’d like you to walk away with, it’s that if any of these defenses trigger an alarm you will have discovered malicious activity for a couple of hours of effort. And it cost you nothing.
\n\n\n\nAt Smokescreen, we’ve been implementing active defense programs since before it was a thing. No wonder then that Smokescreen covered 95% of MITRE Shield when it launched in Sep 2020. If you’d like to see how we can help, hit us up. Here’s a mapping of Smokescreen to MITRE Shield if it’s helpful.
\n\n\n\nWe’re also running active defense workshops where we deconstruct MITRE Shield and talk about how you can implement it. Feel free to sign up.
\n","excerpt":"For free, of course. At this point, I’m positive that you’ve heard of MITRE Shield. It’s a new active defense knowledge base released by MITRE – stuff they’ve been implementing for over a decade to engage adversaries and derail attacks. They’ve opened it up to everyone, and for the first time perhaps, the infosec community […]\n","slug":"four-mitre-shield-techniques-you-can-implement-in-2021","date":"2020-12-30T16:48:39.000Z","status":"publish","modified":"2021-02-03T07:14:04.000Z","wordpress_id":18652,"featured_media":{"id":"3b48d9b0-598d-52ec-92d7-1eef58be5ea8","source_url":"https://ss-website-content-prod.s3.ap-south-1.amazonaws.com/wp-content/uploads/2020/12/Smokescreen-MITRE-Shield-Techniques.png","alt_text":"Smokescreen-MITRE-Shield-Techniques","large":{"childImageSharp":{"fluid":{"base64":"data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAABQAAAALCAYAAAB/Ca1DAAAACXBIWXMAAAsTAAALEwEAmpwYAAACQklEQVQoz0WSSW8TQRCF84s5IXFBHJEQ4g9wQggOkbhEBEEIS4xDMkZeEhzH8SITJ+N4tu4Zz+6xncerceIcamq6W/11Vb23ZU8mULYN33UxUx5mWsHXGjPfRxgECGezh+Ba9gOea8+Dchy4lgXn5gbCsUwTW/IZXHTR6w/RG11jMrV5mRcJiKIIcRw/BNdRGJZggfpKbaAboDkew6hWcWg0YHRGuDQtFFmKPMuQpSmSJEHKSEooH4jC8sHAlypdeLZF4HRT5ZbFn9HlGOOrK5gTEybXJl+8NDkK7SPP8xKWpMzZkrlgXjBWPFshZQ7DpISWwBuWuf3lKz7sf8f23jd8rBxit/obe8c1NLoXmOcZUsLiyIY3rUG755z5KbRlINZt5MEJVrkFz9UEmmvgzo8D7Faq2Cdk5+AXPlWPcNg6RWc4YtsJsjmQWAfQJ0/gd1/Bbz+D138L3XkO1XyE1PoJpWICr9ctN9pnaHXOcdYfoHXRw1/m7ugfivmcs0yR5bdInD8I2k+he68RCHT4Dqr3Brr1GJl7TGC0BopCmkoFVEwsEVNFmVnKEKWlwpSzy/0zJP0XSNw6YqeBePIZyfg90sFLFH4DygvvKmTL1UoFNcPA8dERDOZms4l6vY4Jh1wqTfi8KLBY3qIo5igWQLFkyN5ixVhQbXstijOlOgyXG4rmLk19Z+gsE0HW1pFqg4CmZhc+za/EMuzMEQ+KZe5tI/4Rujg/uIOJee/NLLCNFxmyJ+ez0tyKqrvlfeFIt/8BWgssJrC5KxYAAAAASUVORK5CYII=","aspectRatio":1.9047619047619047,"src":"/static/edada2176ce537fff9fc98c912eee812/ee604/Smokescreen-MITRE-Shield-Techniques.png","srcSet":"/static/edada2176ce537fff9fc98c912eee812/69585/Smokescreen-MITRE-Shield-Techniques.png 200w,\n/static/edada2176ce537fff9fc98c912eee812/497c6/Smokescreen-MITRE-Shield-Techniques.png 400w,\n/static/edada2176ce537fff9fc98c912eee812/ee604/Smokescreen-MITRE-Shield-Techniques.png 800w,\n/static/edada2176ce537fff9fc98c912eee812/f3583/Smokescreen-MITRE-Shield-Techniques.png 1200w,\n/static/edada2176ce537fff9fc98c912eee812/5707d/Smokescreen-MITRE-Shield-Techniques.png 1600w,\n/static/edada2176ce537fff9fc98c912eee812/0ef64/Smokescreen-MITRE-Shield-Techniques.png 2400w","srcWebp":"/static/edada2176ce537fff9fc98c912eee812/58556/Smokescreen-MITRE-Shield-Techniques.webp","srcSetWebp":"/static/edada2176ce537fff9fc98c912eee812/61e93/Smokescreen-MITRE-Shield-Techniques.webp 200w,\n/static/edada2176ce537fff9fc98c912eee812/1f5c5/Smokescreen-MITRE-Shield-Techniques.webp 400w,\n/static/edada2176ce537fff9fc98c912eee812/58556/Smokescreen-MITRE-Shield-Techniques.webp 800w,\n/static/edada2176ce537fff9fc98c912eee812/99238/Smokescreen-MITRE-Shield-Techniques.webp 1200w,\n/static/edada2176ce537fff9fc98c912eee812/7c22d/Smokescreen-MITRE-Shield-Techniques.webp 1600w,\n/static/edada2176ce537fff9fc98c912eee812/f1e40/Smokescreen-MITRE-Shield-Techniques.webp 2400w","sizes":"(max-width: 800px) 100vw, 800px"}}},"medium":{"childImageSharp":{"fluid":{"base64":"data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAABQAAAAKCAYAAAC0VX7mAAAACXBIWXMAAAsTAAALEwEAmpwYAAACFUlEQVQoz02SS0/bQBSF83f7A7rprpt22S5bqbtu6KpqEaiKUAuEgAgJIQhC0jyI4zi249f4NbZj0OkZJ0pZXM3Ynvl87rmnZhsGTF2HNp1iPtehGyZc10UoBKIwRBzHSLal9lEUVd+E7yPgOW+1gmNZUBxrsUBttVxWsItGA832LVr9R9iOhyKTyLMMaZruSqYx0oTwKEQkAgSeQ6BFoAnFUdBapZA1nkwxnc0w518WpgndtFgmshfQKF0jTApWDhGvkcgSMnumarlTWXN5aULY96Pf+PHnBAeNJg7OznHcucb+aRO261FpjlSmEF4fwh2w3TGE00UiBpDiDqVcwuM522DLLskTtvztVx37x6c4JHCvfoTD5gXOuj2sFDAv2K5AeP8Wwd17iNs38AafETx8QNB5BWn8hO/HBOobDy3W/fAvxjMNY22O4eMMQ+59mv/8VFJdhkxyIA/v4PUJGX5CMPiIYPQVfvc1pH0C34s2CiszWYamwaR/yk/XtuFzgg4nGIaCPuasFIWxh8w6QhbNkdgt7uvItS8oRYfAcAukhwvCri4vcd1u46rVQu/mBr1eD6PRqIqKlLIaSlECWfGELC+54v+areFQxG7KDqEqU2EQIGbO0iRhi5vYKJgkLOG7iGqVYhGoyDCDzqqKjL3tsgKqMKoHNXYV0sDzqgtVqAlXoJdZVM/qfbQNt7JGWVTNgqx/v9rh65njvVwAAAAASUVORK5CYII=","aspectRatio":1.9152542372881356,"src":"/static/edada2176ce537fff9fc98c912eee812/62b1f/Smokescreen-MITRE-Shield-Techniques.png","srcSet":"/static/edada2176ce537fff9fc98c912eee812/e7519/Smokescreen-MITRE-Shield-Techniques.png 113w,\n/static/edada2176ce537fff9fc98c912eee812/7e7e9/Smokescreen-MITRE-Shield-Techniques.png 225w,\n/static/edada2176ce537fff9fc98c912eee812/62b1f/Smokescreen-MITRE-Shield-Techniques.png 450w,\n/static/edada2176ce537fff9fc98c912eee812/e2e7f/Smokescreen-MITRE-Shield-Techniques.png 675w,\n/static/edada2176ce537fff9fc98c912eee812/db955/Smokescreen-MITRE-Shield-Techniques.png 900w,\n/static/edada2176ce537fff9fc98c912eee812/0ef64/Smokescreen-MITRE-Shield-Techniques.png 2400w","srcWebp":"/static/edada2176ce537fff9fc98c912eee812/b8a88/Smokescreen-MITRE-Shield-Techniques.webp","srcSetWebp":"/static/edada2176ce537fff9fc98c912eee812/3a3bf/Smokescreen-MITRE-Shield-Techniques.webp 113w,\n/static/edada2176ce537fff9fc98c912eee812/975bf/Smokescreen-MITRE-Shield-Techniques.webp 225w,\n/static/edada2176ce537fff9fc98c912eee812/b8a88/Smokescreen-MITRE-Shield-Techniques.webp 450w,\n/static/edada2176ce537fff9fc98c912eee812/761da/Smokescreen-MITRE-Shield-Techniques.webp 675w,\n/static/edada2176ce537fff9fc98c912eee812/210c1/Smokescreen-MITRE-Shield-Techniques.webp 900w,\n/static/edada2176ce537fff9fc98c912eee812/f1e40/Smokescreen-MITRE-Shield-Techniques.webp 2400w","sizes":"(max-width: 450px) 100vw, 450px"}}}},"author":{"id":"765e8417-7ed6-55b7-95a7-1d561141e760","name":"Sudarshan Pisupati"}}},{"node":{"id":"9d8a2f78-f1ee-581e-957c-2092fc5a0b66","title":"Active Defense – Incident Response’s New Best Friend","content":"\nOn Sep 14, 2020, MITRE, the federally funded R&D organization perhaps best known for its popular ATT&CK framework, announced Shield – an Active Defense knowledge base developed to arm cybersecurity defenders with a framework for actively dealing with threats instead of passively reacting to them. As MITRE puts it, Shield has been “derived from over 10 years of adversary engagement experience. It spans the range from high level, CISO ready considerations of opportunities and objectives, to practitioner friendly discussions of the TTPs available to defenders.”
\n\n\n\nAs an industry armed with protecting networks and IT infrastructures, we have been overly reliant on passive defenses. Given the rapid pace of technology development, shortage of skilled cybersecurity professionals, and the vendor community’s ‘assume breach’ schtick, we have become accustomed to dealing with threats on our turf, on the adversary’s terms, instead of actively smoking out the threat. We’re always reacting after the fact. Which is why Shield couldn’t have arrived sooner.
\n\n\n\nSince then, I’ve had countless conversations with CISOs attempting to understand how Shield can inform their security posture and incident handlers/practitioners on what they can do today that might have an outsized impact on their ability to defend. I’ve also realized that there’s a fundamental conversation to be had about what ‘active defense’ in cybersecurity means, and why teams must adopt it as an integral part of their security program and best practices.
\n\n\n\nOver the last 10 years, I have been a part of multiple incident response projects. The story usually unfolds in a similar fashion – evidence of compromise is on the network. Jump to the ‘Cotton Eye Joe’ problem – where did it come from, where does it go. And of course, what did it damage.
\n\n\n\nPerhaps the most high-pressure scenarios are those where the threat is not just active but is actively moving around the network, say something like ransomware. Machine after machine is getting infected, and there is nothing you can do to stop it.
\n\n\n\nConsider this nightmare scenario for a moment. You work security for a business with 1000 employees. You don’t have an anti-virus (AV) installed (hypothetical). You have been infected by ransomware. You immediately take a call to purchase an AV, the budget gets freed up, and you go to procure it. But it takes days, even weeks if not months to procure it and push it out to every single workstation and server. Your AV has now future proof-ed you in some way, but the adversary has already finished her attack. You are recovering from the disaster in some form. Maybe you are restoring backups. Maybe you just paid up the ransom. The response was required in minutes and hours. That battle was lost.
\n\n\n\nThe fallouts of such incidents can be brutal. There is intense pressure on security teams, and they carry heavy burdens. I have seen security folks stay up 96 hours at a stretch, trying to squeeze in a couple of minutes of sleep in offices amid thousands of messages, texts, and calls. I have seen top management in companies get involved and ask tough questions to which there are no good answers.
\n\n\n\nIf you are involved in any security function in your organization, at any level, this should be relatable. To some, something like this might have happened recently. For some, it’s been a while. And if it hasn’t happened to you yet, chances are, it will happen at some point – sooner rather than later.
\n\n\n\nAnd then let’s talk money. It costs a lot of money. I’m talking serious cash. In the order of hundreds of thousands of dollars. All being spent in a matter of days. You are paying your vendors, service providers, advisors, and implementers. You are paying by the hour for everyone involved in the response, IT teams, security teams, and active directory teams. And then people wonder why cybersecurity is a $123 billion industry.
\n\n\n\nIt gets chaotic.
\n\n\n\nIn my experience, you can contain that chaos with an Active Defense mindset.
\n\n\n\nActive defense isn’t really a new concept. For example, the armed forces and police have active defense protocols. If intelligence picks up an impending threat, the machinery kicks in to reflect the seriousness of the threat. Intensified checking at posts, barricades across high-value locations and roads, enhanced protective measures for ministers and other high-value targets, orders to restrict the movement of people and goods, frequent patrolling – you get the drift.
\n\n\n\nNow notice this strategy for a moment. It includes a lot of tough calls because the threat has a material impact on the life of civilians. There’s a protocol in place. Also, notice that the strategy doesn’t involve waiting for the bad guy to move around as he pleases. It actively tries to smoke the threat out. The alternative is to play catch up. Always one step behind the threat. Ring any bells? Of course, it does because that’s exactly what we do in cybersecurity.
\n\n\n\nWhat I’m getting to is that when you are in the midst of an incident, you have ways to try to smoke out the threat, make life difficult for the adversary, and minimize the impact of the breach. One that can be measured in days (if not hours), will not be as costly and will reign in panic.
\n\n\n\nIt involves barricades, restriction of movement, enhanced patrolling, and of course, protecting the crown jewels.
\n\n\n\nHere’s how it might look like in a real-life ‘incident’:
\n\n\n\nThis is, of course, a non-exhaustive list but all of these can be really quick to do! The biggest impediment is usually taking the tough calls as this may temporarily and disrupt services. It also happens because of poor team communication across the board. It is because of this that we forgo a defensive advantage and chase the threat for days and months on end.
\n\n\n\nBut hey, if you drill this out before things go wrong, you will already know and understand what the impact is going to be.
\n\n\n\nThink about it this way. You have an existing set of software defenses. That should make life difficult for the software tactics of the threat. Active defense is you putting additional software defenses to attack the human behind the threat.
\n\n\n\nThis brings me back to why MITRE Shield couldn’t have come sooner. For the first time, defenders have a shared vocabulary and framework for what they can proactively do to defend their networks. It even maps out to MITRE ATT&CK, telling you exactly which defense can disrupt an attack tactic. I strongly urge you to check out Shield.
\n\n\n\nIf you need help with understanding this more, we are running 30 mins workshops to deconstruct MITRE Shield and breakdown how you can get started with active defense. Feel free to sign up here.
\n\n\n\nWe have also released our mapping to MITRE Shield. With Smokescreen, you can achieve 95% coverage of all the active defense techniques included in the framework. You can get the mapping from here. And if you want to see all of this in action, you can always ask for a demo.
\n\n\n\nI’m very excited about all the conversations that are happening around MITRE Shield. As we help our customers implement Shield and achieve more active defense coverage, I will be sharing what I learn. Feel free to hit me up on LinkedIn or Twitter.
\n","excerpt":"Active defense provides defenders with a shared vocabulary and framework for actively dealing with threats instead of passively reacting to them.\n","slug":"active-defense-for-incident-responders","date":"2020-12-29T01:34:46.000Z","status":"publish","modified":"2021-01-24T16:42:40.000Z","wordpress_id":18639,"featured_media":{"id":"b7c5bd0f-1190-59a5-8777-52cae2404171","source_url":"https://ss-website-content-prod.s3.ap-south-1.amazonaws.com/wp-content/uploads/2020/12/Smokescreen-Active-defense-blog-post-scaled.jpeg","alt_text":"Active defense","large":{"childImageSharp":{"fluid":{"base64":"data:image/jpeg;base64,/9j/2wBDABALDA4MChAODQ4SERATGCgaGBYWGDEjJR0oOjM9PDkzODdASFxOQERXRTc4UG1RV19iZ2hnPk1xeXBkeFxlZ2P/2wBDARESEhgVGC8aGi9jQjhCY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2P/wgARCAAeABQDASIAAhEBAxEB/8QAGAAAAwEBAAAAAAAAAAAAAAAAAAMEBQL/xAAXAQEBAQEAAAAAAAAAAAAAAAAAAQID/9oADAMBAAIQAxAAAAHhjmc9wlhS3Z1SVGcH/8QAHBAAAgICAwAAAAAAAAAAAAAAAAECEhETITFB/9oACAEBAAEFAoRNaKEevMF1Y4Fhu5sP/8QAFBEBAAAAAAAAAAAAAAAAAAAAIP/aAAgBAwEBPwEf/8QAFBEBAAAAAAAAAAAAAAAAAAAAIP/aAAgBAgEBPwEf/8QAGhAAAQUBAAAAAAAAAAAAAAAAEAABERIgIf/aAAgBAQAGPwLUDrqx/8QAHBABAQEAAgMBAAAAAAAAAAAAAQARITFBUWHh/9oACAEBAAE/ITMnIySLEeluZy5+yTG+W8Q46l+yCjkukofy/9oADAMBAAIAAwAAABCYLEP/xAAVEQEBAAAAAAAAAAAAAAAAAAAgIf/aAAgBAwEBPxCD/8QAFhEBAQEAAAAAAAAAAAAAAAAAEBFB/9oACAECAQE/EKaf/8QAHhABAAICAgMBAAAAAAAAAAAAAQARITFBYVGBkeH/2gAIAQEAAT8QGCBw41FZqumrH9hlpvRdSkYcahaBVVt47I2YepIiqF88TCrrUCEM6mvuO7dUFejqPTcf/9k=","aspectRatio":0.6644518272425249,"src":"/static/4cdd14b89e9545a1913f042df0c033ec/14b42/Smokescreen-Active-defense-blog-post-scaled.jpg","srcSet":"/static/4cdd14b89e9545a1913f042df0c033ec/f836f/Smokescreen-Active-defense-blog-post-scaled.jpg 200w,\n/static/4cdd14b89e9545a1913f042df0c033ec/2244e/Smokescreen-Active-defense-blog-post-scaled.jpg 400w,\n/static/4cdd14b89e9545a1913f042df0c033ec/14b42/Smokescreen-Active-defense-blog-post-scaled.jpg 800w,\n/static/4cdd14b89e9545a1913f042df0c033ec/47498/Smokescreen-Active-defense-blog-post-scaled.jpg 1200w,\n/static/4cdd14b89e9545a1913f042df0c033ec/0e329/Smokescreen-Active-defense-blog-post-scaled.jpg 1600w,\n/static/4cdd14b89e9545a1913f042df0c033ec/4f4f6/Smokescreen-Active-defense-blog-post-scaled.jpg 1700w","srcWebp":"/static/4cdd14b89e9545a1913f042df0c033ec/58556/Smokescreen-Active-defense-blog-post-scaled.webp","srcSetWebp":"/static/4cdd14b89e9545a1913f042df0c033ec/61e93/Smokescreen-Active-defense-blog-post-scaled.webp 200w,\n/static/4cdd14b89e9545a1913f042df0c033ec/1f5c5/Smokescreen-Active-defense-blog-post-scaled.webp 400w,\n/static/4cdd14b89e9545a1913f042df0c033ec/58556/Smokescreen-Active-defense-blog-post-scaled.webp 800w,\n/static/4cdd14b89e9545a1913f042df0c033ec/99238/Smokescreen-Active-defense-blog-post-scaled.webp 1200w,\n/static/4cdd14b89e9545a1913f042df0c033ec/7c22d/Smokescreen-Active-defense-blog-post-scaled.webp 1600w,\n/static/4cdd14b89e9545a1913f042df0c033ec/35cfd/Smokescreen-Active-defense-blog-post-scaled.webp 1700w","sizes":"(max-width: 800px) 100vw, 800px"}}},"medium":{"childImageSharp":{"fluid":{"base64":"data:image/jpeg;base64,/9j/2wBDABALDA4MChAODQ4SERATGCgaGBYWGDEjJR0oOjM9PDkzODdASFxOQERXRTc4UG1RV19iZ2hnPk1xeXBkeFxlZ2P/2wBDARESEhgVGC8aGi9jQjhCY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2P/wgARCAAeABQDASIAAhEBAxEB/8QAGAAAAwEBAAAAAAAAAAAAAAAAAAMEBQL/xAAXAQEBAQEAAAAAAAAAAAAAAAAAAQID/9oADAMBAAIQAxAAAAHhjmc9wlhS3Z1SVGcH/8QAHBAAAgICAwAAAAAAAAAAAAAAAAECEhETITFB/9oACAEBAAEFAoRNaKEevMF1Y4Fhu5sP/8QAFBEBAAAAAAAAAAAAAAAAAAAAIP/aAAgBAwEBPwEf/8QAFBEBAAAAAAAAAAAAAAAAAAAAIP/aAAgBAgEBPwEf/8QAGhAAAQUBAAAAAAAAAAAAAAAAEAABERIgIf/aAAgBAQAGPwLUDrqx/8QAHBABAQEAAgMBAAAAAAAAAAAAAQARITFBUWHh/9oACAEBAAE/ITMnIySLEeluZy5+yTG+W8Q46l+yCjkukofy/9oADAMBAAIAAwAAABCYLEP/xAAVEQEBAAAAAAAAAAAAAAAAAAAgIf/aAAgBAwEBPxCD/8QAFhEBAQEAAAAAAAAAAAAAAAAAEBFB/9oACAECAQE/EKaf/8QAHhABAAICAgMBAAAAAAAAAAAAAQARITFBYVGBkeH/2gAIAQEAAT8QGCBw41FZqumrH9hlpvRdSkYcahaBVVt47I2YepIiqF88TCrrUCEM6mvuO7dUFejqPTcf/9k=","aspectRatio":0.6647058823529411,"src":"/static/4cdd14b89e9545a1913f042df0c033ec/32fd5/Smokescreen-Active-defense-blog-post-scaled.jpg","srcSet":"/static/4cdd14b89e9545a1913f042df0c033ec/06e94/Smokescreen-Active-defense-blog-post-scaled.jpg 113w,\n/static/4cdd14b89e9545a1913f042df0c033ec/07ab6/Smokescreen-Active-defense-blog-post-scaled.jpg 225w,\n/static/4cdd14b89e9545a1913f042df0c033ec/32fd5/Smokescreen-Active-defense-blog-post-scaled.jpg 450w,\n/static/4cdd14b89e9545a1913f042df0c033ec/4a838/Smokescreen-Active-defense-blog-post-scaled.jpg 675w,\n/static/4cdd14b89e9545a1913f042df0c033ec/9842e/Smokescreen-Active-defense-blog-post-scaled.jpg 900w,\n/static/4cdd14b89e9545a1913f042df0c033ec/4f4f6/Smokescreen-Active-defense-blog-post-scaled.jpg 1700w","srcWebp":"/static/4cdd14b89e9545a1913f042df0c033ec/b8a88/Smokescreen-Active-defense-blog-post-scaled.webp","srcSetWebp":"/static/4cdd14b89e9545a1913f042df0c033ec/3a3bf/Smokescreen-Active-defense-blog-post-scaled.webp 113w,\n/static/4cdd14b89e9545a1913f042df0c033ec/975bf/Smokescreen-Active-defense-blog-post-scaled.webp 225w,\n/static/4cdd14b89e9545a1913f042df0c033ec/b8a88/Smokescreen-Active-defense-blog-post-scaled.webp 450w,\n/static/4cdd14b89e9545a1913f042df0c033ec/761da/Smokescreen-Active-defense-blog-post-scaled.webp 675w,\n/static/4cdd14b89e9545a1913f042df0c033ec/210c1/Smokescreen-Active-defense-blog-post-scaled.webp 900w,\n/static/4cdd14b89e9545a1913f042df0c033ec/35cfd/Smokescreen-Active-defense-blog-post-scaled.webp 1700w","sizes":"(max-width: 450px) 100vw, 450px"}}}},"author":{"id":"765e8417-7ed6-55b7-95a7-1d561141e760","name":"Sudarshan Pisupati"}}},{"node":{"id":"34bde990-0a83-5088-90fc-ec45aea87b8a","title":"The curious case of “How many decoys do I need?”","content":"\r\nMany an old sparring session has been witnessed on this subject here at Smokescreen. Buckle up, this is going to be a long read.
\r\n\r\n\r\n\r\nWhen someone asks “How many decoys do I need?”, what they’re really asking is how many decoys do I need to make sure that I can catch the adversary.
\r\n\r\n\r\n\r\nDeception has toed the industry line on this question. It seems natural to want comprehensive coverage. After all, you wouldn’t buy antivirus licenses for just 20% of your organisation. The technology, too, has been able to keep pace – you can literally place deception in every part of your environment. Notice I said, “you can”. Just because you can, doesn’t mean you should.
\r\n\r\n\r\n\r\nThat deception everywhere thinking might have made sense five years ago when deception technology was just hitting the market but does it hold today? To answer that, we’re going to dive into our experience of 80+ deception deployments to see if there’s a case to be made to rethink how we size, scope, and deploy deception in the enterprise.
\r\n\r\n\r\n\r\nWe’re dropping our vendor hat and will analyse this problem from the perspective of the entity we hope to thwart using deception – the attacker / adversary.
\r\n\r\n\r\n\r\nColloquially, the APT. This is either an organised crime group or a nation-state grade attacker. They are targeted in their approach. They want something valuable you have – intel, a database, a transaction processing system, a formula, intellectual property, confidential non-public information, access to your CEOs email, etc. They will deploy specialised, customised malware, infrastructure, and tooling to achieve these means. They spend time understanding you and focus heavily on avoiding detection. If they do get detected, they count on the fact that you won’t do anything about it until they are already gone.
\r\n\r\n\r\n\r\nDefinition of a decoy: Any fake machine, file, credential, account or lure placed in the network.
\r\n\r\n\r\n\r\nLet’s assume that you do not have the ability to do the following in your network:
\r\n\r\n\r\n\r\nLet’s also assume that the initial entry point and the subnet on which the entry point machine resides has no deception whatsoever. It means, you are running blind at the point of first infection.
\r\n\r\n\r\n\r\nWith these constraints, what does an effective deception deployment look like, so you can detect the adversary?
\r\n\r\n\r\n\r\nLet’s say the crown jewel here is the production customer database.
\r\n\r\n\r\n\r\nFor an adversary to be able to access the database (actually, any database), they will need:
\r\n\r\n\r\n\r\nLet’s run a couple of scenarios to see how this plays out.
\r\n\r\n\r\n\r\nDoes deception help in this scenario? The answer is no. In fact, you could cast reasonable doubt on whether any security product will be able to stop this.
\r\n\r\n\r\n\r\nIn such a scenario, the database server reconnaissance has already happened. The adversary will know exactly which set of account credentials are required to login to the server.
\r\n\r\n\r\n\r\nThis scenario throws an interesting question. Where can one find the credentials? What are the options available?
\r\n\r\n\r\n\r\nUnmanaged accounts like in #1 & #2 should be hardened, especially since we are talking about a business-critical system. #5 is also a hard sell in this scenario.
\r\n\r\n\r\n\r\nHow many decoys do you need?
\r\n\r\n\r\n\r\nSo, if you have 10 OS administrators and 10 DB administrators, you’ll need 2 fake AD accounts + 1 network decoy hosting a file share + 20 endpoint decoys.
\r\n\r\n\r\n\r\nHow do you find the hostname or IP address of a database server?
\r\n\r\n\r\n\r\nConsidering the above, the following are the four deception possibilities:
\r\n\r\n\r\n\r\nHow many decoys do you need?
\r\n\r\n\r\n\r\nA couple of Active Directory entries for databases + A network decoy hosting a file share + 2 network decoys hosting decoy databases + the deception in Scenario 2.
\r\n\r\n\r\n\r\nAll in all, at this point, you’ll add around 5 additional decoys.
\r\n\r\n\r\n\r\nHow many Network Decoys do I need?
\r\n\r\n\r\n\r\nNetwork decoys require special consideration as they are the hottest topic of debate because the process of deploying them requires VLAN trunking. The questions are:
\r\n\r\n\r\n\r\nIn our proposed strategy, it is possible for you to avoid trunking entirely. Just add a file share in the same subnet as your real file share. Place a database decoy preceding and succeeding the IP address of the actual database server.
\r\n\r\n\r\n\r\nIf we consider only the “production” version in our database server scenario, we need a total of 3 network decoys (a decoy file share and two fake database servers) to achieve a reasonable strategy that covers the most likely outcomes.
\r\n\r\n\r\n\r\nIf it makes you feel comfortable, you can double this up and it’s still only 6 network decoys.
\r\n\r\n\r\n\r\nIf you want to cover your test and UAT environments for the database server, that’s 9 network decoys.
\r\n\r\n\r\n\r\nIf you want to cover an additional scenario, that’s 18 network decoys.
\r\n\r\n\r\n\r\nThere is a cogent case to be made here that it is certainly not necessary to deploy decoys everywhere and yo’ll still achieve effectiveness. Our example scenario needed no more than 6 network decoys, a couple of fake accounts, fake computer entries in Active Directory, and endpoint deception deployed to a very targeted group.
\r\n\r\n\r\n\r\nWith a focused deployment, you will understand exactly what tactics you are attempting to cover with deception and you can sleep well knowing you have achieved that outcome. If you find yourself attempting to blanket your network with deception, it is likely you are adopting the spray and pray approach which usually has little value. You’ll be chasing sheep when you have the opportunity to catch the wolves.
\r\n","excerpt":"Decoys can be deployed everywhere in your network – current-gen deception technology makes that possible. There are however no free lunches and pervasive deception might come with a cost. So the question is, should you?\n","slug":"how-many-decoys-do-i-need","date":"2020-07-20T06:03:16.000Z","status":"publish","modified":"2020-09-11T02:19:17.000Z","wordpress_id":18421,"featured_media":{"id":"e924a8d1-d814-5487-8d67-de66a2f7b385","source_url":"https://ss-website-content-prod.s3.ap-south-1.amazonaws.com/wp-content/uploads/2020/07/How-many-decoys-do-I-need.png","alt_text":"decoys","large":{"childImageSharp":{"fluid":{"base64":"data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAABQAAAALCAYAAAB/Ca1DAAAACXBIWXMAAAsTAAALEwEAmpwYAAACy0lEQVQozz2SXUiTURjHz76k1Mxmtc3N6TY1/CzX2pyrJnPNPqAvjUbQNygVCV1FdNFFEF0WZBB0IY2KIjMLiqgEr72wD+3jShPS2YZpTS2d/TrvS/rAw/O+nPP8zv9/niMM1ZtQMmO9F13VRvSVbgxqlVm+AW1JBSK/CFFUit5Vhs5ZisbmRJjsCLNMUwFidT7CaJbVglCB6zehqXCzTNaMag96h2w229DaXWRWuYmeaaOwLoiQ/1p7CTkeN5ad9eTWbiTX68YU8mOJBMj1VCOW1fgQJZXsOdXG2w8DhPfsQwhBhk6nVld5BcnxcZ68eKkCNTYXqzb7KDt7gKLodsw7t1DQ1IAp4sdYV4PQVXmkMi/vP37iXX8/JcUuFbSYWZnL6evrY2FhgdJgg7RlxRQMUHPqII79ETa0HsBaX0eWxUGmzSF7iis4fekySjzu6qKltZVYLIbf7ycnJwenw0Hdlq2k0/Pcvv8AscJIWTDM/mMt2N21hJuj7D58jH3HT1Ls9SNWejfzLT4Of/8SCoXoktDe3l56enro7u7mZns7RouVh0+fqYcG9jYj8sxkrytHV+BAay1EZ7WjMVmlejmYax0xdWPsUSfLs7NJ/frF1NQUo6OjTMo6m0rhDTdS2biL9Pw88e8J7L4AIisXvd2pAjWWAjTKEBWoAnv/+QvW4DYuXLmqwtPyvuLxON8TCRbSaXYcOSGt5rH7RIu6Pij3H207J5+TXQKL0CpVQlVgYmJCXmpE2rCyxu3j6/Cw2jQyMsLQ0BCzMzMEmg4iLMqbs/H8TQ+Lsf3QYfn+1mJQrCtAqVLc636GpynKkfMXud5xh2QyydzcHClpdUIe9lPa7h8Y4Omr18Q6u3g3OLgEvBW7K4ewGoNi/b9KodzXvAQsxvT0NAlpdXJykrGxMYal4h8/JpbW//z5zczsrPp9QwoQq6TCQteS9X+wd+nDk8Ie7wAAAABJRU5ErkJggg==","aspectRatio":1.9047619047619047,"src":"/static/33b83b27cd195b73256e62ee8a884b72/ee604/How-many-decoys-do-I-need.png","srcSet":"/static/33b83b27cd195b73256e62ee8a884b72/69585/How-many-decoys-do-I-need.png 200w,\n/static/33b83b27cd195b73256e62ee8a884b72/497c6/How-many-decoys-do-I-need.png 400w,\n/static/33b83b27cd195b73256e62ee8a884b72/ee604/How-many-decoys-do-I-need.png 800w,\n/static/33b83b27cd195b73256e62ee8a884b72/f3583/How-many-decoys-do-I-need.png 1200w,\n/static/33b83b27cd195b73256e62ee8a884b72/5707d/How-many-decoys-do-I-need.png 1600w,\n/static/33b83b27cd195b73256e62ee8a884b72/0ef64/How-many-decoys-do-I-need.png 2400w","srcWebp":"/static/33b83b27cd195b73256e62ee8a884b72/58556/How-many-decoys-do-I-need.webp","srcSetWebp":"/static/33b83b27cd195b73256e62ee8a884b72/61e93/How-many-decoys-do-I-need.webp 200w,\n/static/33b83b27cd195b73256e62ee8a884b72/1f5c5/How-many-decoys-do-I-need.webp 400w,\n/static/33b83b27cd195b73256e62ee8a884b72/58556/How-many-decoys-do-I-need.webp 800w,\n/static/33b83b27cd195b73256e62ee8a884b72/99238/How-many-decoys-do-I-need.webp 1200w,\n/static/33b83b27cd195b73256e62ee8a884b72/7c22d/How-many-decoys-do-I-need.webp 1600w,\n/static/33b83b27cd195b73256e62ee8a884b72/f1e40/How-many-decoys-do-I-need.webp 2400w","sizes":"(max-width: 800px) 100vw, 800px"}}},"medium":{"childImageSharp":{"fluid":{"base64":"data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAABQAAAAKCAYAAAC0VX7mAAAACXBIWXMAAAsTAAALEwEAmpwYAAAChklEQVQozz2RS0gUUBSG78yokaWWOs44D2d8p6OOU76LbApxUZj4gGiVitgm0UWrRKimtZaboqcgWcFsohxdREVDbtJFFlLio2wjvlIcc3z0db1qBw73wDn/f///HBGak0+YswCR6UKk56BzHCU0+Qih9lRESgaW46fIKT+LSEgmJCldZhrRJwqIyncR7sgk8piTwwUuDjoy0BhMiH25hYjULC60XsXb58PiyEYIQZhOp952zy3m5+Z2SI0J7M9wkN5URUpdBeYKN/baMqxVp9G7pahYI0IjFcUUnWTyx08G+vrQx8Yoor2sralhOzy3uxBReiKyc8hurCGpupzMukqMp4o4YEkiwpaCiDFITHImbR13FKijs5Pm5mY8Hg82mw273Y7JbKa7p4fllRX0zjzC0xxU1TfhPFNOyblKWTdSeamexDzp9JAUYyot489akF/T0xQWFjI6Okp/fz9+vx+v10tDQwNZRSXqw0fPXkiQnhCpRmtNlOAENPEWhD5e2jWg3X57Xr5Swy3X2ih1u1U9NTXF/Pw8K1KVz+dTwPu9z1Wv9fpNRGQ0WosdnUyt7GklqdZgRrNNuD3U+9pHuKuIu0+6FSgYDDIpSdnaYuDde4TckTDZePtxUPUf9DzF5MpHxJnRmW2S0LpDGCev/GnkKyIjVzatFJ+vZn1tTYHGxsYISIVvPvgx5BWjTUzj4pUW9qLr4WN1hBBpXak07qgUXt8Al9tvcE/uZ2jkC78XFwkEAiwvLzM7O8viwgLfxsf5PjHJ8OcRNjY2FOGwnA2xJaORCpVKZd2KWJf29mJrc5OlpSVmZmbUDicmJpiWx1pdDexO/JX1qqoGh4bRScL/u9wl/QdHt8WNhvW2hQAAAABJRU5ErkJggg==","aspectRatio":1.9152542372881356,"src":"/static/33b83b27cd195b73256e62ee8a884b72/62b1f/How-many-decoys-do-I-need.png","srcSet":"/static/33b83b27cd195b73256e62ee8a884b72/e7519/How-many-decoys-do-I-need.png 113w,\n/static/33b83b27cd195b73256e62ee8a884b72/7e7e9/How-many-decoys-do-I-need.png 225w,\n/static/33b83b27cd195b73256e62ee8a884b72/62b1f/How-many-decoys-do-I-need.png 450w,\n/static/33b83b27cd195b73256e62ee8a884b72/e2e7f/How-many-decoys-do-I-need.png 675w,\n/static/33b83b27cd195b73256e62ee8a884b72/db955/How-many-decoys-do-I-need.png 900w,\n/static/33b83b27cd195b73256e62ee8a884b72/0ef64/How-many-decoys-do-I-need.png 2400w","srcWebp":"/static/33b83b27cd195b73256e62ee8a884b72/b8a88/How-many-decoys-do-I-need.webp","srcSetWebp":"/static/33b83b27cd195b73256e62ee8a884b72/3a3bf/How-many-decoys-do-I-need.webp 113w,\n/static/33b83b27cd195b73256e62ee8a884b72/975bf/How-many-decoys-do-I-need.webp 225w,\n/static/33b83b27cd195b73256e62ee8a884b72/b8a88/How-many-decoys-do-I-need.webp 450w,\n/static/33b83b27cd195b73256e62ee8a884b72/761da/How-many-decoys-do-I-need.webp 675w,\n/static/33b83b27cd195b73256e62ee8a884b72/210c1/How-many-decoys-do-I-need.webp 900w,\n/static/33b83b27cd195b73256e62ee8a884b72/f1e40/How-many-decoys-do-I-need.webp 2400w","sizes":"(max-width: 450px) 100vw, 450px"}}}},"author":{"id":"765e8417-7ed6-55b7-95a7-1d561141e760","name":"Sudarshan Pisupati"}}},{"node":{"id":"5e1c6dca-c67a-5ab3-b731-b92e52c4ded4","title":"6 Ways Deception Technology Levels Up Your SOC","content":"\nDeception technology enables security teams to evolve from simple log aggregation and static detection use-cases to a proactive, low false-positive detection model, with deep analytics to convert data to information, and finally, heavily automated response mechanisms.
\n\n\n\nIn summary, it arms security operations teams with many of the most desired capabilities of a next-gen SOC.
\n\n\n\nHere’s a low-down of how deception technology levels up your SOC:
\n\n\n\nThere were days (or were there?) where defenders could neatly divide their network into trusted and untrusted. Alas, networks are now more complex than ever and adversaries are ahead for the most part.
\n\n\n\nIt’s no surprise then that the industry has moved to assuming that the environment is hostile, and is likely in various stages of compromise already.
\n\n\n\nThis approach liberates defenders from having to try and plug every weakness (an impossible task!) to baselining and monitoring for compromise in progress.
\n\n\n\nIf security teams have a good baseline and reliable telemetry, they can find even the most sophisticated attackers dwelling within the network.
\n\n\n\nDeception technology already ‘assumes breach’. Decoys are placed on endpoints, in Active Directory, and on the network, in such a way that an attacker in progress will engage with these deceptive assets and reveal their presence.
\n\n\n\nDeception is an ‘active defence’ strategy, designed to make the network hostile for attackers, and to shift the costs of remaining undetected onto them.
\n\n\n\nIn contrast, static security monitoring use-cases fall out of date quickly, and cannot keep up with changing attacker tactics, thus making it easier for attackers to evade detection and dwell within the network for months or even years.
\n\n\n\nHowever, deception does not rely on static use-cases. By targeting the human intent behind an attack, as opposed to the tools, exploits, or techniques being used, deception-based defences can remain effective no matter what the bad guys try in the future.
\n\n\n\nThis means that the modern SOC can stay agile and adaptive to new threats without having to wait to see them first. Deception can also be used by threat- hunters and incident responders to lay down traps both to find evil or dimension the spread of an on-going incident.
\n\n\n\nTraditional SOCs have ‘cried wolf’ far too often. Even with significant tuning, finding the balance between too many alerts, and missing real incidents is extremely challenging and a constant process.
\n\n\n\nA reduction in the number of false positives automatically makes the security team more productive as they can focus on real threats instead of chasing down ghosts.
\n\n\n\nDeception technology has extremely low false positives because nobody should even interact with a decoy system, credential, or file. Any interaction is worthy of investigation, and can even trigger an orchestrated response. This means that the SOC can reduce the number of alerts to only the ones that matter.
\n\n\n\nMost data analytics focuses on ‘collecting everything’ and then trying to make sense of the data. Security is not necessarily a big-data problem, it’s more of a ‘good-data’ problem.
\n\n\n\nSince deception systems only see anomalous or malicious traffic, data-analytics can be applied to better understand the threats within the network instead of hunting for a needle in a haystack (or ElasticSearch DB!).
\n\n\n\nThis also means that the SOC can move from consuming static, external threat intelligence (which is not specific, and often stale) to creating its own threat intelligence and IOCs that are more relevant to the business, and can better inform future defences.
\n\n\n\nIn order to deal with threats at wire-speed, you need orchestrated response mechanisms. However, the challenge is to find orchestration triggers that are so reliable that a human being does not have to validate them before the response is actually fired. Failing to do so can mean that response actions trigger on false positives, which can lead to disruption of legitimate business activity.
\n\n\n\nWith low false positives and built-in orchestration and integration capabilities, a deception platform can enable ‘continuous response’, reliably detecting compromised assets and users within the network, and investigating, containing or eradicating the threat automatically, without the need for human intervention.
\n\n\n\nWhile security teams have typically focused more on external adversaries, the insider with legitimate access is far harder to tackle. They often have detailed knowledge of the security mechanisms in place and can tailor their malicious intent to look completely benign.
\n\n\n\nDeception can detect insiders seeking out data on high-value target personnel, searching for systems they should not access, or copying and opening data that they are not authorised to. It also injects an element of unpredictability; deception deployments are invisible to normal users, and the placement of decoys is known only to a limited trusted circle, so the insider will either not know of the existence or the placement of the deception. This also serves as a deterrent against casual fraud or misplaced inquisitiveness by internal employees.
\n\n\n\nDeception is a crucial component of the modern SOC. The use of adversarial thinking against the attacker changes the game for defenders, letting them ‘punch above their weight’ against sophisticated adversaries.
\n\n\n\nWant to learn how Smokescreen’s deception platform fits into your SOC? Download the whitepaper.
\n","excerpt":"Learn how deception technology enables SOCs to move from simple log aggregation and static detection use-cases to a proactive, low false-positive detection model that heavily automates response mechanisms.\n","slug":"6-ways-deception-technology-levels-up-your-soc","date":"2020-02-11T12:54:00.000Z","status":"publish","modified":"2021-01-24T16:44:20.000Z","wordpress_id":18362,"featured_media":{"id":"5f8ebc04-8b45-5d4d-a533-1fac6ca83dc5","source_url":"https://ss-website-content-prod.s3.ap-south-1.amazonaws.com/wp-content/uploads/2020/01/SOC-Deception-scaled.jpeg","alt_text":"Deception SOC","large":{"childImageSharp":{"fluid":{"base64":"data:image/jpeg;base64,/9j/2wBDABALDA4MChAODQ4SERATGCgaGBYWGDEjJR0oOjM9PDkzODdASFxOQERXRTc4UG1RV19iZ2hnPk1xeXBkeFxlZ2P/2wBDARESEhgVGC8aGi9jQjhCY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2P/wgARCAANABQDASIAAhEBAxEB/8QAFgABAQEAAAAAAAAAAAAAAAAAAAMC/8QAFAEBAAAAAAAAAAAAAAAAAAAAAP/aAAwDAQACEAMQAAABgmNJj//EABgQAQEAAwAAAAAAAAAAAAAAAAARASFB/9oACAEBAAEFAsuqu6//xAAUEQEAAAAAAAAAAAAAAAAAAAAQ/9oACAEDAQE/AT//xAAUEQEAAAAAAAAAAAAAAAAAAAAQ/9oACAECAQE/AT//xAAUEAEAAAAAAAAAAAAAAAAAAAAg/9oACAEBAAY/Al//xAAZEAACAwEAAAAAAAAAAAAAAAAAQREhgQH/2gAIAQEAAT8hbSRxjaVNpP/aAAwDAQACAAMAAAAQsA//xAAUEQEAAAAAAAAAAAAAAAAAAAAQ/9oACAEDAQE/ED//xAAUEQEAAAAAAAAAAAAAAAAAAAAQ/9oACAECAQE/ED//xAAdEAEAAgICAwAAAAAAAAAAAAABACERMUFRYaHB/9oACAEBAAE/EFoPtAYuSlvKcdxA8r7is/RggbpdN6g0k578T//Z","aspectRatio":1.492537313432836,"src":"/static/f595f7c786f638b097be04b800fd5c5f/14b42/SOC-Deception-scaled.jpg","srcSet":"/static/f595f7c786f638b097be04b800fd5c5f/f836f/SOC-Deception-scaled.jpg 200w,\n/static/f595f7c786f638b097be04b800fd5c5f/2244e/SOC-Deception-scaled.jpg 400w,\n/static/f595f7c786f638b097be04b800fd5c5f/14b42/SOC-Deception-scaled.jpg 800w,\n/static/f595f7c786f638b097be04b800fd5c5f/47498/SOC-Deception-scaled.jpg 1200w,\n/static/f595f7c786f638b097be04b800fd5c5f/0e329/SOC-Deception-scaled.jpg 1600w,\n/static/f595f7c786f638b097be04b800fd5c5f/4a461/SOC-Deception-scaled.jpg 2560w","srcWebp":"/static/f595f7c786f638b097be04b800fd5c5f/58556/SOC-Deception-scaled.webp","srcSetWebp":"/static/f595f7c786f638b097be04b800fd5c5f/61e93/SOC-Deception-scaled.webp 200w,\n/static/f595f7c786f638b097be04b800fd5c5f/1f5c5/SOC-Deception-scaled.webp 400w,\n/static/f595f7c786f638b097be04b800fd5c5f/58556/SOC-Deception-scaled.webp 800w,\n/static/f595f7c786f638b097be04b800fd5c5f/99238/SOC-Deception-scaled.webp 1200w,\n/static/f595f7c786f638b097be04b800fd5c5f/7c22d/SOC-Deception-scaled.webp 1600w,\n/static/f595f7c786f638b097be04b800fd5c5f/ab8d3/SOC-Deception-scaled.webp 2560w","sizes":"(max-width: 800px) 100vw, 800px"}}},"medium":{"childImageSharp":{"fluid":{"base64":"data:image/jpeg;base64,/9j/2wBDABALDA4MChAODQ4SERATGCgaGBYWGDEjJR0oOjM9PDkzODdASFxOQERXRTc4UG1RV19iZ2hnPk1xeXBkeFxlZ2P/2wBDARESEhgVGC8aGi9jQjhCY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2P/wgARCAANABQDASIAAhEBAxEB/8QAFgABAQEAAAAAAAAAAAAAAAAAAAMC/8QAFAEBAAAAAAAAAAAAAAAAAAAAAP/aAAwDAQACEAMQAAABgmNJj//EABgQAQEAAwAAAAAAAAAAAAAAAAARASFB/9oACAEBAAEFAsuqu6//xAAUEQEAAAAAAAAAAAAAAAAAAAAQ/9oACAEDAQE/AT//xAAUEQEAAAAAAAAAAAAAAAAAAAAQ/9oACAECAQE/AT//xAAUEAEAAAAAAAAAAAAAAAAAAAAg/9oACAEBAAY/Al//xAAZEAACAwEAAAAAAAAAAAAAAAAAQREhgQH/2gAIAQEAAT8hbSRxjaVNpP/aAAwDAQACAAMAAAAQsA//xAAUEQEAAAAAAAAAAAAAAAAAAAAQ/9oACAEDAQE/ED//xAAUEQEAAAAAAAAAAAAAAAAAAAAQ/9oACAECAQE/ED//xAAdEAEAAgICAwAAAAAAAAAAAAABACERMUFRYaHB/9oACAEBAAE/EFoPtAYuSlvKcdxA8r7is/RggbpdN6g0k578T//Z","aspectRatio":1.486842105263158,"src":"/static/f595f7c786f638b097be04b800fd5c5f/32fd5/SOC-Deception-scaled.jpg","srcSet":"/static/f595f7c786f638b097be04b800fd5c5f/06e94/SOC-Deception-scaled.jpg 113w,\n/static/f595f7c786f638b097be04b800fd5c5f/07ab6/SOC-Deception-scaled.jpg 225w,\n/static/f595f7c786f638b097be04b800fd5c5f/32fd5/SOC-Deception-scaled.jpg 450w,\n/static/f595f7c786f638b097be04b800fd5c5f/4a838/SOC-Deception-scaled.jpg 675w,\n/static/f595f7c786f638b097be04b800fd5c5f/9842e/SOC-Deception-scaled.jpg 900w,\n/static/f595f7c786f638b097be04b800fd5c5f/4a461/SOC-Deception-scaled.jpg 2560w","srcWebp":"/static/f595f7c786f638b097be04b800fd5c5f/b8a88/SOC-Deception-scaled.webp","srcSetWebp":"/static/f595f7c786f638b097be04b800fd5c5f/3a3bf/SOC-Deception-scaled.webp 113w,\n/static/f595f7c786f638b097be04b800fd5c5f/975bf/SOC-Deception-scaled.webp 225w,\n/static/f595f7c786f638b097be04b800fd5c5f/b8a88/SOC-Deception-scaled.webp 450w,\n/static/f595f7c786f638b097be04b800fd5c5f/761da/SOC-Deception-scaled.webp 675w,\n/static/f595f7c786f638b097be04b800fd5c5f/210c1/SOC-Deception-scaled.webp 900w,\n/static/f595f7c786f638b097be04b800fd5c5f/ab8d3/SOC-Deception-scaled.webp 2560w","sizes":"(max-width: 450px) 100vw, 450px"}}}},"author":{"id":"34627d50-53e7-5dda-bb36-6ab2c0cf489d","name":"Amir Moin"}}}]},"costSectionImage":{"childImageSharp":{"fluid":{"base64":"data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAABQAAAANCAYAAACpUE5eAAAACXBIWXMAAAsTAAALEwEAmpwYAAADUklEQVQ4yzWSW2gcZRzFzzcze02y273OfWdnZ3dmr9mmSUsiaaJtV+0lNppaGmukTcEHgygWtS8iKAUFRSEvggj6JoJPPha1j74IfREUBC+ICIKgD2K7mfn7n10dOAzfzHy/Od/5H4xGDVzb6aPSaeeyhl2ZdepW2qx5Sd3qirK2JKnWCaHb56HZO9DMZ4Rm3YBm3YRq7kuq8aFQjU8yVv3LGct5F4AEuVyBVCofl8rqT6xfpKr+h6Sa/0iaSUK3SJgOgSVbdUrbLgmjRtBtYiihqk9VqvLa/A7HH/aAQinWCyiWCWV+UeYPVIM3WRFsNxQ1L4TjhTPNzkGx1T3g9QFDxwwdJwx7LFT9LooVgt34Gucv98ELBpbfQ4kfVrS7SaMWJq16lPH8SHJakahPJTfaLD8SthvBqEXsOso5XsTRhBOH9dbneHzXgmyYMfRWDEzxH3Nei3LNNhUGC5T1+wTXJ+EGJPFdbgTEQJIdj7IshaEczRTY7H6KK88VIfKVOT7u95wd5erNcC4IorQXUL6/QIeGiyS1eiS8DkN9Uvgu1RoTKXG2GsdS1SOUVULn8Pt45Z00RKHiMnCc4CHkXT+aZRfJoEf5zgLlh0skMxDsMHYn11sTh1LskqGp+Oj/AwdHb+LWN0qc3ygeiKyaYY6zyrd7UX7+MBXmj9CMP5g44wxJZqjitlj+ZOoZBiZjYEXj7PV7WFi+LhFxcw4Vn50ORL2Xc1vhXKcb5oJeWOwNo1SzG8FpRiJWrRGBh8XZRXIM0u2I2zB1pxp/4djaVcSXUlE/Ev9VRqgWZdwmzbTapLADxL2zG7HiqYYwWLodcnYhqgZLG087aP2G1dEmllaBREV9OuF4d9Kdwbey3/0x3Rv+qjSD36WG/2cq6P2d6Q7HuaMrlPK7pDiNScEli4tu2qRw7txhLrv9Mx58dA3nLgGnYpubO6s4e2kDDz22JU5uXBHrp/dw36mXxfIDr8srJ96SV+7fTyyvf5BcXPlYHix+JnXmv1Da/a+yQf9Ooub+kPL7t3Hm4hE8chkozWUFntwD1jeQeXVf4MbbCl58IyleejOD51+bxe71Ap7Y07B1zcGFXR9bV+ex+dQx3ryGje0Rzm2fwekL2+yuibMX8S+BMBcPGVLWLQAAAABJRU5ErkJggg==","aspectRatio":1.528735632183908,"src":"/static/739e365bb81f8bf83185927701d2793f/651c0/cost-image-2x.png","srcSet":"/static/739e365bb81f8bf83185927701d2793f/e223a/cost-image-2x.png 133w,\n/static/739e365bb81f8bf83185927701d2793f/66882/cost-image-2x.png 265w,\n/static/739e365bb81f8bf83185927701d2793f/651c0/cost-image-2x.png 530w,\n/static/739e365bb81f8bf83185927701d2793f/a384c/cost-image-2x.png 795w,\n/static/739e365bb81f8bf83185927701d2793f/c884a/cost-image-2x.png 1056w","srcWebp":"/static/739e365bb81f8bf83185927701d2793f/46494/cost-image-2x.webp","srcSetWebp":"/static/739e365bb81f8bf83185927701d2793f/a5ef1/cost-image-2x.webp 133w,\n/static/739e365bb81f8bf83185927701d2793f/4dc00/cost-image-2x.webp 265w,\n/static/739e365bb81f8bf83185927701d2793f/46494/cost-image-2x.webp 530w,\n/static/739e365bb81f8bf83185927701d2793f/5b747/cost-image-2x.webp 795w,\n/static/739e365bb81f8bf83185927701d2793f/950f5/cost-image-2x.webp 1056w","sizes":"(max-width: 530px) 100vw, 530px"}}}},"pageContext":{"id":"3951c28c-b5e0-5095-ac9d-8dd0a526e23e","relatedPostsIDs":[18707,18652,18639,18421,18362]}},"staticQueryHashes":["1478079672"]}