![\"\"](\"https://internal-wp.smokescreen.io/wp-content/uploads/2020/02/Screenshot-2020-01-23-at-8.50.57-PM-1024x457-1.png\")
Deception technology is all the rage these days. From mature security teams at large enterprises to lean teams at mid-market companies, almost everyone is beginning to see the benefits of early threat detection. While there are clear merits, there is a lot of vendor-speak out there that might make it hard for you to evaluate if deception is the right approach for your security strategy.
\r\n\r\n\r\n\r\nWith this guide, we intend to answer some questions around what the technology is, who it’s for, what it’s capable of doing (and not doing), key use cases, and advantages. We’re going to keep it simple but go fairly deep where necessary. So grab a cup of coffee (or beer depending on when you’re reading this) and strap in.
\r\n\r\n\r\n\r\nLet’s start with the basic definition. Deception technology is a simple but effective approach to building security defences that detect threats early with low false positives and minimal performance impact on the network. The technology works by creating decoys – realistic-but-fake assets (domains, databases, servers, applications, files, credentials, cookies, sessions, and more) that are deployed in your network alongside legitimate assets. For an attacker who has breached the network, there is no way to differentiate the fake from the real. The moment they interact with a decoy, a silent alarm is raised while the systems collect information on the attacker’s actions and intent.
\r\n\r\n\r\n\r\nModern-day deception technology-based cybersecurity defences borrow heavily from proven military deception principles employed by the likes of Chanakya, Sun Tzu, Napoleon, and Genghis Khan to conquer continents by use of deceit, camouflage, and subterfuge. The most famous example of military deception perhaps is Operation Fortitude which was devised by the Allied forces to mislead the German high command as to the location of the invasion eventually leading to the Normandy landings.
\r\n\r\n\r\n\r\nIn the context of cybersecurity, defenders use decoys and lures to mislead attackers into believing that they have a foothold in the network and revealing themselves. The beauty of this approach lies in its simplicity.
\r\n\r\n\r\n\r\nPicture two adversaries with comparable capabilities but differing goals facing off against each other. The odds of either of them winning are usually at a coin toss. What if one of the two had the benefit of speed, flexibility, and targeted information? It’s no contest. The speedier, more nimble of the adversaries will usually outcompete their opponent. Even so, the latter has greater strength and access to more information. Why? Because the opponent with more information falls into ‘analysis paralysis’. They have so much information that analysing all of it becomes infeasible and some information must be prioritised over the rest. This is how adversaries lacking in strength usually win an adversarial contest.
\r\n\r\n\r\n\r\nSomething very similar happens in cybersecurity. Consider for a minute how things have played out over the past couple of decades.
\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\nAttacker: Let’s play a game with some simple rules. I’ll try to access your information or other resources. If I’m successful once, I win.
\r\n
Defender: Sounds fair.
Attacker: If you prevent me from being able to reach my target at any time including otherwise rough or busy days, after-hours, on weekends and holidays… you win.
Defender: …
No wonder we’re losing. It’s a rigged game. As a defender, you need to be right 100% of the time. The attacker just has to be right once. Thankfully, deception flips the table by placing the burden of success on the attackers instead. Once you populate your network with decoys, adversaries need to carry out a flawless attack without interacting with any deceptive assets, triggering any detection controls, or prompting other defensive actions, to succeed in their attack. In other words, the attacker now needs to be right 100% of the time, while a single mistake hands the defenders a win.
\r\n\r\n\r\n\r\nDeception technology is attack-vector-agnostic. It only ever looks at the intent of the adversary to detect attacks. No legitimate user has any business accessing a decoy system, file or application. Therefore, by design, any interaction with a decoy is suspicious at a minimum and malicious at worst. Since deception-based defences do not depend on signatures or heuristics for detection, they are able to detect virtually any attack including APTs, zero-days, reconnaissance, lateral movement, malwareless attacks, social engineering, man-in-the-middle attacks, and ransomware in real-time.
\r\n\r\n\r\n\r\nYes and no. Against the vast majority of adversaries, deception is extremely effective because it leverages the fact that they do not know everything about the network they’re trying to move around. Since decoys are essentially just another asset in the network and their strength is functional and not technical, differentiating them from legitimate assets is virtually impossible.
\r\n\r\n\r\n\r\nFurther, by injecting fake records in a user’s browser history, password manager, and other common points of internal reconnaissance, the attacker can be deceived about functional uses of decoys, making them appear like they are either regularly-used assets – indicating they’re likely useful and can be used by the attacker to move laterally to what appears to be a valuable target – or an infrequently-used but valuable asset – indicating they can be used to access privileged and/or critical information.
\r\n\r\n\r\n\r\nHowever, deception can lose some of its efficacy against attackers with extensive knowledge of the various components needed for a successful attack and their functional use. A malicious member of the team responsible for a deception deployment, for instance, is a prime candidate for such activity. Even here, though, deception can be extremely effective when coupled with other tools in your security stack. Monitoring access to privileged and sensitive resources through other solutions such as PIMs and DLPs goes a long way towards covering these blind spots in a deception program. This fits right into a defence-in-depth strategy.
\r\n\r\n\r\n\r\nIt’s assumed that deception is a capability deployed only by highly mature security organizations. While this was largely true five years ago, we have identified that the large mid-market enterprise and smaller companies also find the technology extremely attractive. Deception is becoming a mainstream capability across markets. Here’s how:
\r\n\r\n\r\n\r\nForward-leaning, big-budget, large-security-team-type organisations benefit from deception as an optimisation across their threat detection, internal threat intelligence creation, and response capabilities.
\r\n\r\n\r\n\r\nLarge customers look to detect better, more advanced threats with deception and leverage the low false-positive alerts either for proactive threat-hunting, or integrated response through enforcement technologies that they have already invested in. This market segment has led the way for deception being more broadly adopted.
\r\n\r\n\r\n\r\nThe mid-market CISO is faced with a conundrum — Her security team and budget are small, but she still has a significant threat and risk perception (perhaps she’s in an industry without compliance regulations driving investment).
\r\n\r\n\r\n\r\nShe’s got some basic security hygiene in place but needs to do something to detect more serious threats. Her wish list from a solution is:
\r\n\r\n\r\n\r\nDeception perfectly checks all the boxes above for her, letting her quickly start punching above her weight when it comes to more advanced, targeted threats.
\r\n\r\n\r\n\r\nWhen we launched IllusionBLACK in 2015, our CEO Sahir Hidayatullah, wrote a manifesto outlining the key advantages of deception technology. 5 years and 4 generations of deception platform later, those advantages still hold.
\r\n\r\n\r\n\r\nIn anti-submarine warfare, the sighting of a periscope breaking the water is an unambiguous indicator of an imminent threat. We believe deception alerts are very similar, and term them ‘periscope events’ — a behavior that, when detected, clearly indicates that an attacker is in the network.
\r\n\r\n\r\n\r\nIf you place detection classes on a scale of accuracy, at one extreme you have:
\r\n\r\n\r\n\r\nDeception’s periscope events are the middle ground — highly accurate, but with broad threat coverage (we can broadly detect any type of submarine with extremely low false positives).
\r\n\r\n\r\n\r\nMost security controls are not aware of current business risks (your antivirus does not know or care that you’re going through an M&A). However, deception is intrinsically aligned with the current business threat perception. For example, if a company is launching a new product, it can create deception around that product launch, aligning security controls tightly to areas where the organisation perceives risk.
\r\n\r\n\r\n\r\nSince deception is a detection class, it can be applied broadly horizontally across the enterprise, including environments that are often neglected blindspots. For example, deception can detect threats at the perimeter, the endpoint, the network, Active Directory, and application layers, as well as offer coverage to more neglected environments such as SCADA/ICS, IoT, and cloud.
\r\n\r\n\r\n\r\nUnlike point solutions, deception also covers the entire kill-chain; from pre-attack reconnaissance to exploitation, privilege escalation, lateral movement, and data-theft / destruction.
\r\n\r\n\r\n\r\nFalse positives cripple security team productivity and drag both IT and security teams through convoluted triage workflows. Often, the process of trying to validate the alert is more time consuming than the actual remediation measure.
\r\n\r\n\r\n\r\nDeception has an intrinsic low false-positive property — nobody should open a decoy file, log in to a decoy application, use a decoy credential, or scan a decoy server. However, the alerts are also far more contextual; giving insight into the attacker’s intent (“they went for the R&D information, not the financial systems”).
\r\n\r\n\r\n\r\nMost behavior-based systems try to establish a normal baseline and then classify any activity above the baseline as anomalous, this leads to a number of false positives. Deception establishes a zero-activity normal baseline, where any activity at all is worthy of investigation.
\r\n\r\n\r\n\r\nIt also gives detailed IOCs (indicators of compromise). Everything that happens on a decoy is considered evil; so analysts don’t need to weed through the data to segregate legitimate user activity and forensically relevant artifacts. Not only can you detect more reliably, but you can ‘know your enemy’ far better.
\r\n\r\n\r\n\r\nYou can also use deception to qualify medium or ‘warm’ alerts from other platforms. For example, a UEBA system may generate a medium risk score for a user’s behavior, leaving the analyst in no man’s land — “is this a threat, or a false positive?” Dynamic deployment of deception on and around that user’s environment may result in a higher-order detection if the attack is real.
\r\n\r\n\r\n\r\nRing-fencing potential problem areas in this manner is also exceptionally useful during incident response in environments where the available logging is limited, but a rapid increase in visibility is required. If the DMZ may be compromised, lay down deception and watch for privilege escalation or lateral movement detection while the root cause of the compromise is being investigated. This can help answer two of the most fundamental questions in incident response, “how far in did they get, and are they still in?”.
\r\n\r\n\r\n\r\nOrchestrated / automated response is most useful only when the trigger event is 100% certain. While plenty of orchestration tooling is being built (like shovels during the gold rush), not many real-world transformational orchestration use cases exist because there are very few alerts that are 100% certain. The ones that are, typically don’t require orchestration, because the products that generate them already contain remedial capabilities (for example, an antivirus detection quarantining a file).
\r\n\r\n\r\n\r\nDeception alerts are highly certain, contextual, and real-time, affording opportunities for security teams to orchestrate more complex and invasive scenarios (for example, use of a decoy credential can result in automatic redirection of the compromised asset into a decoy environment, while disabling the logged-on user’s account and access in the real environment).
\r\n\r\n\r\n\r\nIn terms of containment / response use cases, deception alerts can integrate with:
\r\n\r\n\r\n\r\nSince deception alerts are contextual, the response can also target the appropriate application. For example, if an attacker targets a decoy SWIFT server in a banking environment, the user’s account can be disabled for the real SWIFT server.
\r\n\r\n\r\n\r\nDeception is being used to detect threats across the kill-chain starting with reconnaissance going all the way up to data theft. Broadly, we see three key use cases.
\r\n\r\n\r\n\r\n![\"\"](\"https://internal-wp.smokescreen.io/wp-content/uploads/2020/02/Decoys-for-the-entire-kill-chain-1-1024x377.png\")
At a time when it’s possible to scan all IPv4 IPs in under an hour, monitoring all inbound connections – even just the unusual ones – becomes like drinking from the proverbial fire hose. With VMs available in the cloud within minutes, the noise comes not just from suspicious visitors to a page or from adversaries targeting the organisation, but from almost anyone that can create a cloud account and run a script or two.
\r\n\r\n\r\n\r\nSecurity isn’t a big data problem so much as a good data problem.
\r\n\r\n\r\n\r\nSetting up deceptive public-facing assets, if done right, can drastically simplify this problem and give you actionable telemetry on who’s targeting you. This is different from simply setting up a traditional honeypot with a number of open ports on a public IP. Such a setup is going to generate noisy alerts as everything from Google and Shodan to scripts for college research projects trying to connect to these honeypots. Instead, deploying decoys that mimic beta/staging applications can create high-confidence alerts telling you that an attacker is attempting to reach specific public-facing (but unannounced) infrastructure. Irrespective of their reason and methodology for doing so – including scripts set up to search for such infrastructure belonging to specific organisations, the alerts produced become a high-confidence indicator of intent to locate sensitive infrastructure belonging to your organisation.
\r\n\r\n\r\n\r\nThese alerts become useful pivot points to check for other activity in the valuable but voluminous logs from the WAF (Web Application Firewall) and other sources. For example, other interactions by the source attempting to access public-facing decoys can be looked into and the source optionally blocked. If successful login attempts are discovered, resetting the user’s credentials and enabling 2FA (Two Factor Authentication) for the account are common first steps for a containment… You get the idea.
\r\n\r\n\r\n\r\nBarring insider threats, once attackers gain a foothold in an organisation, they’re like a new employee on day one except for the onboarding – they have a very broad sense of the objective they need to achieve, but no information on the relative location of the things they need or how to get there.
\r\n\r\n\r\n\r\nA strategically deployed set of decoy internal servers and workstations play well here, being available as targets to the attacker. However, simply deploying decoys leaves the odds of them being targeted at not much better than random chance. Effective network deception requires the decoys to be placed in the various locations an attacker might peruse to identify targets; better still if they can be made to look not just like valuable assets on the network, but systems that the appropriate legitimate users interact with to perform their tasks.
\r\n\r\n\r\n\r\nRegular users know the hostnames or network locations of the databases they need to administer, the document servers they need to pull files from, the hosts they must remote into. Even forgetful users that connect to a couple of incorrect hosts in the course of looking for the one they want are unlikely to continue once they can see that they have connected to a different host than the one they intended to connect to.
\r\n\r\n\r\n\r\nAn attacker, on the other hand, often has something of value to glean from connecting to a different system than the one they seek to target. This results in different behavior from a regular user, making attacker interactions with decoys easy to differentiate from a user that mistyped an IP. As with other types of deception, such alerts then make for great points to begin investigations from.
\r\n\r\n\r\n\r\nConsider your usage of the file system on your machine. More often than not, you probably know which file you want and where it’s located. For folks that deal with a large number of local files, you may search through the file system using some keywords you know to be associated with or present in the file you’re looking for.
\r\n\r\n\r\n\r\nHowever, if a decoy file is placed on your system, it’s unlikely to affect any tasks you need to perform, particularly if you know it’s a decoy. To an attacker, though, a file that appears to have legitimate and valuable content, and looks like it is accessed by the user, is a candidate for exfiltration.
\r\n\r\n\r\n\r\nCoupled with fake processes, and breadcrumbs pointing to decoy workstations/servers posing as legitimate systems accessed by the user, endpoint deception can be put to use to detect not just behavior that would be suspicious on the network, but also behavior that would be the norm on the network but has no legitimate place on a particular endpoint at a particular time.
\r\n\r\n\r\n\r\nEven a malicious insider who might be familiar with weaknesses in existing defences doesn’t have extensive knowledge of every valuable file on other endpoints. Additionally, since the goal of many attacks is data theft, theft of decoy files becomes a particularly high priority signal because it indicates an attacker may be close to accomplishing their goal – after all, an attacker stealing decoy files is likely to also be stealing real ones.
\r\n\r\n\r\n\r\nDeception technology is a “force multiplier” for a number of existing capabilities that organisations may already have implemented. Here are some examples:
\r\n\r\n\r\n\r\nEndpoint detection can be significantly improved with deception. An attacker using decoy credentials stored in memory, following a decoy SSH or RDP session, or trying to escalate privileges by exploiting a decoy running process provides extremely reliable indicators of malicious host-based activity. The EDR can ‘fill in the blanks’ into what happened before (which processes ran, what other network connections were created etc.)
\r\n\r\n\r\n\r\nUser Entity and Behavior Analytics (UEBA) systems are prone to false positives and data paralysis, especially in larger, geographically disparate networks where analysts may not have the context to validate an alert (Eric in the Paris security team doesn’t know why Nakamura san is uploading a lot of data in Tokyo).
\r\n\r\n\r\n\r\nHowever, the UEBA system can provide excellent enrichment to a deception alert, fleshing out the user backstory. For example, if a decoy file is copied and the user is suddenly logging in outside of office hours concurrently from two places, the detection is very likely to be real.
\r\n\r\n\r\n\r\nSandboxing was deception 1.0, focused on convincing malware to detonate and reveal its cards. Modern deception is sandboxing for the human attacker. By providing a wider virtual ‘attack surface’, and a believable environment for them to progress their attack, higher-order forensics can be developed.
\r\n\r\n\r\n\r\nMany threat intelligence services offer dumps of malware hashes, domains or IPs that rapidly go stale or are devoid of context (“block these 5000 IPs because they’re from China”). The commercial ramp-up to more specific threat intelligence is significant, and often only consumable by extremely mature security organisations.
\r\n\r\n\r\n\r\nWhile deception is typically seen as a behind-the-firewall capability, it is possible to deploy Internet-facing decoys that only engage with targeted threats against a named organization. These ‘private threat intelligence’ decoys give predictive analytics of attacker activity early on in the reconnaissance phase of the kill chain.
\r\n\r\n\r\n\r\nFor example, decoy Amazon S3 buckets incorporating the company’s name can identify attempted reconnaissance, while decoy UAT, staging and testbed subdomains can identify attackers looking for a weak way in. Decoy login portals / webmail systems / VPNs can also reliably uncover spear-phished credentials (attackers need somewhere to use them). More business-specific use cases include decoy credit cards with a specific bank BIN or fake insurance policyholder information that may be targeted at renewal time.
\r\n\r\n\r\n\r\nThe use of deception lets less mature companies create rather than consume threat intelligence that is specifically relevant to their vertical or geography. More advanced security teams can leverage advanced counterintelligence deception use cases, such as decoy social media accounts to attract spear-phishing.
\r\n\r\n\r\n\r\nNetwork threat detection is a critical piece of the puzzle, especially since attackers cannot avoid using the network to move around. However, network threat analytics tools suffer from scalability challenges in deployment and are increasingly blind as more traffic is encrypted, even east-west in the network.
\r\n\r\n\r\n\r\nNetwork deception is the ‘original honeypot’, and it still works exceptionally well at detecting everything from worm-like activity such as network-driven ransomware to targeted attackers in large networks.
\r\n\r\n\r\n\r\nThrough improvements in virtualization and software-defined networking, we can place network decoys at scale in every subnet and VLAN, as well as in the dark IP space of the network to efficiently detect network-driven threats. Moreover, since the network decoy itself is instrumented, it is not blind to encrypted traffic and can provide full packet forensics about the threat.
\r\n\r\n\r\n\r\nDeception and threat hunting are two pillars of ‘active defence’ — proactively attempting to take the fight to the adversary. We find that the champions for deception technology at many of our customers are the threat hunting teams, as they are able to think like the attacker and deploy deception in paths where they perceive they will have to traverse.
\r\n\r\n\r\n\r\nA deception alert is a perfect trigger to a hunt mission and can let an analyst ring-fence a potential incident with decoys while they pivot on available data to understand the root cause of the threat. The real-world analogy of a hunter laying traps is extremely applicable here.
\r\n\r\n\r\n\r\nIn fact, we’re so bullish about this use case that we’ve put our money where our mouth is by launching Shadowhunt, a human-driven managed threat hunting service powered by the IllusionBLACK platform.
\r\n\r\n\r\n\r\nWow, that was a lot of reading you got done. Phew! If you’ve come this far, I’d like to leave you with some closing thoughts. Whether you’re a CISO trying to move the needle on the detect, know, and respond metrics, or someone on the security team struggling to reign in all those false positives, deception technology can improve the quality of your life by an order of magnitude.
\r\n\r\n\r\n\r\nDeception technology can help you cut down your:
\r\n\r\n\r\n\r\nWell, that’s it from us. If you have any questions about deception technology or want to get an expert opinion, feel free to hit us up. We’d love to hear what you’re currently dealing with and help you out.
\r\n","excerpt":"Deception technology is now fairly mainstream but still shrouded in vendor speak. Read this detailed guide to understand what the technology is, who it’s for, what it’s capable of doing, how it fits in your security stack, key use cases, and advantages.\n","slug":"deception-technology-101","date":"2020-02-08T08:14:05.000Z","modified":"2020-09-11T02:19:32.000Z","status":"publish","featured_media":{"id":"ba95f456-c987-5f37-80ae-b1130f538e5e","source_url":"https://ss-website-content-prod.s3.ap-south-1.amazonaws.com/wp-content/uploads/2020/02/Screenshot-2020-01-27-at-1.09.56-PM-1.png","alt_text":"","large":{"childImageSharp":{"fluid":{"base64":"data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAABQAAAALCAIAAADwazoUAAAACXBIWXMAAAsTAAALEwEAmpwYAAACfklEQVQozyWS21NSURTGz0z1kkg2PRQXr1ND3MQ7YDOomKSiAUqYHEHliFy8HdADhnI5R1SQg3ITAZtRTHBSrKmmpofqofrDWk4ze/asWXt/a/3WtzfCra3jcGurGNUMBrPm/oOW1rb6hsa6+gZ597Od3Qgd3z9IpLbC2za7w71KzFowC2Z1Liw6nAviZgnC5nAZ1UzmvZqmx08gbmhs6pLKcJd7Y9O/ukb8+Pnr95+/lesP2zu70UgIX7brxsbtDue8zT5lMiN3qxi3bt95PqAaVo9At+UVHDSTRhR6RvdiheO3pXK5cv1xZWlOpxtdWrQW8hmSugEJkRTS2SXF5qx7MXo3Es1mj0rli1y+AJqTkyJkgiFy/Y0PyNPJqMOO8QXimWkDQbgIj9flXkNidBwuwXiwYL6DRPL95dXZu/NUOhPe3gElSVEkFV7FsUjYg1lQrWbIMT+55rYRBI4EgiHgtM7boP+sxQIwyVT6vHQBu3rkpaKn14iiQ8NqhULu8XjyuXQ6Se/Ho2SAcOGLCEltQXlo6w8EYVTwCfSZwywggHMPH7HGxvUaLdhk8G34wWeXm/Cu+yBQ9g8gcPX/wNRWOF84TmcOT06L56Vy9igXo2mPd90w8Voqk0taWnlP+WwOh8W+WRDDGyPAHInuHeXywHlVuf70+cvlVeW0eAZJqPL123c4Al/gFLiEIrFGNwYsMlm3RqdD1COjKIpasLlNfwAK4bjLbJ42olMABnYkkqnpmdnBwSGajgeCQYhfGSamTCb4JCBBBEKhQCCEBxtWq/V6vVLZ39HR2dbeLpXKlEqlRqNVKHpYLFazRKJSvejt64M8j8fj8wUikfgfdAEJrG9VLqsAAAAASUVORK5CYII=","aspectRatio":1.7699115044247788,"src":"/static/cc761f7c9fa6734e37318904a20cb79f/ee604/Screenshot-2020-01-27-at-1.09.56-PM-1.png","srcSet":"/static/cc761f7c9fa6734e37318904a20cb79f/69585/Screenshot-2020-01-27-at-1.09.56-PM-1.png 200w,\n/static/cc761f7c9fa6734e37318904a20cb79f/497c6/Screenshot-2020-01-27-at-1.09.56-PM-1.png 400w,\n/static/cc761f7c9fa6734e37318904a20cb79f/ee604/Screenshot-2020-01-27-at-1.09.56-PM-1.png 800w,\n/static/cc761f7c9fa6734e37318904a20cb79f/f3583/Screenshot-2020-01-27-at-1.09.56-PM-1.png 1200w,\n/static/cc761f7c9fa6734e37318904a20cb79f/5707d/Screenshot-2020-01-27-at-1.09.56-PM-1.png 1600w,\n/static/cc761f7c9fa6734e37318904a20cb79f/b3888/Screenshot-2020-01-27-at-1.09.56-PM-1.png 2878w","srcWebp":"/static/cc761f7c9fa6734e37318904a20cb79f/58556/Screenshot-2020-01-27-at-1.09.56-PM-1.webp","srcSetWebp":"/static/cc761f7c9fa6734e37318904a20cb79f/61e93/Screenshot-2020-01-27-at-1.09.56-PM-1.webp 200w,\n/static/cc761f7c9fa6734e37318904a20cb79f/1f5c5/Screenshot-2020-01-27-at-1.09.56-PM-1.webp 400w,\n/static/cc761f7c9fa6734e37318904a20cb79f/58556/Screenshot-2020-01-27-at-1.09.56-PM-1.webp 800w,\n/static/cc761f7c9fa6734e37318904a20cb79f/99238/Screenshot-2020-01-27-at-1.09.56-PM-1.webp 1200w,\n/static/cc761f7c9fa6734e37318904a20cb79f/7c22d/Screenshot-2020-01-27-at-1.09.56-PM-1.webp 1600w,\n/static/cc761f7c9fa6734e37318904a20cb79f/650fc/Screenshot-2020-01-27-at-1.09.56-PM-1.webp 2878w","sizes":"(max-width: 800px) 100vw, 800px"}}},"medium":{"childImageSharp":{"fluid":{"base64":"data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAABQAAAALCAIAAADwazoUAAAACXBIWXMAAAsTAAALEwEAmpwYAAACfklEQVQozyWS21NSURTGz0z1kkg2PRQXr1ND3MQ7YDOomKSiAUqYHEHliFy8HdADhnI5R1SQg3ITAZtRTHBSrKmmpofqofrDWk4ze/asWXt/a/3WtzfCra3jcGurGNUMBrPm/oOW1rb6hsa6+gZ597Od3Qgd3z9IpLbC2za7w71KzFowC2Z1Liw6nAviZgnC5nAZ1UzmvZqmx08gbmhs6pLKcJd7Y9O/ukb8+Pnr95+/lesP2zu70UgIX7brxsbtDue8zT5lMiN3qxi3bt95PqAaVo9At+UVHDSTRhR6RvdiheO3pXK5cv1xZWlOpxtdWrQW8hmSugEJkRTS2SXF5qx7MXo3Es1mj0rli1y+AJqTkyJkgiFy/Y0PyNPJqMOO8QXimWkDQbgIj9flXkNidBwuwXiwYL6DRPL95dXZu/NUOhPe3gElSVEkFV7FsUjYg1lQrWbIMT+55rYRBI4EgiHgtM7boP+sxQIwyVT6vHQBu3rkpaKn14iiQ8NqhULu8XjyuXQ6Se/Ho2SAcOGLCEltQXlo6w8EYVTwCfSZwywggHMPH7HGxvUaLdhk8G34wWeXm/Cu+yBQ9g8gcPX/wNRWOF84TmcOT06L56Vy9igXo2mPd90w8Voqk0taWnlP+WwOh8W+WRDDGyPAHInuHeXywHlVuf70+cvlVeW0eAZJqPL123c4Al/gFLiEIrFGNwYsMlm3RqdD1COjKIpasLlNfwAK4bjLbJ42olMABnYkkqnpmdnBwSGajgeCQYhfGSamTCb4JCBBBEKhQCCEBxtWq/V6vVLZ39HR2dbeLpXKlEqlRqNVKHpYLFazRKJSvejt64M8j8fj8wUikfgfdAEJrG9VLqsAAAAASUVORK5CYII=","aspectRatio":1.765625,"src":"/static/cc761f7c9fa6734e37318904a20cb79f/62b1f/Screenshot-2020-01-27-at-1.09.56-PM-1.png","srcSet":"/static/cc761f7c9fa6734e37318904a20cb79f/e7519/Screenshot-2020-01-27-at-1.09.56-PM-1.png 113w,\n/static/cc761f7c9fa6734e37318904a20cb79f/7e7e9/Screenshot-2020-01-27-at-1.09.56-PM-1.png 225w,\n/static/cc761f7c9fa6734e37318904a20cb79f/62b1f/Screenshot-2020-01-27-at-1.09.56-PM-1.png 450w,\n/static/cc761f7c9fa6734e37318904a20cb79f/e2e7f/Screenshot-2020-01-27-at-1.09.56-PM-1.png 675w,\n/static/cc761f7c9fa6734e37318904a20cb79f/db955/Screenshot-2020-01-27-at-1.09.56-PM-1.png 900w,\n/static/cc761f7c9fa6734e37318904a20cb79f/b3888/Screenshot-2020-01-27-at-1.09.56-PM-1.png 2878w","srcWebp":"/static/cc761f7c9fa6734e37318904a20cb79f/b8a88/Screenshot-2020-01-27-at-1.09.56-PM-1.webp","srcSetWebp":"/static/cc761f7c9fa6734e37318904a20cb79f/3a3bf/Screenshot-2020-01-27-at-1.09.56-PM-1.webp 113w,\n/static/cc761f7c9fa6734e37318904a20cb79f/975bf/Screenshot-2020-01-27-at-1.09.56-PM-1.webp 225w,\n/static/cc761f7c9fa6734e37318904a20cb79f/b8a88/Screenshot-2020-01-27-at-1.09.56-PM-1.webp 450w,\n/static/cc761f7c9fa6734e37318904a20cb79f/761da/Screenshot-2020-01-27-at-1.09.56-PM-1.webp 675w,\n/static/cc761f7c9fa6734e37318904a20cb79f/210c1/Screenshot-2020-01-27-at-1.09.56-PM-1.webp 900w,\n/static/cc761f7c9fa6734e37318904a20cb79f/650fc/Screenshot-2020-01-27-at-1.09.56-PM-1.webp 2878w","sizes":"(max-width: 450px) 100vw, 450px"}}}},"categories":[{"id":"a725b316-af4b-5d16-8453-4b07c65d8fca","slug":"deception","name":"deception"}],"author":{"id":"72c88789-f3cb-50a8-9db3-a549434a7d3b","name":"Kush Mehra"},"yoast_meta":{"yoast_wpseo_twitter_title":"","yoast_wpseo_twitter_description":"","yoast_wpseo_redirect":"","yoast_wpseo_opengraph_title":"","yoast_wpseo_opengraph_description":"","yoast_wpseo_metakeywords":"","yoast_wpseo_metadesc":"A comprehensive guide to what deception technology is, who it’s for, what it’s capable of doing (and not doing), key use cases, and advantages.","yoast_wpseo_meta_robots_noindex":"","yoast_wpseo_meta_robots_nofollow":"","yoast_wpseo_meta_robots_adv":"","yoast_wpseo_linkdex":"61","yoast_wpseo_focuskw":"Deception Technology","yoast_wpseo_canonical":""}},"relatedPosts":{"edges":[{"node":{"id":"95ac6be2-63ff-55a5-8100-d32915ee92dd","title":"The bright side of the DARKSIDE ransomware","content":"\nBy now, you’ve probably been bulldozed with solution briefings, white papers, vendor pitches, and webinar invitations to discuss how this ransomware could have been stopped.
\n\n\n\nWe’ll do things a little differently. We’ll of course include our resources at the end of this post, because obviously we don’t want to be left behind. But we’ll first take you through what we’ve been saying about ransomware these last couple of months. I think it’ll help you understand where we’re coming from and why we recommend dealing with ransomware with a different mindset.
\n\n\n\nAs a company, we have been vocal about the threat of ransomware for a long time. We’ve seen it singularly wreak more havoc on organizations compared to any other single threat. So we decided to use our social platform to educate the infosec community about ransomware and how to defend against it.
\n\n\n\nHere’s us predicting the weaponisation of the Exchange vulnerabilities for ransomware ⏱
\n\n\n\n\n\n\n\n![\"\"](\"https://internal-wp.smokescreen.io/wp-content/uploads/2021/05/Screenshot-2021-05-18-at-8.30.58-PM-813x1024.png\")
We even launched a course focussed exclusively on ransomware 🎓
\n\n\n\n\n\n\n\nAnd then we said some more stuff about the impact of ransomware 🎯
\n\n\n\n\n\n\n\nWe even had a slide just about the consequences of ransomware 💣
\n\n\n\n![\"\"](\"https://internal-wp.smokescreen.io/wp-content/uploads/2021/05/Smokescreen-Consequences-of-ransomware.png\")
And then we wrote a paper on how to defend against it 📝
\n\n\n\n\n\n\n\nAnd made it publically accessible 📖
\n\n\n\n\n\n\n\nAnd then we said this about DARKSIDE 👇🏼
\n\n\n\n\n\n\n\nLet me clarify something here – This is not a ‘I told you so’ post. We are not oracles predicting the future. We have been on this trajectory of ransomware making front page news for years now, starting with Wannacry.
\n\n\n\nBut it’s not all doom and gloom.
\n\n\n\nThe DARKSIDE ransomware did not do anything radically different that can catch the security community off-guard.
\n\n\n\nWe know how most ransomware operates. Download the paper here.
\n\n\n\nWe know what we must do to defend against it.
\n\n\n\nWe simply need to start doing it.
\n\n\n\nHere are three things:
\n\n\n\nWhen analyzing attacker tactics and techniques, ask “Why?”. When you ask “Why?”, it opens up new avenues for guerilla-warfare-style defenses to combat ransomware.
\n\n\n\nI’ve enumerated over 40 approaches in the paper on messing with ransomware. Use deception to disrupt what the ransomware is trying to achieve, rather than trying to stop the usage of a specific tool. It’s easy to setup, doesn’t generate too much data, and has a much faster time to value. This statement may look like a vendor marketing plug but it’s not. If you check out MITRE Shield, you will see that the adoption of deception is vital to active defense against a use case like Ransomware.
\n\n\n\nReduce reliance on detection in only one part of the network, for example, stacking all the controls on the endpoint. Notice how many EDRs are now talking about XDR? It’s likely because it’s impossible to stop threats meaningfully only in one part of your environment. You need defenses across your environment. Active Defense-based deception does this already.
\n\n\n\nIrrespective of how you choose to tackle ransomware, here’s the one advise I’ll leave you with 🙏🏼
\n\n\n\n\n","excerpt":"By now, you’ve probably been bulldozed with solution briefings, white papers, vendor pitches, and webinar invitations to discuss how this ransomware could have been stopped. We’ll do things a little differently. We’ll of course include our resources at the end of this post, because obviously we don’t want to be left behind. But we’ll first […]\n","slug":"the-bright-side-of-the-darkside-ransomware","date":"2021-05-18T16:01:29.000Z","status":"publish","modified":"2021-05-18T16:19:33.000Z","wordpress_id":18782,"featured_media":{"id":"6a62504d-2791-5a4b-ad8a-4d13b155ef9f","source_url":"https://ss-website-content-prod.s3.ap-south-1.amazonaws.com/wp-content/uploads/2021/05/Smokescreen-Darkside-Ransomware.png","alt_text":"Smokescreen-Darkside-Ransomware","large":{"childImageSharp":{"fluid":{"base64":"data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAABQAAAALCAYAAAB/Ca1DAAAACXBIWXMAAAsTAAALEwEAmpwYAAACqklEQVQoz3WTvU9TURiHz72UQhTKrdzbW4EoUSwBtbQUKC2lYL+gUBFKKSDgB35C1Bi/aowmJhrjYGLUxcTBwcHBODg4uLkYYxyN0cF/wMXEhKgBuY+nxYFBh1/eM/1yznmeV1jW6jIg82v5/YsLy9dnKlev5gWFcdW6OCasQs7GsaFqIl6NBpeG7tRwav+PsCxKfS8fTjIVFCS9gkxAtQZ9ChMhheEOuyxzkug0CLTobK0z2GwauIx/R8g268ub+1Y+KKzjyXLr8pjNOrxHJdupWhGPYvU32wlscxBorqXPb+Bv1ql367h0HWN9ZFlxCmtliQ9PwtycVTg1VMaVMRuLKZWTMvt7VA5E7cwnmwi1NhAL6KTDDWzfYlLnNjFdLjbL6TbN0u2KU/z+/pnbBzdwqF+Q71EY71YYaFOJ7VYY8iuMyCcfTTcS3V1HZ7NGPt3O6HCCZCLOeDZLtLeXvZkM/X19dAQCiB9f33F+tIzFtMKl8XJm+1Rmogr5kHx2l8J0pIJMsIauFoPIrk0cmUowncswmZ9gIpcjI8visRhzc3Mk4nHEz2+feLCwkYdnqnhacHAipbAwaONaVqWQUbk8Uclgl5PQLjf7ovWcPZJiLhejNxKhJxwmHArh9/lKZe1+fxHKEs9ueMl3C+4cc3B3vpzH58q5NVvGtKSc8kkoHo3gTkOSNhnprafdU42zxoHD4aBGpqhLdVXVmjZFaT6+vsdMSHD3RCUXxso4mhRMyv8MNglJ2I53u0bbDr1EuUOq42mUMEwXLgmlCKYIxPx7/uvhCq8eTZVKU22CbLfK8QFF/qdgoN0ub6TR4zXweQwa6w0a3EVF1vmnr2lU8lBuCqVOfvH2+XkKuQoW0oLTGQkpK1gctjETrybYquGu1TBlauW2aP/ZlD8604JDURmM0wAAAABJRU5ErkJggg==","aspectRatio":1.9047619047619047,"src":"/static/a72a3afeb6a8b47ebe9708c9950bb690/ee604/Smokescreen-Darkside-Ransomware.png","srcSet":"/static/a72a3afeb6a8b47ebe9708c9950bb690/69585/Smokescreen-Darkside-Ransomware.png 200w,\n/static/a72a3afeb6a8b47ebe9708c9950bb690/497c6/Smokescreen-Darkside-Ransomware.png 400w,\n/static/a72a3afeb6a8b47ebe9708c9950bb690/ee604/Smokescreen-Darkside-Ransomware.png 800w,\n/static/a72a3afeb6a8b47ebe9708c9950bb690/f3583/Smokescreen-Darkside-Ransomware.png 1200w,\n/static/a72a3afeb6a8b47ebe9708c9950bb690/5707d/Smokescreen-Darkside-Ransomware.png 1600w,\n/static/a72a3afeb6a8b47ebe9708c9950bb690/0ef64/Smokescreen-Darkside-Ransomware.png 2400w","srcWebp":"/static/a72a3afeb6a8b47ebe9708c9950bb690/58556/Smokescreen-Darkside-Ransomware.webp","srcSetWebp":"/static/a72a3afeb6a8b47ebe9708c9950bb690/61e93/Smokescreen-Darkside-Ransomware.webp 200w,\n/static/a72a3afeb6a8b47ebe9708c9950bb690/1f5c5/Smokescreen-Darkside-Ransomware.webp 400w,\n/static/a72a3afeb6a8b47ebe9708c9950bb690/58556/Smokescreen-Darkside-Ransomware.webp 800w,\n/static/a72a3afeb6a8b47ebe9708c9950bb690/99238/Smokescreen-Darkside-Ransomware.webp 1200w,\n/static/a72a3afeb6a8b47ebe9708c9950bb690/7c22d/Smokescreen-Darkside-Ransomware.webp 1600w,\n/static/a72a3afeb6a8b47ebe9708c9950bb690/f1e40/Smokescreen-Darkside-Ransomware.webp 2400w","sizes":"(max-width: 800px) 100vw, 800px"}}},"medium":{"childImageSharp":{"fluid":{"base64":"data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAABQAAAAKCAYAAAC0VX7mAAAACXBIWXMAAAsTAAALEwEAmpwYAAACXUlEQVQoz32S3UtTcRjHzzlagtNtZ+ecmRoYvpG6mnM7brbNuaa5F9+ma+YLlWkqpYFgodVN1h8QUVR0IV32D3QXSHSfBP4D3UYXQoQSO59+Mywi6eLL7+G5+PD8ns8jWVZhz4I9RLbfru9vTCmFh9MyaznZupeXuT9RxmjUTn2tA83pQHU4cNjt/0b0K2w2JEvQoMC719eYjkiMdMpkg4qV65KZjsn0B8rpMzUiXp1TtTo1bh1DPzpOAZUEzdrZemzlApK10FdqLV4osXIhheRZ2Yo2K4Sby/E2qES9BiFPEWpQZRi4j4jqdArgj10+bpqsjkjcyZayNlzCckphLqGQC8rMxFUGgg2YpzUGI9V4Gg2qxZS69vd0v4H7X7d5NHWc2YTEaEhmVEDibTJpv0zSK3G1V2Osux5/k0oqXM/48HnisW4GBwaI9/SQTqXoEW/A70dzuZB2P2+xnJFZGVJYzR5jMiozFS1OpzAmcilqI+JxEWpRGU/5mJkYJDs8xNTkJJl0mmQyST6fpycWw15ZifT9yyeeLJTxasXOy6UKFvsVbouvP8gprI+UMJ+pxGwx6DWrmL3YyfWJGJEuk1AwhBkI0OHzEQ6H8Xd0HEr5xubdVsa7JJ7ddPB0vpTnS6XcEntMehXOtdjwNetCik4mXEPMp1FtFE/FgUtVD/ZWBB3WRcvsvH/BXExiY7qEy3FZRCIjdhhslGlvsOFp0IRhg2CbTlOdQW21W0hw/7Ht/lUfAAsHdwgf3ixzRUDTHUWgwo2UMJyQSbSXEz6jYbbq1NXonDwhjP7nDn8CrvNYN+AFX20AAAAASUVORK5CYII=","aspectRatio":1.9152542372881356,"src":"/static/a72a3afeb6a8b47ebe9708c9950bb690/62b1f/Smokescreen-Darkside-Ransomware.png","srcSet":"/static/a72a3afeb6a8b47ebe9708c9950bb690/e7519/Smokescreen-Darkside-Ransomware.png 113w,\n/static/a72a3afeb6a8b47ebe9708c9950bb690/7e7e9/Smokescreen-Darkside-Ransomware.png 225w,\n/static/a72a3afeb6a8b47ebe9708c9950bb690/62b1f/Smokescreen-Darkside-Ransomware.png 450w,\n/static/a72a3afeb6a8b47ebe9708c9950bb690/e2e7f/Smokescreen-Darkside-Ransomware.png 675w,\n/static/a72a3afeb6a8b47ebe9708c9950bb690/db955/Smokescreen-Darkside-Ransomware.png 900w,\n/static/a72a3afeb6a8b47ebe9708c9950bb690/0ef64/Smokescreen-Darkside-Ransomware.png 2400w","srcWebp":"/static/a72a3afeb6a8b47ebe9708c9950bb690/b8a88/Smokescreen-Darkside-Ransomware.webp","srcSetWebp":"/static/a72a3afeb6a8b47ebe9708c9950bb690/3a3bf/Smokescreen-Darkside-Ransomware.webp 113w,\n/static/a72a3afeb6a8b47ebe9708c9950bb690/975bf/Smokescreen-Darkside-Ransomware.webp 225w,\n/static/a72a3afeb6a8b47ebe9708c9950bb690/b8a88/Smokescreen-Darkside-Ransomware.webp 450w,\n/static/a72a3afeb6a8b47ebe9708c9950bb690/761da/Smokescreen-Darkside-Ransomware.webp 675w,\n/static/a72a3afeb6a8b47ebe9708c9950bb690/210c1/Smokescreen-Darkside-Ransomware.webp 900w,\n/static/a72a3afeb6a8b47ebe9708c9950bb690/f1e40/Smokescreen-Darkside-Ransomware.webp 2400w","sizes":"(max-width: 450px) 100vw, 450px"}}}},"author":{"id":"765e8417-7ed6-55b7-95a7-1d561141e760","name":"Sudarshan Pisupati"}}},{"node":{"id":"26a6fa99-a7a6-5ae1-835e-ae5c2183236e","title":"Ransomware, the limits of prevention, and active defense","content":"\nWe’re almost halfway through 2021, and there seems to be a ransomware resurgence.
\n\n\n\nOr that’s what the headlines will have you believe.
\n\n\n\nOn the contrary, the opposite might be true.
\n\n\n\nAccording to a Sophos survey, ransomware attacks seem to have gone down in 2021. Only 37% of the organizations surveyed have said they experienced a ransomware attack in 2021 compared to 51% in 2020.
\n\n\n\nSo why does it feel like ransomware attacks have gone through the roof? The answer emerges when you look at the victims – high-profile targets.
\n\n\n\nHere are some headlines from the last couple of months:
\n\n\n\nIreland’s Health Services hit with $20 million ransomware demand
\n\n\n\nThe Conti ransomware gang attacked Ireland’s publicly funded healthcare system. The Irish Health Service had to shut down all of its IT systems. The attack disrupted COVID-19 testing, crippled diagnostic services, and forced hospitals to cancel appointments.
\n\n\n\nRansomware attack leads to shutdown of major U.S. pipeline system
\n\n\n\nColonial Pipeline, one of the biggest fuel pipeline operators in the US, had to shut down its entire network following an attack by the DarkSide ransomware group. The attack resulted in gas price increases, panic buying, and supply shortages. The company paid a 75 bitcoin ransom which was worth $5 million when we wrote this.
\n\n\n\nAxa division in Asia hit by ransomware cyber attack
\n\n\n\nOne of Axa’s businesses in Asia got hit by Avaddon ransomware. 3TB of sensitive data was stolen, including customer medical reports (exposing their sexual health diagnosis), copies of ID cards, bank account statements, claim forms, payment records, contracts, and more. The attack impacted IT operations in Thailand, Malaysia, Hong Kong, and the Philippines.
\n\n\n\nToshiba subsidiary confirms ransomware attack
\n\n\n\nA European subsidiary of Toshiba was the victim of a ransomware attack. Sources inside the company believe DarkSide is behind it, but there was no confirmation when this post was published. 740 GB of data, including passports and other PII, was stolen. The company had to sever network connections between Japan and Europe to stop the spread of ransomware.
\n\n\n\nUS cyber insurance major CNA Financial hit with ransomware
\n\n\n\nOne of the biggest players in the cyber insurance space (yeah, we see the irony) suffered a ransomware attack that affected operations for three days. The company was forced to shut down parts of the network to limit the spread and contain the damage. Although the company did not disclose if data was stolen, it’s a pretty big deal. A compromise could potentially help adversaries determine which companies had applied for or acquired cyber insurance, the scope of coverage, and the limits of deductibles.
\n\n\n\nAcer hit with $50 million ransomware demand
\n\n\n\nRansomware operation REvil breached computer giant Acer resulting in the largest known ransomware demand. Images leaked by the ransomware operators revealed that they had access to some of the company’s financial spreadsheets, bank balances, and bank communication.
\n\n\n\nRansomware gangs are now going after meaty targets. After all, why rob a person when you can rob a bank where everyone keeps their money?
\n\n\n\nIt’s no surprise then that the financial impact of ransomware has more than doubled from US$761,106 in 2020 to US$1.85 million in 2021.
\n\n\n\nAccording to Coveware, ransomware demands are up 43% so far in 2021.
\n\n\n\nSo aside from being meaty targets, what else is common between ransomware victims these days? They all make significant investments in cybersecurity.
\n\n\n\nLook at the scale of these companies. They have large security teams, a bevy of infosec consultants at their disposal, and all the cool tools to defend – endpoint detection and response, DLPs, SIEMs, cloud SIEMs, SIEMs that are also UEBA. You get the drift.
\n\n\n\nDifferent folks will give different answers to these questions. Media outlets will not move beyond the sensational headlines, consultants will say there aren’t enough skilled folks in the company, EDRs will say there’s not enough endpoint coverage, SIEMs will say data ingestion from critical segments might be missing, the OT folks will say it’s hard to defend non-IT assets, deception vendors will say there are no decoys/honeypots!
\n\n\n\nEssentially, anyone who has a horse in the race is going to give one-dimensional answers.
\n\n\n\nHere’s the thing though; the companies that suffer these breaches are pretty good at cybersecurity. More often than not, they operate at the cutting edge.
\n\n\n\nThe answer to why they get hit by ransomware is more nuanced. It’s because there are limits to prevention.
\n\n\n\nIf you happen to be one of the most frequently targeted companies, it’s only a matter of time before you’ll get breached despite having the best preventive controls in place.
\n\n\n\nWhy? Because anything preventive assumes the threat to be static. With ransomware, the threat is evolving. The boring bits of ransomware have been automated, there are dedicated ransomware services (REvil allegedly made $100 million in 2020), and there are human adversaries behind the ransomware that are constantly cooking up new and novel ways of compromising their targets.
\n\n\n\nFurther, most solutions to security problems take a siloed approach. Want to defend endpoints? Cover them with an EDR. More visibility? NTA. Malicious behavior? UEBA. Ransomware doesn’t discriminate. It doesn’t just go after your endpoint or server zone. Once it gets in, it just goes after everything.
\n\n\n\nPrevention doesn’t always work because ransomware is a moving target.
\n\n\n\nBusinesses need a different approach for dealing with it – Active defense.
\n\n\n\nRansomware is capable of interacting with all parts of your IT environment. Focussing your efforts on just one part of it will have diminishing returns. Dealing with something like ransomware demands a holistic approach. Your strategy needs to cover critical areas of the environment to be effective.
\n\n\n\n‘Active Defense‘ helps you do that. The approach is use case-driven and balanced in its outcome. You can pick the use case (in this instance, ransomware) and focus on where you want to be most effective (e.g. DMZ, Active Directory, critical server segments, privileged user accounts, privileges workstations, etc.)
\n\n\n\nWhat we’re recommending isn’t something experimental. Forward-thinking security teams are building dedicated deception-based active defense programs, in some cases around specific risks like ransomware.
\n\n\n\nWe have an insurance customer that has done this. They already had a firewall, network segmentation, anti-virus, EDR, and SIEM when they deployed Smokescreen. They were concerned about ransomware (rightly so).
\n\n\n\nThe idea of planting decoy file shares in key segments was adopted as the primary strategy to detect ransomware in the lateral movement phase. In the event of a detection, the organization’s internal incident response process would kick in.
\n\n\n\nThe goal was to detect ransomware spreading on the network, quickly understand the nature of ransomware, and allow established incident response processes to contain the threat.
\n\n\n\nThe security team planted network decoys in the DMZ and DC. The hypothesis behind this decision was that assets in the DMZ were at a high risk of infection and lateral movement activity would likely be recorded in those segments.
\n\n\n\nThe decoys themselves were projecting a diverse set of network services ranging from decoy SMB file shares to FTP servers to SSH servers and decoy applications.
\n\n\n\nSure enough, the company was hit by a ransomware attack. The incident started a little after midnight and a minute later, Smokescreen had raised a detection. Smokescreen was the first security control to raise an alarm.
\n\n\n\nInvestigation revealed that all decoys masquerading as file shares had been encrypted within the DMZ segment. The decoy files hosted on these file shares had been encrypted and renamed, which allowed for easy identification of the ransomware strain.
\n\n\n\nRoot cause analysis further revealed that the lateral movement phase of the ransomware attack was detected by Smokescreen less than a minute after it began encrypting assets.
\n\n\n\nWhy do you think the security team at this insurance company was able to avert a ransomware breach? Sure they had our active defense solution, but more importantly, they had the foresight to think what an attacker would possibly do and then build defenses that would intercept those attacks.
\n\n\n\nThat’s Active Defense in action.
\n\n\n\nBuilding a dedicated defense strategy around ransomware is a worthy goal to have in 2021.
\n\n\n\nRansomware is industry-agnostic and affects all parts of your network. Today, it is the one singular threat that can completely disrupt operations and bring business to a grinding halt.
\n\n\n\nHaving the ability to detect ransomware early in the attack lifecycle can be instrumental in limiting its spread and impact.
\n\n\n\nActive defense gives you the ability to do this without investing in expensive tooling, adding headcount, or making changes to your network.
\n\n\n\nWe’re going to leave you with a playbook of active defense strategies that can help you detect over 40 ransomware techniques.
\n\n\n\nPlaybook – The Top 40 Ransomware Techniques and How to Mess With Them
\n\n\n\nRemember, you don’t have to implement everything. But implementing even some of it can help you control and reduce the attack surface available to ransomware.
\n\n\n\n\n","excerpt":"We’re almost halfway through 2021, and there seems to be a ransomware resurgence. Or that’s what the headlines will have you believe. On the contrary, the opposite might be true. According to a Sophos survey, ransomware attacks seem to have gone down in 2021. Only 37% of the organizations surveyed have said they experienced a […]\n","slug":"ransomware-the-limits-of-prevention-and-active-defense","date":"2021-05-17T12:15:38.000Z","status":"publish","modified":"2021-05-18T16:18:54.000Z","wordpress_id":18779,"featured_media":{"id":"8fcb1a39-fe2c-5560-b945-364105ce2807","source_url":"https://ss-website-content-prod.s3.ap-south-1.amazonaws.com/wp-content/uploads/2021/05/Smokescreen-Ransomware-Defense.png","alt_text":"Smokescreen Ransomware Defense","large":{"childImageSharp":{"fluid":{"base64":"data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAABQAAAALCAYAAAB/Ca1DAAAACXBIWXMAAAsTAAALEwEAmpwYAAADL0lEQVQozx2SfUzUdRzHv56HbVrTBGGWcnLe/e5O7g4fjgfdBbgT4ZCmqeMo5gNuJpXxkCeZwo2HKCFDzafTlWaWOZSgjhPHcSBwZxRu6mCtWmtraU8qsYGICXv1rb8/+7w+n/eDUFlslLi3c7v1Xe4FvdRUlqI2WZlisBJhtKJWzExT4pmmN6HWGlDHKYjYhWiXWgmcrWYoeJwHoYs0HisnUqtBnNyTy1DnIR4Phnl4o4fhq0fxHS5k9hIbaoOFqfp4xHwJeVaHKk7PVAmcpVPwV+Ux1H2Cf/o7Gelt5n7wIP2nixFtpav55kQZPza+za9fVTF6/VMme+vQ25dLiEKE/HTrpiwKNjuJ0C1CRGuYazTwZXEmfUfe4MapIu74q5gYuMhE735EUW46weotBMqcjLR54Psmmo6WMMOcQFq2nH1SycTXn8O3fjo+riJ9VQqq+VrynSm0ludzdW8Okz11/BU+g3t7DkJYElmR5aB+22paG3bg2uZCGBKYLn1s92zgbuAII31+7nacYTTs5U7LPiKNJkRMLJp4E+6Ndmp2riPWIq15cjZCZV6GWGDB7EglKSsVMVePUKzMtCRwrnAVofoddNfl85uvAn5o4e9ALVEmIyLyGcSceeRkLyc1bQlihoQ9HY2ISl5B+d5Cfva9x5+XT3GgtoyYZfKI3ozNnoS3NJdg2RoeBqrpb25gzVqH9DaOlPQkfN63GA+f5fF1P5817MZkleFdqHAx0tXA5EAP49cuMx7y0ne6hGhbImKhlKE1krkykbyNDqZodFKqhkhFoaPGxXD3ccZudTMcbmI0dIyfGt9E+IoyCB0q5uZHu/ilpUJW5wKToXp0/6U8TyFqaTLu117A/eoGohbbJHABMQaFS69nEnp/J9cObuV3fyV818RYVy3ipbVptHo20e528uCKh0c3z3O4+mWeWJTAi3lZDDbvh1t+uRBi4It68nMdqOSnGek2zu920bknh0dd7zDo/wDX+pUy5XgbWvtzeLZkcK62gOTns6VUC0+ZF9O+bx23fQe433uJPwInGev7kKG2SuaYzf9LnykL/sp6OyUFTqbHSTtmxfAvXln2Qtw0IX8AAAAASUVORK5CYII=","aspectRatio":1.7699115044247788,"src":"/static/6a39ebe40d3a52b97b478c8ce0551c02/ee604/Smokescreen-Ransomware-Defense.png","srcSet":"/static/6a39ebe40d3a52b97b478c8ce0551c02/69585/Smokescreen-Ransomware-Defense.png 200w,\n/static/6a39ebe40d3a52b97b478c8ce0551c02/497c6/Smokescreen-Ransomware-Defense.png 400w,\n/static/6a39ebe40d3a52b97b478c8ce0551c02/ee604/Smokescreen-Ransomware-Defense.png 800w,\n/static/6a39ebe40d3a52b97b478c8ce0551c02/f3583/Smokescreen-Ransomware-Defense.png 1200w,\n/static/6a39ebe40d3a52b97b478c8ce0551c02/5707d/Smokescreen-Ransomware-Defense.png 1600w,\n/static/6a39ebe40d3a52b97b478c8ce0551c02/2685c/Smokescreen-Ransomware-Defense.png 2560w","srcWebp":"/static/6a39ebe40d3a52b97b478c8ce0551c02/58556/Smokescreen-Ransomware-Defense.webp","srcSetWebp":"/static/6a39ebe40d3a52b97b478c8ce0551c02/61e93/Smokescreen-Ransomware-Defense.webp 200w,\n/static/6a39ebe40d3a52b97b478c8ce0551c02/1f5c5/Smokescreen-Ransomware-Defense.webp 400w,\n/static/6a39ebe40d3a52b97b478c8ce0551c02/58556/Smokescreen-Ransomware-Defense.webp 800w,\n/static/6a39ebe40d3a52b97b478c8ce0551c02/99238/Smokescreen-Ransomware-Defense.webp 1200w,\n/static/6a39ebe40d3a52b97b478c8ce0551c02/7c22d/Smokescreen-Ransomware-Defense.webp 1600w,\n/static/6a39ebe40d3a52b97b478c8ce0551c02/ab8d3/Smokescreen-Ransomware-Defense.webp 2560w","sizes":"(max-width: 800px) 100vw, 800px"}}},"medium":{"childImageSharp":{"fluid":{"base64":"data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAABQAAAALCAYAAAB/Ca1DAAAACXBIWXMAAAsTAAALEwEAmpwYAAADL0lEQVQozx2SfUzUdRzHv56HbVrTBGGWcnLe/e5O7g4fjgfdBbgT4ZCmqeMo5gNuJpXxkCeZwo2HKCFDzafTlWaWOZSgjhPHcSBwZxRu6mCtWmtraU8qsYGICXv1rb8/+7w+n/eDUFlslLi3c7v1Xe4FvdRUlqI2WZlisBJhtKJWzExT4pmmN6HWGlDHKYjYhWiXWgmcrWYoeJwHoYs0HisnUqtBnNyTy1DnIR4Phnl4o4fhq0fxHS5k9hIbaoOFqfp4xHwJeVaHKk7PVAmcpVPwV+Ux1H2Cf/o7Gelt5n7wIP2nixFtpav55kQZPza+za9fVTF6/VMme+vQ25dLiEKE/HTrpiwKNjuJ0C1CRGuYazTwZXEmfUfe4MapIu74q5gYuMhE735EUW46weotBMqcjLR54Psmmo6WMMOcQFq2nH1SycTXn8O3fjo+riJ9VQqq+VrynSm0ludzdW8Okz11/BU+g3t7DkJYElmR5aB+22paG3bg2uZCGBKYLn1s92zgbuAII31+7nacYTTs5U7LPiKNJkRMLJp4E+6Ndmp2riPWIq15cjZCZV6GWGDB7EglKSsVMVePUKzMtCRwrnAVofoddNfl85uvAn5o4e9ALVEmIyLyGcSceeRkLyc1bQlihoQ9HY2ISl5B+d5Cfva9x5+XT3GgtoyYZfKI3ozNnoS3NJdg2RoeBqrpb25gzVqH9DaOlPQkfN63GA+f5fF1P5817MZkleFdqHAx0tXA5EAP49cuMx7y0ne6hGhbImKhlKE1krkykbyNDqZodFKqhkhFoaPGxXD3ccZudTMcbmI0dIyfGt9E+IoyCB0q5uZHu/ilpUJW5wKToXp0/6U8TyFqaTLu117A/eoGohbbJHABMQaFS69nEnp/J9cObuV3fyV818RYVy3ipbVptHo20e528uCKh0c3z3O4+mWeWJTAi3lZDDbvh1t+uRBi4It68nMdqOSnGek2zu920bknh0dd7zDo/wDX+pUy5XgbWvtzeLZkcK62gOTns6VUC0+ZF9O+bx23fQe433uJPwInGev7kKG2SuaYzf9LnykL/sp6OyUFTqbHSTtmxfAvXln2Qtw0IX8AAAAASUVORK5CYII=","aspectRatio":1.765625,"src":"/static/6a39ebe40d3a52b97b478c8ce0551c02/62b1f/Smokescreen-Ransomware-Defense.png","srcSet":"/static/6a39ebe40d3a52b97b478c8ce0551c02/e7519/Smokescreen-Ransomware-Defense.png 113w,\n/static/6a39ebe40d3a52b97b478c8ce0551c02/7e7e9/Smokescreen-Ransomware-Defense.png 225w,\n/static/6a39ebe40d3a52b97b478c8ce0551c02/62b1f/Smokescreen-Ransomware-Defense.png 450w,\n/static/6a39ebe40d3a52b97b478c8ce0551c02/e2e7f/Smokescreen-Ransomware-Defense.png 675w,\n/static/6a39ebe40d3a52b97b478c8ce0551c02/db955/Smokescreen-Ransomware-Defense.png 900w,\n/static/6a39ebe40d3a52b97b478c8ce0551c02/2685c/Smokescreen-Ransomware-Defense.png 2560w","srcWebp":"/static/6a39ebe40d3a52b97b478c8ce0551c02/b8a88/Smokescreen-Ransomware-Defense.webp","srcSetWebp":"/static/6a39ebe40d3a52b97b478c8ce0551c02/3a3bf/Smokescreen-Ransomware-Defense.webp 113w,\n/static/6a39ebe40d3a52b97b478c8ce0551c02/975bf/Smokescreen-Ransomware-Defense.webp 225w,\n/static/6a39ebe40d3a52b97b478c8ce0551c02/b8a88/Smokescreen-Ransomware-Defense.webp 450w,\n/static/6a39ebe40d3a52b97b478c8ce0551c02/761da/Smokescreen-Ransomware-Defense.webp 675w,\n/static/6a39ebe40d3a52b97b478c8ce0551c02/210c1/Smokescreen-Ransomware-Defense.webp 900w,\n/static/6a39ebe40d3a52b97b478c8ce0551c02/ab8d3/Smokescreen-Ransomware-Defense.webp 2560w","sizes":"(max-width: 450px) 100vw, 450px"}}}},"author":{"id":"34627d50-53e7-5dda-bb36-6ab2c0cf489d","name":"Amir Moin"}}},{"node":{"id":"ea0aa0bf-7d16-5925-b1f2-594f99da9771","title":"6 takeaways from GOV.UK’s 2021 cybersecurity breaches survey","content":"\nUK’s Department for Digital, Culture, Media and Sports has published the 6th edition of its annual cybersecurity breaches survey on GOV.UK.
\n\n\n\nWe sifted through this year’s report to compile the top 6 takeaways. Let’s go.
\n\n\n\nFewer businesses are now deploying security monitoring tools (35% vs. 40% last year) or undertaking any form of user monitoring (32% vs. 38%).
\n\n\n\nCompared to 46% of businesses in 2017, only 39% said that they detected any breach or attack. This can be attributed to fewer organizations deploying security controls and their limited ability to monitor remote employees.
\n\n\n\n83% of attacks on businesses and 79% on charities were in the form of phishing. These are consistent with the attack vectors reported in 2019 and 2020.
\n\n\n\n4 in 10 businesses and 1 in 4 charities were hit by a security breach/attack in the last 12 months.
\n\n\n\nOf the businesses and charities that reported a security breach/attack, a quarter of them were hit at least once a week,
\n\n\n\nThe data from this survey reinforces what we’re seeing globally:
\n\n\n\nYou can read the full report here.
\n\n\n\nThere’s no silver bullet. We can recommend four easy-to-implement active defense strategies that address security challenges around phishing and remote work access. These deception-based active defense recommendations are easy to implement, do not require complex tooling, and detect threats early.
\n\n\n\nEmail decoys are fake email accounts that intercept attackers attempting to mount social-engineering/spear-phishing attacks on high-value personnel.
\n\n\n\nSeed these decoys on social media and other Internet-facing assets where attackers scour for spear-phishing targets. These email decoys are enumerated by hackers and added to their target lists for sending spear-phishing emails. There is no reason for anyone to send any emails to the decoy email addresses. Therefore, any email sent to these addresses is a high-fidelity indication of an attack.
\n\n\n\nYou can integrate these with your SIEM to find other targets. Additionally, you can integrate with proxies to block access to spear-phishing domains.
\n\n\n\nEnabling employees to work from anywhere requires security teams to use VPNs, Citrix servers, and expose applications to the Internet.
\n\n\n\nAttackers target vulnerabilities in these remote access services to get into your network. Use that against them.
\n\n\n\nDeploy Internet-facing decoys that resemble vulnerable applications, databases, and servers. E.g., you can easily set up decoys that have the recent Citrix and ManageEngine vulnerabilities, making them attractive targets for the attackers.
\n\n\n\nAttackers looking for these assets during recon will discover and engage with the decoys as well. Any attempt to seek out these assets will alert you of incoming threats with low alert volume.
\n\n\n\nAttackers use credential stuffing and stolen credentials to break into organizations. These are hard to detect because the activity seems legitimate. You have two simple active defense plays here:
\n\n\n\nAs you’ve seen in the survey finding, fewer organizations have visibility into endpoints because now they are outside the perimeter. Consider using endpoint deception to build this visibility, detect attacks early, and stop lateral movement.
\n\n\n\nPlant endpoint decoys like fake files, processes, passwords, and cookies on the work machines of all your remote employees.
\n\n\n\nAn attacker on your employees’ machines will encounter these decoys and will be caught.
\n\n\n\nEndpoint deception follows the end-user, so even when they’re working from home, your ability to detect threats is not diminished. You gain visibility into home networks that are compromised without having to deploy appliances or network traffic monitoring choke-points.
\n\n\n\nActive defense is emerging as a viable approach to dealing with advanced attacks. MITRE has a new knowledge base dedicated to active defense. If you want to understand why this approach is gaining prominence in infosec circles, read this.
\n\n\n\nFor more on using active defense and deception for remote work security, check out the white paper.
Deception technology provides a unique approach to detecting adversary activity in a network. Compared to other detection controls, it’s easier to deploy, gives you greater visibility, and solves your false positives problem.
\n\n\n\nLet’s cut to the chase, shall we? Of course, I’m going to say this. I work for a company that sells a deception solution. I’m quite sure that if you’ve ever spoken to a deception vendor, you would have heard a similar pitch. If you haven’t talked to one, well, that’s more or less what you’re going to hear in a nutshell.
\n\n\n\nWhile what I’ve stated above is accurate, there are nuances to every approach. As they say, when it comes to cybersecurity, there are no silver bullets. I’m writing this post because when you’re evaluating technology or deploying it, you must understand the conditions under which it can be effective. It allows you to be pragmatic and set realistic expectations.
\n\n\n\nIn the next couple of paragraphs, I’m going to delve into nuances of deception technology that often don’t make it to marketing materials.
\n\n\n\nAs with any security control, there are several components that come together to make deception effective. For now, I’m going to focus on the three most important properties that can make or break a deception technology deployment. These are:
\n\n\n\nIn an ideal world, every deceptive component should exhibit all three properties in totality. The reality, however, is different.
\n\n\n\nSome decoys will be visible to folks inside your company but will be a popular target for attackers. Some will have limited realism but will not be fingeprintable. The point is, when you’re deploying deception in a living, breathing network, trade-offs have to be made – sometimes because of internal limitations, and other times because that’s the best strategy.
\n\n\n\nIn my experience, an understanding of these three properties helps in deciding what trade-offs to make and what you can expect. Let’s break them down one by one.
\n\n\n\nVisibility is an important consideration when deploying deceptive components. In organizations, highly visible decoys will lead to false positives and noise. However, the decoys themselves may be the only effective way to detect an adversary. Being aware of different deceptive components and their visibility property can help inform your thinking about what to do. Here’s a handy table.
\n\n\n\n| Component | Visibility to regular users |
| Private Threat Intelligence (Internet-facing decoys) | Not visible |
| Internal network decoys | Not visible |
| Active Directory decoys | Not visible |
| MiTM Deception | Not visible |
| Endpoint Deception – File Decoys | * Invisible unless the user chooses the option to show hidden files. * The Endpoint deception policy allows file decoys to be hidden to make them invisible to regular users. |
| Endpoint Deception – Browser Lures | * Cookies are invisible to the user. * Credentials may be viewed if the user browses to the Saved Password page. * Browser Favorites will be visible to the user. |
| Endpoint Deception – Session Lures | * Network Shares and Windows Credentials are placed in Credential Manager and rarely accessed by regular users and are therefore effectively invisible. * Session Lures created for software like PuTTY and WinSCP will be visible in the panel of saved sessions. |
| Endpoint Deception – Privilege Escalation | Not visible |
| Endpoint Deception – Defense Evasion | Effectively invisible. Fake Processes are visible in Task Manager but they masquerade as a real process and hide in plain sight. |
If an adversary can fingerprint your deceptive assets, she will be able to avoid them altogether. That can’t be good, can it? Here are a couple of things to consider when looking at deception solutions to figure out if they’re fingerprintable.
\n\n\n\nWhat are the characteristics of the decoys?
\n\n\n\nFor decoys deployed to the network, network characteristics can result in fingerprinting. While it’s relatively easy to fake characteristics like MAC addresses, Hostnames, and IP addresses, NetBIOS names are harder to spoof as they are tied to the machine itself.
\n\n\n\nAre they high interaction?
\n\n\n\nAll deception components have a limitation to the extent to which they fool an adversary. However, it’s important to test whether interacting with a deception component gives away large portions of your deployment. If decoys are created using multiple virtual network adapters from a single machine, it is likely that once you login to a decoy and run “ipconfig / ifconfig”, you will be able to figure out all the decoys projected from that host.
\n\n\n\nTest open-source fingerprinting tools
\n\n\n\nOpen-source fingerprinting tools like HoneypotBuster, attempt to fingerprint deception in active directory and fake credentials in memory. We recommend testing these tools, especially on computer objects in Active Directory as they contain properties that cannot be easily modified in a deception scenario. Also, tools like HoneypotBuster check only the domain from which the tool is run and will not check domains that are trusted in any way. Ensure that you run the tool against the domain where the deception has been configured in Active Directory.
\n\n\n\nThe realism of a deception component is critical to keeping an attacker engaged. Ideally, the component should be real enough that it allows the adversary to reveal tools, tactics, and techniques that are being used in your environment. It should also provide you with enough telemetry to determine what the next steps should be.
\n\n\n\nThe overarching goal here is to make the deception component real enough to engage the adversary for long enough so that you can respond to the event.
\n\n\n\nHere is some guidance for ensuring that the deception technology components you opt for meet the realism criteria:
\n\n\n\nWhen evaluating deception technology, visibility, realism, and fingerprinting should be some of the key components that you should closely look at to figure how the solution will play out in your network.
\n","excerpt":"When evaluating deception technology, look at three key components of the solution to ascertain how effective it will be in your environment – visibility, realism, and fingerprintability.\n","slug":"the-pragmatic-security-leaders-guide-to-deception-technology","date":"2021-02-01T04:04:10.000Z","status":"publish","modified":"2021-02-01T12:39:33.000Z","wordpress_id":18727,"featured_media":{"id":"2a4ed0d8-6b54-5c32-b562-d58644b889bc","source_url":"https://ss-website-content-prod.s3.ap-south-1.amazonaws.com/wp-content/uploads/2021/02/Maze.jpeg","alt_text":"deception technology","large":{"childImageSharp":{"fluid":{"base64":"data:image/jpeg;base64,/9j/2wBDABALDA4MChAODQ4SERATGCgaGBYWGDEjJR0oOjM9PDkzODdASFxOQERXRTc4UG1RV19iZ2hnPk1xeXBkeFxlZ2P/2wBDARESEhgVGC8aGi9jQjhCY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2P/wgARCAANABQDASIAAhEBAxEB/8QAFwABAQEBAAAAAAAAAAAAAAAAAAUCBP/EABYBAQEBAAAAAAAAAAAAAAAAAAABAv/aAAwDAQACEAMQAAAB6EXObaQR/8QAGxAAAgMAAwAAAAAAAAAAAAAAAAMBAhMREjL/2gAIAQEAAQUC1WbLNaC/Kp5O81P/xAAUEQEAAAAAAAAAAAAAAAAAAAAQ/9oACAEDAQE/AT//xAAUEQEAAAAAAAAAAAAAAAAAAAAQ/9oACAECAQE/AT//xAAaEAACAgMAAAAAAAAAAAAAAAAAAQIxEBFR/9oACAEBAAY/ArLxJse+DR//xAAcEAACAgIDAAAAAAAAAAAAAAAAAREhYZExUfH/2gAIAQEAAT8hXkMzRJMN6LW3NDsaj6E0hzDP/9oADAMBAAIAAwAAABAP/wD/xAAVEQEBAAAAAAAAAAAAAAAAAAAAIf/aAAgBAwEBPxBH/8QAFxEBAAMAAAAAAAAAAAAAAAAAAAERIf/aAAgBAgEBPxC5a//EAB0QAAIDAAIDAAAAAAAAAAAAAAERACExUaFBYZH/2gAIAQEAAT8QCDJ0VveITtcW4CWCKPtC86gnxhX31DgsS5l2VfYJIzZGz//Z","aspectRatio":1.5037593984962405,"src":"/static/bb6b3e0811f2e1fac8c855c6c38b11f2/14b42/Maze.jpg","srcSet":"/static/bb6b3e0811f2e1fac8c855c6c38b11f2/f836f/Maze.jpg 200w,\n/static/bb6b3e0811f2e1fac8c855c6c38b11f2/2244e/Maze.jpg 400w,\n/static/bb6b3e0811f2e1fac8c855c6c38b11f2/14b42/Maze.jpg 800w,\n/static/bb6b3e0811f2e1fac8c855c6c38b11f2/47498/Maze.jpg 1200w,\n/static/bb6b3e0811f2e1fac8c855c6c38b11f2/0e329/Maze.jpg 1600w,\n/static/bb6b3e0811f2e1fac8c855c6c38b11f2/42f14/Maze.jpg 1651w","srcWebp":"/static/bb6b3e0811f2e1fac8c855c6c38b11f2/58556/Maze.webp","srcSetWebp":"/static/bb6b3e0811f2e1fac8c855c6c38b11f2/61e93/Maze.webp 200w,\n/static/bb6b3e0811f2e1fac8c855c6c38b11f2/1f5c5/Maze.webp 400w,\n/static/bb6b3e0811f2e1fac8c855c6c38b11f2/58556/Maze.webp 800w,\n/static/bb6b3e0811f2e1fac8c855c6c38b11f2/99238/Maze.webp 1200w,\n/static/bb6b3e0811f2e1fac8c855c6c38b11f2/7c22d/Maze.webp 1600w,\n/static/bb6b3e0811f2e1fac8c855c6c38b11f2/34b00/Maze.webp 1651w","sizes":"(max-width: 800px) 100vw, 800px"}}},"medium":{"childImageSharp":{"fluid":{"base64":"data:image/jpeg;base64,/9j/2wBDABALDA4MChAODQ4SERATGCgaGBYWGDEjJR0oOjM9PDkzODdASFxOQERXRTc4UG1RV19iZ2hnPk1xeXBkeFxlZ2P/2wBDARESEhgVGC8aGi9jQjhCY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2P/wgARCAANABQDASIAAhEBAxEB/8QAFwABAQEBAAAAAAAAAAAAAAAAAAUCBP/EABYBAQEBAAAAAAAAAAAAAAAAAAABAv/aAAwDAQACEAMQAAAB6EXObaQR/8QAGxAAAgMAAwAAAAAAAAAAAAAAAAMBAhMREjL/2gAIAQEAAQUC1WbLNaC/Kp5O81P/xAAUEQEAAAAAAAAAAAAAAAAAAAAQ/9oACAEDAQE/AT//xAAUEQEAAAAAAAAAAAAAAAAAAAAQ/9oACAECAQE/AT//xAAaEAACAgMAAAAAAAAAAAAAAAAAAQIxEBFR/9oACAEBAAY/ArLxJse+DR//xAAcEAACAgIDAAAAAAAAAAAAAAAAAREhYZExUfH/2gAIAQEAAT8hXkMzRJMN6LW3NDsaj6E0hzDP/9oADAMBAAIAAwAAABAP/wD/xAAVEQEBAAAAAAAAAAAAAAAAAAAAIf/aAAgBAwEBPxBH/8QAFxEBAAMAAAAAAAAAAAAAAAAAAAERIf/aAAgBAgEBPxC5a//EAB0QAAIDAAIDAAAAAAAAAAAAAAERACExUaFBYZH/2gAIAQEAAT8QCDJ0VveITtcW4CWCKPtC86gnxhX31DgsS5l2VfYJIzZGz//Z","aspectRatio":1.5066666666666666,"src":"/static/bb6b3e0811f2e1fac8c855c6c38b11f2/32fd5/Maze.jpg","srcSet":"/static/bb6b3e0811f2e1fac8c855c6c38b11f2/06e94/Maze.jpg 113w,\n/static/bb6b3e0811f2e1fac8c855c6c38b11f2/07ab6/Maze.jpg 225w,\n/static/bb6b3e0811f2e1fac8c855c6c38b11f2/32fd5/Maze.jpg 450w,\n/static/bb6b3e0811f2e1fac8c855c6c38b11f2/4a838/Maze.jpg 675w,\n/static/bb6b3e0811f2e1fac8c855c6c38b11f2/9842e/Maze.jpg 900w,\n/static/bb6b3e0811f2e1fac8c855c6c38b11f2/42f14/Maze.jpg 1651w","srcWebp":"/static/bb6b3e0811f2e1fac8c855c6c38b11f2/b8a88/Maze.webp","srcSetWebp":"/static/bb6b3e0811f2e1fac8c855c6c38b11f2/3a3bf/Maze.webp 113w,\n/static/bb6b3e0811f2e1fac8c855c6c38b11f2/975bf/Maze.webp 225w,\n/static/bb6b3e0811f2e1fac8c855c6c38b11f2/b8a88/Maze.webp 450w,\n/static/bb6b3e0811f2e1fac8c855c6c38b11f2/761da/Maze.webp 675w,\n/static/bb6b3e0811f2e1fac8c855c6c38b11f2/210c1/Maze.webp 900w,\n/static/bb6b3e0811f2e1fac8c855c6c38b11f2/34b00/Maze.webp 1651w","sizes":"(max-width: 450px) 100vw, 450px"}}}},"author":{"id":"765e8417-7ed6-55b7-95a7-1d561141e760","name":"Sudarshan Pisupati"}}},{"node":{"id":"e3cd17da-d028-5fad-bd26-31d9b3a4604d","title":"Using deception to shield the insurance sector","content":"\nLet’s cut to the chase, insurance companies are under siege from cyberattacks. An Accenture report from 2020 shows that attacks on insurers have more than doubled from 240 to 519, on average. Insurers also sit on top of sensitive customer data and are at risk of losing it – 44% exposed more than 500,000 customer records in 2019 compared to 15% for cross-industry peers.
\n\n\n\nAs more people around the world come under the ambit of insurance policies, the risk to insurers continues to grow. In this post, we take a look at some of the key pieces of an insurer’s infrastructure that adversaries target, why they go after it, and how you can use deception to build active defenses that mitigate the risk of these attacks and put you in a better position to detect and contain these threats,
\n\n\n\nFor a moment, step into the shoes of a malicious entity targeting an insurance company. Your goal is to get $$$. What are your best opportunities?
\n\n\n\nThe database of all policyholders and their policy details, complete with confidential and protected information is perhaps the most valuable asset of an insurer. This would be the holy grail of compromises. Given that a lot of this information is distributed across many systems (some of them legacy), protecting them is a challenge for the sector.
\n\n\n\nNot only would this data sell for a neat sum on the underground market, but it can also be weaponized in numerous ways, including and not limited to:
\n\n\n\nTo achieve this target, adversaries will have to invest time and money into:
\n\n\n\nCost-benefit analysis reveals Low to medium risk with an extremely high payout.
\n\n\n\nAdvanced and organized criminal syndicates.
\n\n\n\nInsurance companies deal with lots of files. Lots and lots of files. If an adversary succeeds in encrypting as many files as possible, the payout from this activity can be significant.
\n\n\n\nRansomware operators of any sophistication.
\n\n\n\nInsurance companies worldwide are expected to digitize their interactions with consumers. Everything from pre-sales to claims management is expected to be made available to consumers directly in a bid to simplify the consumer experience. This involves the adoption of cloud services, moving previously internal systems to Internet-facing infrastructure, and spinning up even more infrastructure to support business objectives. Adversaries now have a wider attack surface available to them to exploit.
\n\n\n\nMapping external infrastructure is a trivial task and therefore there are minimal considerations for groups adopting this approach.
\n\n\n\nLow effort with payout equivalent to the criticality of the infrastructure they compromise.
\n\n\n\nCybercriminals of any sophistication.
\n\n\n\nDeception is about tilting the odds of winning in your favor. It’s about making reasonable judgments about what the adversary might go after and presenting that information to them on a platter. Deception is about abstracting defenses to individual attacker techniques with lesser effort and increased cost to the attacker.
\n\n\n\nThe core principle of deception is the idea that any interaction with a decoy can be viewed as suspicious and warrants immediate action.
\n\n\n\nBroadly, the plan is to plant decoys across the network, from perimeter to end-point, to deceive the adversary. At a high-level, the following locations will be configured with decoys:
\n\n\n\nBy spreading decoys across the infrastructure, we maximize our chances of detecting adversaries. Remember, we only need to be able to detect the adversary once.
\n\n\n\nThe following is a break-down of what this might look like in practice.
\n\n\n\nLet’s say you don’t want to use deception. The alternative is to understand and defend yourself against every attacker technique. As per MITRE ATT&CK, these are over 100 and this does not account for variations in how these attacks might be executed.
\n\n\n\nDeception is grounded in addressing the motivations of the adversary and presenting fake information on a platter that adversaries find attractive. It is technique-agnostic and abstracts away the complexity that arises from blocking individual tools, techniques, and behaviors.
\n\n\n\nDeception is a form of Active Defense, where security teams take proactive steps to channel the adversary and make their life difficult. It varies from regular defense where you wait for an existing system to generate an alarm and then react.
\n\n\n\nMITRE new active defense framework, Shield, is being adopted by CISOs around the world and we see this approach being embraced by more and more security teams at insurance companies.