For free, of course.
\n\n\n\nAt this point, I’m positive that you’ve heard of MITRE Shield. It’s a new active defense knowledge base released by MITRE – stuff they’ve been implementing for over a decade to engage adversaries and derail attacks. They’ve opened it up to everyone, and for the first time perhaps, the infosec community has a shared vocabulary and framework for actively defending against attacks instead of reacting to them.
\n\n\n\nI’ve been having conversations about MITRE Shield and Active Defense with CISOs and customers. While some of the conversations are basic and around what is active defense and why does it matter, what I consistently hear from across the board is – “how do we even begin to implement this stuff?” That’s a fair question, but it’s only one part. What more folks aren’t asking is, where do we implement active defenses for the most impact.
\n\n\n\nI’ve zeroed down on four active defense techniques from the MITRE Shield matrix that address both the questions – how do I get started with this and where should I be building active defenses first. Think of this as a soft launch guide for your Active Defense journey.
\n\n\n\nI’ve selected techniques based on two factors:
\n\n\n\nAs a result, all four defenses are Active Directory exclusive. Active Directory has become an adversary favorite attack vector. By deploying active defenses in Active Directory, you’ll be able to make great strides in disrupting adversary actions.
\n\n\n\nOnly two:
\n\n\n\nLet’s dive right in.
\n\n\n\nMITRE Shield Procedure – DPR002
\n\n\n\nPlant decoy accounts in your Active Directory. Any interaction with these accounts is a high-confidence indicator of compromise. These accounts will also help you study the adversary’s actions, mislead attackers by putting these accounts in their path during enumeration, and use them to influence the attacker’s actions and next steps.
\n\n\n\nSet up a decoy account and give it “Domain Admin” privileges. This will make the account interesting to the adversary.
\n\n\n\nIn this video, we focus on detecting the operation. We show how to setup Windows Auditing so that we can capture the appropriate log. We also demonstrate an attack to test if the logs are captured appropriately.
\n\n\n\nPsuedo-code for detection rule:
\n\n\n\nIf login_activity observed for decoy_account then raise a high priority alert.\n\n\n\n
MITRE Shield Procedures – DPR0022 and DPR0033
\n\n\n\nDecoy systems are an excellent active defense tool because they act as a target to lure away attackers from legitimate assets. Decoy content could be anything ranging from fake files to browser shortcuts that act as breadcrumbs to point adversaries to decoy systems.
\n\n\n\nIn this video, we set up a webserver on our test machine to channel an adversary towards interacting with it. We create a browser shortcut and place it in a publically accessible location on the Active Directory Server to make it easier for the adversary to discover.
\n\n\n\nWe ensure that our web server is logging connections. If an adversary attempts to conduct reconnaissance against this webserver, we should see a logline in the webserver log.
\n\n\n\nPsuedo-code for detection rule:
\n\n\n\nIf REQUEST observed for /admin then raise a high priority alert.\n\n\n\n
MITRE Shield Procedure – DPR0024
\n\n\n\nDecoy credentials are fake usernames and passwords that can be planted in a variety of places including in the Active Directory. They act as silent alarms when interacted with and also as a means to delay the attacker.
\n\n\n\nIn this video, we create a batch file planted with fake credentials and store it in a publically accessible location on the Active Directory Server to make it easier for the adversary to discover.
\n\n\n\nIn this video, we show how to set up auditing on your test machine to capture attempts to use the credentials against your test machine.
\n\n\n\nPsuedo-code for detection rule:
\n\n\n\nIf login_event is 4625 AND username is admin\n\n\n\n
Then raise a high priority alert.
MITRE Shield Procedure – DPR0052
\n\n\n\nPocket litter is an active defense technique used to mislead attackers into thinking that the system and user they’re exploiting are legit. You plant fake documents, browser history, browser sessions, etc. to give adversaries the confidence that they are on the right track.
\n\n\n\nIn this video, we will set up a file share on the test machine. We will plant a shortcut to this file share in a publically accessible location on the Active Directory Server to make it easier for the adversary to discover.
\n\n\n\nIn this video, we show how to set up file share auditing on your test machine to capture attempts to access the file share on your machine.
\n\n\n\nPsuedo-code for detection rule:
\n\n\n\nIf login_event is 5140 AND share_name contains shared_folder_name\nThen raise a high priority alert.\n\n\n\n
These folders are accessible to all users within your environment. Over time, these folders accrue a lot of files and scripts that are interesting to adversaries. We wish to use these folders to misdirect the attacker, should the attacker go browsing through these folders. It is also uncommon for regular users to require to browse through this folder.
\n\n\n\nThe focus of this guide was to get your mind thinking about active defense. If there’s one thing I’d like you to walk away with, it’s that if any of these defenses trigger an alarm you will have discovered malicious activity for a couple of hours of effort. And it cost you nothing.
\n\n\n\nAt Smokescreen, we’ve been implementing active defense programs since before it was a thing. No wonder then that Smokescreen covered 95% of MITRE Shield when it launched in Sep 2020. If you’d like to see how we can help, hit us up. Here’s a mapping of Smokescreen to MITRE Shield if it’s helpful.
\n\n\n\nWe’re also running active defense workshops where we deconstruct MITRE Shield and talk about how you can implement it. Feel free to sign up.
\n","excerpt":"For free, of course. At this point, I’m positive that you’ve heard of MITRE Shield. It’s a new active defense knowledge base released by MITRE – stuff they’ve been implementing for over a decade to engage adversaries and derail attacks. They’ve opened it up to everyone, and for the first time perhaps, the infosec community […]\n","slug":"four-mitre-shield-techniques-you-can-implement-in-2021","date":"2020-12-30T16:48:39.000Z","modified":"2021-02-03T07:14:04.000Z","status":"publish","featured_media":{"id":"3b48d9b0-598d-52ec-92d7-1eef58be5ea8","source_url":"https://ss-website-content-prod.s3.ap-south-1.amazonaws.com/wp-content/uploads/2020/12/Smokescreen-MITRE-Shield-Techniques.png","alt_text":"Smokescreen-MITRE-Shield-Techniques","large":{"childImageSharp":{"fluid":{"base64":"data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAABQAAAALCAYAAAB/Ca1DAAAACXBIWXMAAAsTAAALEwEAmpwYAAACQklEQVQoz0WSSW8TQRCF84s5IXFBHJEQ4g9wQggOkbhEBEEIS4xDMkZeEhzH8SITJ+N4tu4Zz+6xncerceIcamq6W/11Vb23ZU8mULYN33UxUx5mWsHXGjPfRxgECGezh+Ba9gOea8+Dchy4lgXn5gbCsUwTW/IZXHTR6w/RG11jMrV5mRcJiKIIcRw/BNdRGJZggfpKbaAboDkew6hWcWg0YHRGuDQtFFmKPMuQpSmSJEHKSEooH4jC8sHAlypdeLZF4HRT5ZbFn9HlGOOrK5gTEybXJl+8NDkK7SPP8xKWpMzZkrlgXjBWPFshZQ7DpISWwBuWuf3lKz7sf8f23jd8rBxit/obe8c1NLoXmOcZUsLiyIY3rUG755z5KbRlINZt5MEJVrkFz9UEmmvgzo8D7Faq2Cdk5+AXPlWPcNg6RWc4YtsJsjmQWAfQJ0/gd1/Bbz+D138L3XkO1XyE1PoJpWICr9ctN9pnaHXOcdYfoHXRw1/m7ugfivmcs0yR5bdInD8I2k+he68RCHT4Dqr3Brr1GJl7TGC0BopCmkoFVEwsEVNFmVnKEKWlwpSzy/0zJP0XSNw6YqeBePIZyfg90sFLFH4DygvvKmTL1UoFNcPA8dERDOZms4l6vY4Jh1wqTfi8KLBY3qIo5igWQLFkyN5ixVhQbXstijOlOgyXG4rmLk19Z+gsE0HW1pFqg4CmZhc+za/EMuzMEQ+KZe5tI/4Rujg/uIOJee/NLLCNFxmyJ+ez0tyKqrvlfeFIt/8BWgssJrC5KxYAAAAASUVORK5CYII=","aspectRatio":1.9047619047619047,"src":"/static/edada2176ce537fff9fc98c912eee812/ee604/Smokescreen-MITRE-Shield-Techniques.png","srcSet":"/static/edada2176ce537fff9fc98c912eee812/69585/Smokescreen-MITRE-Shield-Techniques.png 200w,\n/static/edada2176ce537fff9fc98c912eee812/497c6/Smokescreen-MITRE-Shield-Techniques.png 400w,\n/static/edada2176ce537fff9fc98c912eee812/ee604/Smokescreen-MITRE-Shield-Techniques.png 800w,\n/static/edada2176ce537fff9fc98c912eee812/f3583/Smokescreen-MITRE-Shield-Techniques.png 1200w,\n/static/edada2176ce537fff9fc98c912eee812/5707d/Smokescreen-MITRE-Shield-Techniques.png 1600w,\n/static/edada2176ce537fff9fc98c912eee812/0ef64/Smokescreen-MITRE-Shield-Techniques.png 2400w","srcWebp":"/static/edada2176ce537fff9fc98c912eee812/58556/Smokescreen-MITRE-Shield-Techniques.webp","srcSetWebp":"/static/edada2176ce537fff9fc98c912eee812/61e93/Smokescreen-MITRE-Shield-Techniques.webp 200w,\n/static/edada2176ce537fff9fc98c912eee812/1f5c5/Smokescreen-MITRE-Shield-Techniques.webp 400w,\n/static/edada2176ce537fff9fc98c912eee812/58556/Smokescreen-MITRE-Shield-Techniques.webp 800w,\n/static/edada2176ce537fff9fc98c912eee812/99238/Smokescreen-MITRE-Shield-Techniques.webp 1200w,\n/static/edada2176ce537fff9fc98c912eee812/7c22d/Smokescreen-MITRE-Shield-Techniques.webp 1600w,\n/static/edada2176ce537fff9fc98c912eee812/f1e40/Smokescreen-MITRE-Shield-Techniques.webp 2400w","sizes":"(max-width: 800px) 100vw, 800px"}}},"medium":{"childImageSharp":{"fluid":{"base64":"data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAABQAAAAKCAYAAAC0VX7mAAAACXBIWXMAAAsTAAALEwEAmpwYAAACFUlEQVQoz02SS0/bQBSF83f7A7rprpt22S5bqbtu6KpqEaiKUAuEgAgJIQhC0jyI4zi249f4NbZj0OkZJ0pZXM3Ynvl87rmnZhsGTF2HNp1iPtehGyZc10UoBKIwRBzHSLal9lEUVd+E7yPgOW+1gmNZUBxrsUBttVxWsItGA832LVr9R9iOhyKTyLMMaZruSqYx0oTwKEQkAgSeQ6BFoAnFUdBapZA1nkwxnc0w518WpgndtFgmshfQKF0jTApWDhGvkcgSMnumarlTWXN5aULY96Pf+PHnBAeNJg7OznHcucb+aRO261FpjlSmEF4fwh2w3TGE00UiBpDiDqVcwuM522DLLskTtvztVx37x6c4JHCvfoTD5gXOuj2sFDAv2K5AeP8Wwd17iNs38AafETx8QNB5BWn8hO/HBOobDy3W/fAvxjMNY22O4eMMQ+59mv/8VFJdhkxyIA/v4PUJGX5CMPiIYPQVfvc1pH0C34s2CiszWYamwaR/yk/XtuFzgg4nGIaCPuasFIWxh8w6QhbNkdgt7uvItS8oRYfAcAukhwvCri4vcd1u46rVQu/mBr1eD6PRqIqKlLIaSlECWfGELC+54v+areFQxG7KDqEqU2EQIGbO0iRhi5vYKJgkLOG7iGqVYhGoyDCDzqqKjL3tsgKqMKoHNXYV0sDzqgtVqAlXoJdZVM/qfbQNt7JGWVTNgqx/v9rh65njvVwAAAAASUVORK5CYII=","aspectRatio":1.9152542372881356,"src":"/static/edada2176ce537fff9fc98c912eee812/62b1f/Smokescreen-MITRE-Shield-Techniques.png","srcSet":"/static/edada2176ce537fff9fc98c912eee812/e7519/Smokescreen-MITRE-Shield-Techniques.png 113w,\n/static/edada2176ce537fff9fc98c912eee812/7e7e9/Smokescreen-MITRE-Shield-Techniques.png 225w,\n/static/edada2176ce537fff9fc98c912eee812/62b1f/Smokescreen-MITRE-Shield-Techniques.png 450w,\n/static/edada2176ce537fff9fc98c912eee812/e2e7f/Smokescreen-MITRE-Shield-Techniques.png 675w,\n/static/edada2176ce537fff9fc98c912eee812/db955/Smokescreen-MITRE-Shield-Techniques.png 900w,\n/static/edada2176ce537fff9fc98c912eee812/0ef64/Smokescreen-MITRE-Shield-Techniques.png 2400w","srcWebp":"/static/edada2176ce537fff9fc98c912eee812/b8a88/Smokescreen-MITRE-Shield-Techniques.webp","srcSetWebp":"/static/edada2176ce537fff9fc98c912eee812/3a3bf/Smokescreen-MITRE-Shield-Techniques.webp 113w,\n/static/edada2176ce537fff9fc98c912eee812/975bf/Smokescreen-MITRE-Shield-Techniques.webp 225w,\n/static/edada2176ce537fff9fc98c912eee812/b8a88/Smokescreen-MITRE-Shield-Techniques.webp 450w,\n/static/edada2176ce537fff9fc98c912eee812/761da/Smokescreen-MITRE-Shield-Techniques.webp 675w,\n/static/edada2176ce537fff9fc98c912eee812/210c1/Smokescreen-MITRE-Shield-Techniques.webp 900w,\n/static/edada2176ce537fff9fc98c912eee812/f1e40/Smokescreen-MITRE-Shield-Techniques.webp 2400w","sizes":"(max-width: 450px) 100vw, 450px"}}}},"categories":[{"id":"01e02cea-7205-5ef8-88f3-aaee8ace0430","slug":"active-defense","name":"Active Defense"},{"id":"a725b316-af4b-5d16-8453-4b07c65d8fca","slug":"deception","name":"deception"},{"id":"947c3922-5c19-54f8-bc5a-e00845f522eb","slug":"mitre","name":"MITRE"},{"id":"0aaaa4e2-c9fd-5357-95d2-3884b38b33c0","slug":"strategy","name":"strategy"},{"id":"836fd412-127d-5daa-9f15-790564d66ac0","slug":"uncategorized","name":"Uncategorized"}],"author":{"id":"765e8417-7ed6-55b7-95a7-1d561141e760","name":"Sudarshan Pisupati"},"yoast_meta":{"yoast_wpseo_twitter_title":"","yoast_wpseo_twitter_description":"","yoast_wpseo_redirect":"","yoast_wpseo_opengraph_title":"","yoast_wpseo_opengraph_description":"","yoast_wpseo_metakeywords":"","yoast_wpseo_metadesc":"Want to implement MITRE Shield and get started with active defense? Here are four high-impact techniques that you can implement tomorrow. For free.","yoast_wpseo_meta_robots_noindex":"","yoast_wpseo_meta_robots_nofollow":"","yoast_wpseo_meta_robots_adv":"","yoast_wpseo_linkdex":"74","yoast_wpseo_focuskw":"MITRE Shield","yoast_wpseo_canonical":""}},"relatedPosts":{"edges":[{"node":{"id":"e3cd17da-d028-5fad-bd26-31d9b3a4604d","title":"Using deception to shield the insurance sector","content":"\nLet’s cut to the chase, insurance companies are under siege from cyberattacks. An Accenture report from 2020 shows that attacks on insurers have more than doubled from 240 to 519, on average. Insurers also sit on top of sensitive customer data and are at risk of losing it – 44% exposed more than 500,000 customer records in 2019 compared to 15% for cross-industry peers.
\n\n\n\nAs more people around the world come under the ambit of insurance policies, the risk to insurers continues to grow. In this post, we take a look at some of the key pieces of an insurer’s infrastructure that adversaries target, why they go after it, and how you can use deception to build active defenses that mitigate the risk of these attacks and put you in a better position to detect and contain these threats,
\n\n\n\nFor a moment, step into the shoes of a malicious entity targeting an insurance company. Your goal is to get $$$. What are your best opportunities?
\n\n\n\nThe database of all policyholders and their policy details, complete with confidential and protected information is perhaps the most valuable asset of an insurer. This would be the holy grail of compromises. Given that a lot of this information is distributed across many systems (some of them legacy), protecting them is a challenge for the sector.
\n\n\n\nNot only would this data sell for a neat sum on the underground market, but it can also be weaponized in numerous ways, including and not limited to:
\n\n\n\nTo achieve this target, adversaries will have to invest time and money into:
\n\n\n\nCost-benefit analysis reveals Low to medium risk with an extremely high payout.
\n\n\n\nAdvanced and organized criminal syndicates.
\n\n\n\nInsurance companies deal with lots of files. Lots and lots of files. If an adversary succeeds in encrypting as many files as possible, the payout from this activity can be significant.
\n\n\n\nRansomware operators of any sophistication.
\n\n\n\nInsurance companies worldwide are expected to digitize their interactions with consumers. Everything from pre-sales to claims management is expected to be made available to consumers directly in a bid to simplify the consumer experience. This involves the adoption of cloud services, moving previously internal systems to Internet-facing infrastructure, and spinning up even more infrastructure to support business objectives. Adversaries now have a wider attack surface available to them to exploit.
\n\n\n\nMapping external infrastructure is a trivial task and therefore there are minimal considerations for groups adopting this approach.
\n\n\n\nLow effort with payout equivalent to the criticality of the infrastructure they compromise.
\n\n\n\nCybercriminals of any sophistication.
\n\n\n\nDeception is about tilting the odds of winning in your favor. It’s about making reasonable judgments about what the adversary might go after and presenting that information to them on a platter. Deception is about abstracting defenses to individual attacker techniques with lesser effort and increased cost to the attacker.
\n\n\n\nThe core principle of deception is the idea that any interaction with a decoy can be viewed as suspicious and warrants immediate action.
\n\n\n\nBroadly, the plan is to plant decoys across the network, from perimeter to end-point, to deceive the adversary. At a high-level, the following locations will be configured with decoys:
\n\n\n\nBy spreading decoys across the infrastructure, we maximize our chances of detecting adversaries. Remember, we only need to be able to detect the adversary once.
\n\n\n\nThe following is a break-down of what this might look like in practice.
\n\n\n\nLet’s say you don’t want to use deception. The alternative is to understand and defend yourself against every attacker technique. As per MITRE ATT&CK, these are over 100 and this does not account for variations in how these attacks might be executed.
\n\n\n\nDeception is grounded in addressing the motivations of the adversary and presenting fake information on a platter that adversaries find attractive. It is technique-agnostic and abstracts away the complexity that arises from blocking individual tools, techniques, and behaviors.
\n\n\n\nDeception is a form of Active Defense, where security teams take proactive steps to channel the adversary and make their life difficult. It varies from regular defense where you wait for an existing system to generate an alarm and then react.
\n\n\n\nMITRE new active defense framework, Shield, is being adopted by CISOs around the world and we see this approach being embraced by more and more security teams at insurance companies.
Pentest reports tell a story. The story of how the team managed to break into your environment. In my experience, a critical component usually missing from these reports is the rationale behind the choices made by the pentesters who ran the assessment.
\n\n\n\nAsking why allows you to deconstruct choices that real threat actors might make in your environment. Having a sense of those choices will give you some active defense opportunities.
\n\n\n\nLet me demonstrate this with a little thought experiment. Let’s consider a pentest where the objective was to demonstrate access to the customer database. Here’s what the pentesters broadly did:
\n\n\n\nIn each of these steps, the pentesters made some choices. As you’ll now see, deconstructing these choices can help build better defenses.
\n\n\n\nThe Active Defense matrix was released by MITRE to provide a framework for identifying opportunities where adversary behavior can be influenced to enable defenders to easily spot threats.
\n\n\n\nThe foundation of the Active Defense approach rests on three principles:
\n\n\n\nSo let’s begin by deconstructing each of the 7 steps in the report to identify Active Defense opportunities
\n\n\n\nBlock PowerShell to force the adversary to use non-PowerShell options.
\n\n\n\nSince PowerShell usage for C2 is fairly common, it reduces the risk of being hit with commodity malware that uses PowerShell even today.
\n\n\n\nMITRE Shield Technique: Security Controls
\n\n\n\nSetup attractive decoy accounts, assign attractive privileges, and setup attribute level auditing on description, SPN, etc. to monitor enumeration attempts. This has the added advantage of detecting password spraying regardless of intensity and staggering strategies.
\n\n\n\nGain insight into enumeration activities being conducted against the domain from a user perspective.
\n\n\n\n(Note: Don’t ever use these accounts for any operations. There are ways to make this opsec safe)
\n\n\n\nMITRE Shield Technique: Decoy Account
\n\n\n\nSetup decoy computers, assign attractive hostnames to databases, and setup attribute level auditing on description, SPN, etc. to monitor enumeration attempts.
\n\n\n\nGain insight into enumeration activities being conducted against the domain from a computer perspective.
\n\n\n\nMITRE Shield Technique: Decoy System
\n\n\n\nLet’s assume that Kerberoasting was the privilege escalation technique that worked. In this case, let’s also assume that the service account was a domain admin.
\n\n\n\nMakes the adversary believe they have obtained hashes to the customer database SQL service account while at the same time removing the risk of kerberoasting a real domain admin account.
\n\n\n\nA similar approach can be used for other popular privilege escalation techniques.
\n\n\n\nThere are many techniques available for privilege escalation, and some of them lend themselves well to an Active Defense approach. However, in cases where that doesn’t work, focus on what the adversary intends to accomplish with those privileged credentials.
\n\n\n\nMITRE Shield Technique: Decoy Account, Decoy System, Security Controls
\n\n\n\nEven a single port query against the decoy SQL server system is worth investigating while complicating access to the real customer database.
\n\n\n\nMITRE Shield Technique: Network Diversity, Decoy Diversity, Network Manipulation
\n\n\n\nEven a single port query against the decoy SQL server system is worth investigating while complicating access to the real customer database
\n\n\n\nMITRE Shield Technique: Standard Operating Procedure, Decoy Credentials
\n\n\n\nUnfortunately, if the adversary has reached this point, detection difficulty increases. This is because, from an analytics perspective, you are looking for a legitimate account, logging into a legitimate database, and running possibly legitimate queries. However, there are still things we can do.
\n\n\n\nMITRE Shield Technique: Hunting, System Activity Monitoring
\n\n\n\nI present an abstracted approach to applying Active Defense use cases. It has 4 pieces:
\n\n\n\nYou can use the above as a combination to assess a use case beyond just analyzing pentest reports. The pentest report was just a means for me to present my idea.
\n\n\n\nI would like you to note a few things.
\n\n\n\nOn Sep 14, 2020, MITRE, the federally funded R&D organization perhaps best known for its popular ATT&CK framework, announced Shield – an Active Defense knowledge base developed to arm cybersecurity defenders with a framework for actively dealing with threats instead of passively reacting to them. As MITRE puts it, Shield has been “derived from over 10 years of adversary engagement experience. It spans the range from high level, CISO ready considerations of opportunities and objectives, to practitioner friendly discussions of the TTPs available to defenders.”
\n\n\n\nAs an industry armed with protecting networks and IT infrastructures, we have been overly reliant on passive defenses. Given the rapid pace of technology development, shortage of skilled cybersecurity professionals, and the vendor community’s ‘assume breach’ schtick, we have become accustomed to dealing with threats on our turf, on the adversary’s terms, instead of actively smoking out the threat. We’re always reacting after the fact. Which is why Shield couldn’t have arrived sooner.
\n\n\n\nSince then, I’ve had countless conversations with CISOs attempting to understand how Shield can inform their security posture and incident handlers/practitioners on what they can do today that might have an outsized impact on their ability to defend. I’ve also realized that there’s a fundamental conversation to be had about what ‘active defense’ in cybersecurity means, and why teams must adopt it as an integral part of their security program and best practices.
\n\n\n\nOver the last 10 years, I have been a part of multiple incident response projects. The story usually unfolds in a similar fashion – evidence of compromise is on the network. Jump to the ‘Cotton Eye Joe’ problem – where did it come from, where does it go. And of course, what did it damage.
\n\n\n\nPerhaps the most high-pressure scenarios are those where the threat is not just active but is actively moving around the network, say something like ransomware. Machine after machine is getting infected, and there is nothing you can do to stop it.
\n\n\n\nConsider this nightmare scenario for a moment. You work security for a business with 1000 employees. You don’t have an anti-virus (AV) installed (hypothetical). You have been infected by ransomware. You immediately take a call to purchase an AV, the budget gets freed up, and you go to procure it. But it takes days, even weeks if not months to procure it and push it out to every single workstation and server. Your AV has now future proof-ed you in some way, but the adversary has already finished her attack. You are recovering from the disaster in some form. Maybe you are restoring backups. Maybe you just paid up the ransom. The response was required in minutes and hours. That battle was lost.
\n\n\n\nThe fallouts of such incidents can be brutal. There is intense pressure on security teams, and they carry heavy burdens. I have seen security folks stay up 96 hours at a stretch, trying to squeeze in a couple of minutes of sleep in offices amid thousands of messages, texts, and calls. I have seen top management in companies get involved and ask tough questions to which there are no good answers.
\n\n\n\nIf you are involved in any security function in your organization, at any level, this should be relatable. To some, something like this might have happened recently. For some, it’s been a while. And if it hasn’t happened to you yet, chances are, it will happen at some point – sooner rather than later.
\n\n\n\nAnd then let’s talk money. It costs a lot of money. I’m talking serious cash. In the order of hundreds of thousands of dollars. All being spent in a matter of days. You are paying your vendors, service providers, advisors, and implementers. You are paying by the hour for everyone involved in the response, IT teams, security teams, and active directory teams. And then people wonder why cybersecurity is a $123 billion industry.
\n\n\n\nIt gets chaotic.
\n\n\n\nIn my experience, you can contain that chaos with an Active Defense mindset.
\n\n\n\nActive defense isn’t really a new concept. For example, the armed forces and police have active defense protocols. If intelligence picks up an impending threat, the machinery kicks in to reflect the seriousness of the threat. Intensified checking at posts, barricades across high-value locations and roads, enhanced protective measures for ministers and other high-value targets, orders to restrict the movement of people and goods, frequent patrolling – you get the drift.
\n\n\n\nNow notice this strategy for a moment. It includes a lot of tough calls because the threat has a material impact on the life of civilians. There’s a protocol in place. Also, notice that the strategy doesn’t involve waiting for the bad guy to move around as he pleases. It actively tries to smoke the threat out. The alternative is to play catch up. Always one step behind the threat. Ring any bells? Of course, it does because that’s exactly what we do in cybersecurity.
\n\n\n\nWhat I’m getting to is that when you are in the midst of an incident, you have ways to try to smoke out the threat, make life difficult for the adversary, and minimize the impact of the breach. One that can be measured in days (if not hours), will not be as costly and will reign in panic.
\n\n\n\nIt involves barricades, restriction of movement, enhanced patrolling, and of course, protecting the crown jewels.
\n\n\n\nHere’s how it might look like in a real-life ‘incident’:
\n\n\n\nThis is, of course, a non-exhaustive list but all of these can be really quick to do! The biggest impediment is usually taking the tough calls as this may temporarily and disrupt services. It also happens because of poor team communication across the board. It is because of this that we forgo a defensive advantage and chase the threat for days and months on end.
\n\n\n\nBut hey, if you drill this out before things go wrong, you will already know and understand what the impact is going to be.
\n\n\n\nThink about it this way. You have an existing set of software defenses. That should make life difficult for the software tactics of the threat. Active defense is you putting additional software defenses to attack the human behind the threat.
\n\n\n\nThis brings me back to why MITRE Shield couldn’t have come sooner. For the first time, defenders have a shared vocabulary and framework for what they can proactively do to defend their networks. It even maps out to MITRE ATT&CK, telling you exactly which defense can disrupt an attack tactic. I strongly urge you to check out Shield.
\n\n\n\nIf you need help with understanding this more, we are running 30 mins workshops to deconstruct MITRE Shield and breakdown how you can get started with active defense. Feel free to sign up here.
\n\n\n\nWe have also released our mapping to MITRE Shield. With Smokescreen, you can achieve 95% coverage of all the active defense techniques included in the framework. You can get the mapping from here. And if you want to see all of this in action, you can always ask for a demo.
\n\n\n\nI’m very excited about all the conversations that are happening around MITRE Shield. As we help our customers implement Shield and achieve more active defense coverage, I will be sharing what I learn. Feel free to hit me up on LinkedIn or Twitter.
\n","excerpt":"Active defense provides defenders with a shared vocabulary and framework for actively dealing with threats instead of passively reacting to them.\n","slug":"active-defense-for-incident-responders","date":"2020-12-29T01:34:46.000Z","status":"publish","modified":"2021-01-24T16:42:40.000Z","wordpress_id":18639,"featured_media":{"id":"b7c5bd0f-1190-59a5-8777-52cae2404171","source_url":"https://ss-website-content-prod.s3.ap-south-1.amazonaws.com/wp-content/uploads/2020/12/Smokescreen-Active-defense-blog-post-scaled.jpeg","alt_text":"Active defense","large":{"childImageSharp":{"fluid":{"base64":"data:image/jpeg;base64,/9j/2wBDABALDA4MChAODQ4SERATGCgaGBYWGDEjJR0oOjM9PDkzODdASFxOQERXRTc4UG1RV19iZ2hnPk1xeXBkeFxlZ2P/2wBDARESEhgVGC8aGi9jQjhCY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2P/wgARCAAeABQDASIAAhEBAxEB/8QAGAAAAwEBAAAAAAAAAAAAAAAAAAMEBQL/xAAXAQEBAQEAAAAAAAAAAAAAAAAAAQID/9oADAMBAAIQAxAAAAHhjmc9wlhS3Z1SVGcH/8QAHBAAAgICAwAAAAAAAAAAAAAAAAECEhETITFB/9oACAEBAAEFAoRNaKEevMF1Y4Fhu5sP/8QAFBEBAAAAAAAAAAAAAAAAAAAAIP/aAAgBAwEBPwEf/8QAFBEBAAAAAAAAAAAAAAAAAAAAIP/aAAgBAgEBPwEf/8QAGhAAAQUBAAAAAAAAAAAAAAAAEAABERIgIf/aAAgBAQAGPwLUDrqx/8QAHBABAQEAAgMBAAAAAAAAAAAAAQARITFBUWHh/9oACAEBAAE/ITMnIySLEeluZy5+yTG+W8Q46l+yCjkukofy/9oADAMBAAIAAwAAABCYLEP/xAAVEQEBAAAAAAAAAAAAAAAAAAAgIf/aAAgBAwEBPxCD/8QAFhEBAQEAAAAAAAAAAAAAAAAAEBFB/9oACAECAQE/EKaf/8QAHhABAAICAgMBAAAAAAAAAAAAAQARITFBYVGBkeH/2gAIAQEAAT8QGCBw41FZqumrH9hlpvRdSkYcahaBVVt47I2YepIiqF88TCrrUCEM6mvuO7dUFejqPTcf/9k=","aspectRatio":0.6644518272425249,"src":"/static/4cdd14b89e9545a1913f042df0c033ec/14b42/Smokescreen-Active-defense-blog-post-scaled.jpg","srcSet":"/static/4cdd14b89e9545a1913f042df0c033ec/f836f/Smokescreen-Active-defense-blog-post-scaled.jpg 200w,\n/static/4cdd14b89e9545a1913f042df0c033ec/2244e/Smokescreen-Active-defense-blog-post-scaled.jpg 400w,\n/static/4cdd14b89e9545a1913f042df0c033ec/14b42/Smokescreen-Active-defense-blog-post-scaled.jpg 800w,\n/static/4cdd14b89e9545a1913f042df0c033ec/47498/Smokescreen-Active-defense-blog-post-scaled.jpg 1200w,\n/static/4cdd14b89e9545a1913f042df0c033ec/0e329/Smokescreen-Active-defense-blog-post-scaled.jpg 1600w,\n/static/4cdd14b89e9545a1913f042df0c033ec/4f4f6/Smokescreen-Active-defense-blog-post-scaled.jpg 1700w","srcWebp":"/static/4cdd14b89e9545a1913f042df0c033ec/58556/Smokescreen-Active-defense-blog-post-scaled.webp","srcSetWebp":"/static/4cdd14b89e9545a1913f042df0c033ec/61e93/Smokescreen-Active-defense-blog-post-scaled.webp 200w,\n/static/4cdd14b89e9545a1913f042df0c033ec/1f5c5/Smokescreen-Active-defense-blog-post-scaled.webp 400w,\n/static/4cdd14b89e9545a1913f042df0c033ec/58556/Smokescreen-Active-defense-blog-post-scaled.webp 800w,\n/static/4cdd14b89e9545a1913f042df0c033ec/99238/Smokescreen-Active-defense-blog-post-scaled.webp 1200w,\n/static/4cdd14b89e9545a1913f042df0c033ec/7c22d/Smokescreen-Active-defense-blog-post-scaled.webp 1600w,\n/static/4cdd14b89e9545a1913f042df0c033ec/35cfd/Smokescreen-Active-defense-blog-post-scaled.webp 1700w","sizes":"(max-width: 800px) 100vw, 800px"}}},"medium":{"childImageSharp":{"fluid":{"base64":"data:image/jpeg;base64,/9j/2wBDABALDA4MChAODQ4SERATGCgaGBYWGDEjJR0oOjM9PDkzODdASFxOQERXRTc4UG1RV19iZ2hnPk1xeXBkeFxlZ2P/2wBDARESEhgVGC8aGi9jQjhCY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2P/wgARCAAeABQDASIAAhEBAxEB/8QAGAAAAwEBAAAAAAAAAAAAAAAAAAMEBQL/xAAXAQEBAQEAAAAAAAAAAAAAAAAAAQID/9oADAMBAAIQAxAAAAHhjmc9wlhS3Z1SVGcH/8QAHBAAAgICAwAAAAAAAAAAAAAAAAECEhETITFB/9oACAEBAAEFAoRNaKEevMF1Y4Fhu5sP/8QAFBEBAAAAAAAAAAAAAAAAAAAAIP/aAAgBAwEBPwEf/8QAFBEBAAAAAAAAAAAAAAAAAAAAIP/aAAgBAgEBPwEf/8QAGhAAAQUBAAAAAAAAAAAAAAAAEAABERIgIf/aAAgBAQAGPwLUDrqx/8QAHBABAQEAAgMBAAAAAAAAAAAAAQARITFBUWHh/9oACAEBAAE/ITMnIySLEeluZy5+yTG+W8Q46l+yCjkukofy/9oADAMBAAIAAwAAABCYLEP/xAAVEQEBAAAAAAAAAAAAAAAAAAAgIf/aAAgBAwEBPxCD/8QAFhEBAQEAAAAAAAAAAAAAAAAAEBFB/9oACAECAQE/EKaf/8QAHhABAAICAgMBAAAAAAAAAAAAAQARITFBYVGBkeH/2gAIAQEAAT8QGCBw41FZqumrH9hlpvRdSkYcahaBVVt47I2YepIiqF88TCrrUCEM6mvuO7dUFejqPTcf/9k=","aspectRatio":0.6647058823529411,"src":"/static/4cdd14b89e9545a1913f042df0c033ec/32fd5/Smokescreen-Active-defense-blog-post-scaled.jpg","srcSet":"/static/4cdd14b89e9545a1913f042df0c033ec/06e94/Smokescreen-Active-defense-blog-post-scaled.jpg 113w,\n/static/4cdd14b89e9545a1913f042df0c033ec/07ab6/Smokescreen-Active-defense-blog-post-scaled.jpg 225w,\n/static/4cdd14b89e9545a1913f042df0c033ec/32fd5/Smokescreen-Active-defense-blog-post-scaled.jpg 450w,\n/static/4cdd14b89e9545a1913f042df0c033ec/4a838/Smokescreen-Active-defense-blog-post-scaled.jpg 675w,\n/static/4cdd14b89e9545a1913f042df0c033ec/9842e/Smokescreen-Active-defense-blog-post-scaled.jpg 900w,\n/static/4cdd14b89e9545a1913f042df0c033ec/4f4f6/Smokescreen-Active-defense-blog-post-scaled.jpg 1700w","srcWebp":"/static/4cdd14b89e9545a1913f042df0c033ec/b8a88/Smokescreen-Active-defense-blog-post-scaled.webp","srcSetWebp":"/static/4cdd14b89e9545a1913f042df0c033ec/3a3bf/Smokescreen-Active-defense-blog-post-scaled.webp 113w,\n/static/4cdd14b89e9545a1913f042df0c033ec/975bf/Smokescreen-Active-defense-blog-post-scaled.webp 225w,\n/static/4cdd14b89e9545a1913f042df0c033ec/b8a88/Smokescreen-Active-defense-blog-post-scaled.webp 450w,\n/static/4cdd14b89e9545a1913f042df0c033ec/761da/Smokescreen-Active-defense-blog-post-scaled.webp 675w,\n/static/4cdd14b89e9545a1913f042df0c033ec/210c1/Smokescreen-Active-defense-blog-post-scaled.webp 900w,\n/static/4cdd14b89e9545a1913f042df0c033ec/35cfd/Smokescreen-Active-defense-blog-post-scaled.webp 1700w","sizes":"(max-width: 450px) 100vw, 450px"}}}},"author":{"id":"765e8417-7ed6-55b7-95a7-1d561141e760","name":"Sudarshan Pisupati"}}},{"node":{"id":"34bde990-0a83-5088-90fc-ec45aea87b8a","title":"The curious case of “How many decoys do I need?”","content":"\r\nMany an old sparring session has been witnessed on this subject here at Smokescreen. Buckle up, this is going to be a long read.
\r\n\r\n\r\n\r\nWhen someone asks “How many decoys do I need?”, what they’re really asking is how many decoys do I need to make sure that I can catch the adversary.
\r\n\r\n\r\n\r\nDeception has toed the industry line on this question. It seems natural to want comprehensive coverage. After all, you wouldn’t buy antivirus licenses for just 20% of your organisation. The technology, too, has been able to keep pace – you can literally place deception in every part of your environment. Notice I said, “you can”. Just because you can, doesn’t mean you should.
\r\n\r\n\r\n\r\nThat deception everywhere thinking might have made sense five years ago when deception technology was just hitting the market but does it hold today? To answer that, we’re going to dive into our experience of 80+ deception deployments to see if there’s a case to be made to rethink how we size, scope, and deploy deception in the enterprise.
\r\n\r\n\r\n\r\nWe’re dropping our vendor hat and will analyse this problem from the perspective of the entity we hope to thwart using deception – the attacker / adversary.
\r\n\r\n\r\n\r\nColloquially, the APT. This is either an organised crime group or a nation-state grade attacker. They are targeted in their approach. They want something valuable you have – intel, a database, a transaction processing system, a formula, intellectual property, confidential non-public information, access to your CEOs email, etc. They will deploy specialised, customised malware, infrastructure, and tooling to achieve these means. They spend time understanding you and focus heavily on avoiding detection. If they do get detected, they count on the fact that you won’t do anything about it until they are already gone.
\r\n\r\n\r\n\r\nDefinition of a decoy: Any fake machine, file, credential, account or lure placed in the network.
\r\n\r\n\r\n\r\nLet’s assume that you do not have the ability to do the following in your network:
\r\n\r\n\r\n\r\nLet’s also assume that the initial entry point and the subnet on which the entry point machine resides has no deception whatsoever. It means, you are running blind at the point of first infection.
\r\n\r\n\r\n\r\nWith these constraints, what does an effective deception deployment look like, so you can detect the adversary?
\r\n\r\n\r\n\r\nLet’s say the crown jewel here is the production customer database.
\r\n\r\n\r\n\r\nFor an adversary to be able to access the database (actually, any database), they will need:
\r\n\r\n\r\n\r\nLet’s run a couple of scenarios to see how this plays out.
\r\n\r\n\r\n\r\nDoes deception help in this scenario? The answer is no. In fact, you could cast reasonable doubt on whether any security product will be able to stop this.
\r\n\r\n\r\n\r\nIn such a scenario, the database server reconnaissance has already happened. The adversary will know exactly which set of account credentials are required to login to the server.
\r\n\r\n\r\n\r\nThis scenario throws an interesting question. Where can one find the credentials? What are the options available?
\r\n\r\n\r\n\r\nUnmanaged accounts like in #1 & #2 should be hardened, especially since we are talking about a business-critical system. #5 is also a hard sell in this scenario.
\r\n\r\n\r\n\r\nHow many decoys do you need?
\r\n\r\n\r\n\r\nSo, if you have 10 OS administrators and 10 DB administrators, you’ll need 2 fake AD accounts + 1 network decoy hosting a file share + 20 endpoint decoys.
\r\n\r\n\r\n\r\nHow do you find the hostname or IP address of a database server?
\r\n\r\n\r\n\r\nConsidering the above, the following are the four deception possibilities:
\r\n\r\n\r\n\r\nHow many decoys do you need?
\r\n\r\n\r\n\r\nA couple of Active Directory entries for databases + A network decoy hosting a file share + 2 network decoys hosting decoy databases + the deception in Scenario 2.
\r\n\r\n\r\n\r\nAll in all, at this point, you’ll add around 5 additional decoys.
\r\n\r\n\r\n\r\nHow many Network Decoys do I need?
\r\n\r\n\r\n\r\nNetwork decoys require special consideration as they are the hottest topic of debate because the process of deploying them requires VLAN trunking. The questions are:
\r\n\r\n\r\n\r\nIn our proposed strategy, it is possible for you to avoid trunking entirely. Just add a file share in the same subnet as your real file share. Place a database decoy preceding and succeeding the IP address of the actual database server.
\r\n\r\n\r\n\r\nIf we consider only the “production” version in our database server scenario, we need a total of 3 network decoys (a decoy file share and two fake database servers) to achieve a reasonable strategy that covers the most likely outcomes.
\r\n\r\n\r\n\r\nIf it makes you feel comfortable, you can double this up and it’s still only 6 network decoys.
\r\n\r\n\r\n\r\nIf you want to cover your test and UAT environments for the database server, that’s 9 network decoys.
\r\n\r\n\r\n\r\nIf you want to cover an additional scenario, that’s 18 network decoys.
\r\n\r\n\r\n\r\nThere is a cogent case to be made here that it is certainly not necessary to deploy decoys everywhere and yo’ll still achieve effectiveness. Our example scenario needed no more than 6 network decoys, a couple of fake accounts, fake computer entries in Active Directory, and endpoint deception deployed to a very targeted group.
\r\n\r\n\r\n\r\nWith a focused deployment, you will understand exactly what tactics you are attempting to cover with deception and you can sleep well knowing you have achieved that outcome. If you find yourself attempting to blanket your network with deception, it is likely you are adopting the spray and pray approach which usually has little value. You’ll be chasing sheep when you have the opportunity to catch the wolves.
\r\n","excerpt":"Decoys can be deployed everywhere in your network – current-gen deception technology makes that possible. There are however no free lunches and pervasive deception might come with a cost. So the question is, should you?\n","slug":"how-many-decoys-do-i-need","date":"2020-07-20T06:03:16.000Z","status":"publish","modified":"2020-09-11T02:19:17.000Z","wordpress_id":18421,"featured_media":{"id":"e924a8d1-d814-5487-8d67-de66a2f7b385","source_url":"https://ss-website-content-prod.s3.ap-south-1.amazonaws.com/wp-content/uploads/2020/07/How-many-decoys-do-I-need.png","alt_text":"decoys","large":{"childImageSharp":{"fluid":{"base64":"data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAABQAAAALCAYAAAB/Ca1DAAAACXBIWXMAAAsTAAALEwEAmpwYAAACy0lEQVQozz2SXUiTURjHz76k1Mxmtc3N6TY1/CzX2pyrJnPNPqAvjUbQNygVCV1FdNFFEF0WZBB0IY2KIjMLiqgEr72wD+3jShPS2YZpTS2d/TrvS/rAw/O+nPP8zv9/niMM1ZtQMmO9F13VRvSVbgxqlVm+AW1JBSK/CFFUit5Vhs5ZisbmRJjsCLNMUwFidT7CaJbVglCB6zehqXCzTNaMag96h2w229DaXWRWuYmeaaOwLoiQ/1p7CTkeN5ad9eTWbiTX68YU8mOJBMj1VCOW1fgQJZXsOdXG2w8DhPfsQwhBhk6nVld5BcnxcZ68eKkCNTYXqzb7KDt7gKLodsw7t1DQ1IAp4sdYV4PQVXmkMi/vP37iXX8/JcUuFbSYWZnL6evrY2FhgdJgg7RlxRQMUHPqII79ETa0HsBaX0eWxUGmzSF7iis4fekySjzu6qKltZVYLIbf7ycnJwenw0Hdlq2k0/Pcvv8AscJIWTDM/mMt2N21hJuj7D58jH3HT1Ls9SNWejfzLT4Of/8SCoXoktDe3l56enro7u7mZns7RouVh0+fqYcG9jYj8sxkrytHV+BAay1EZ7WjMVmlejmYax0xdWPsUSfLs7NJ/frF1NQUo6OjTMo6m0rhDTdS2biL9Pw88e8J7L4AIisXvd2pAjWWAjTKEBWoAnv/+QvW4DYuXLmqwtPyvuLxON8TCRbSaXYcOSGt5rH7RIu6Pij3H207J5+TXQKL0CpVQlVgYmJCXmpE2rCyxu3j6/Cw2jQyMsLQ0BCzMzMEmg4iLMqbs/H8TQ+Lsf3QYfn+1mJQrCtAqVLc636GpynKkfMXud5xh2QyydzcHClpdUIe9lPa7h8Y4Omr18Q6u3g3OLgEvBW7K4ewGoNi/b9KodzXvAQsxvT0NAlpdXJykrGxMYal4h8/JpbW//z5zczsrPp9QwoQq6TCQteS9X+wd+nDk8Ie7wAAAABJRU5ErkJggg==","aspectRatio":1.9047619047619047,"src":"/static/33b83b27cd195b73256e62ee8a884b72/ee604/How-many-decoys-do-I-need.png","srcSet":"/static/33b83b27cd195b73256e62ee8a884b72/69585/How-many-decoys-do-I-need.png 200w,\n/static/33b83b27cd195b73256e62ee8a884b72/497c6/How-many-decoys-do-I-need.png 400w,\n/static/33b83b27cd195b73256e62ee8a884b72/ee604/How-many-decoys-do-I-need.png 800w,\n/static/33b83b27cd195b73256e62ee8a884b72/f3583/How-many-decoys-do-I-need.png 1200w,\n/static/33b83b27cd195b73256e62ee8a884b72/5707d/How-many-decoys-do-I-need.png 1600w,\n/static/33b83b27cd195b73256e62ee8a884b72/0ef64/How-many-decoys-do-I-need.png 2400w","srcWebp":"/static/33b83b27cd195b73256e62ee8a884b72/58556/How-many-decoys-do-I-need.webp","srcSetWebp":"/static/33b83b27cd195b73256e62ee8a884b72/61e93/How-many-decoys-do-I-need.webp 200w,\n/static/33b83b27cd195b73256e62ee8a884b72/1f5c5/How-many-decoys-do-I-need.webp 400w,\n/static/33b83b27cd195b73256e62ee8a884b72/58556/How-many-decoys-do-I-need.webp 800w,\n/static/33b83b27cd195b73256e62ee8a884b72/99238/How-many-decoys-do-I-need.webp 1200w,\n/static/33b83b27cd195b73256e62ee8a884b72/7c22d/How-many-decoys-do-I-need.webp 1600w,\n/static/33b83b27cd195b73256e62ee8a884b72/f1e40/How-many-decoys-do-I-need.webp 2400w","sizes":"(max-width: 800px) 100vw, 800px"}}},"medium":{"childImageSharp":{"fluid":{"base64":"data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAABQAAAAKCAYAAAC0VX7mAAAACXBIWXMAAAsTAAALEwEAmpwYAAAChklEQVQozz2RS0gUUBSG78yokaWWOs44D2d8p6OOU76LbApxUZj4gGiVitgm0UWrRKimtZaboqcgWcFsohxdREVDbtJFFlLio2wjvlIcc3z0db1qBw73wDn/f///HBGak0+YswCR6UKk56BzHCU0+Qih9lRESgaW46fIKT+LSEgmJCldZhrRJwqIyncR7sgk8piTwwUuDjoy0BhMiH25hYjULC60XsXb58PiyEYIQZhOp952zy3m5+Z2SI0J7M9wkN5URUpdBeYKN/baMqxVp9G7pahYI0IjFcUUnWTyx08G+vrQx8Yoor2sralhOzy3uxBReiKyc8hurCGpupzMukqMp4o4YEkiwpaCiDFITHImbR13FKijs5Pm5mY8Hg82mw273Y7JbKa7p4fllRX0zjzC0xxU1TfhPFNOyblKWTdSeamexDzp9JAUYyot489akF/T0xQWFjI6Okp/fz9+vx+v10tDQwNZRSXqw0fPXkiQnhCpRmtNlOAENPEWhD5e2jWg3X57Xr5Swy3X2ih1u1U9NTXF/Pw8K1KVz+dTwPu9z1Wv9fpNRGQ0WosdnUyt7GklqdZgRrNNuD3U+9pHuKuIu0+6FSgYDDIpSdnaYuDde4TckTDZePtxUPUf9DzF5MpHxJnRmW2S0LpDGCev/GnkKyIjVzatFJ+vZn1tTYHGxsYISIVvPvgx5BWjTUzj4pUW9qLr4WN1hBBpXak07qgUXt8Al9tvcE/uZ2jkC78XFwkEAiwvLzM7O8viwgLfxsf5PjHJ8OcRNjY2FOGwnA2xJaORCpVKZd2KWJf29mJrc5OlpSVmZmbUDicmJpiWx1pdDexO/JX1qqoGh4bRScL/u9wl/QdHt8WNhvW2hQAAAABJRU5ErkJggg==","aspectRatio":1.9152542372881356,"src":"/static/33b83b27cd195b73256e62ee8a884b72/62b1f/How-many-decoys-do-I-need.png","srcSet":"/static/33b83b27cd195b73256e62ee8a884b72/e7519/How-many-decoys-do-I-need.png 113w,\n/static/33b83b27cd195b73256e62ee8a884b72/7e7e9/How-many-decoys-do-I-need.png 225w,\n/static/33b83b27cd195b73256e62ee8a884b72/62b1f/How-many-decoys-do-I-need.png 450w,\n/static/33b83b27cd195b73256e62ee8a884b72/e2e7f/How-many-decoys-do-I-need.png 675w,\n/static/33b83b27cd195b73256e62ee8a884b72/db955/How-many-decoys-do-I-need.png 900w,\n/static/33b83b27cd195b73256e62ee8a884b72/0ef64/How-many-decoys-do-I-need.png 2400w","srcWebp":"/static/33b83b27cd195b73256e62ee8a884b72/b8a88/How-many-decoys-do-I-need.webp","srcSetWebp":"/static/33b83b27cd195b73256e62ee8a884b72/3a3bf/How-many-decoys-do-I-need.webp 113w,\n/static/33b83b27cd195b73256e62ee8a884b72/975bf/How-many-decoys-do-I-need.webp 225w,\n/static/33b83b27cd195b73256e62ee8a884b72/b8a88/How-many-decoys-do-I-need.webp 450w,\n/static/33b83b27cd195b73256e62ee8a884b72/761da/How-many-decoys-do-I-need.webp 675w,\n/static/33b83b27cd195b73256e62ee8a884b72/210c1/How-many-decoys-do-I-need.webp 900w,\n/static/33b83b27cd195b73256e62ee8a884b72/f1e40/How-many-decoys-do-I-need.webp 2400w","sizes":"(max-width: 450px) 100vw, 450px"}}}},"author":{"id":"765e8417-7ed6-55b7-95a7-1d561141e760","name":"Sudarshan Pisupati"}}},{"node":{"id":"ea4f620c-95dd-5361-8f79-ff8b1fa8ff02","title":"7 Ways to Fail At Implementing Deception Technology","content":"Distributed Deception Platforms are a hot topic today. Most CISOs are thinking of implementing deception technology or road-mapping it into their evaluations and budgets. The promises sound great:
\nUnfortunately, due to the unique secretive nature of deception (after all, you may not want people to know about it), there’s precious little information on how a security team can implement deception tecnology successfully and make it useful.
\nIf you’re being pushed to power-up a sleek appliance and kiss your cybersecurity woes goodbye, don’t believe the marketing hype — that’s not going to happen.
\nAfter implementing deception technology campaigns for the better part of a decade, we’ve compiled a list of the 7 deadly sins that will guarantee that your deception investment will disappoint you. Here we go:
\nIt’s quite obvious that for a deception technology deployment to be successful, you need an objective and a strategy. At a minimum, make sure you know what assets you’re trying to protect (they’re not all equal to the hacker). The best deception campaigns are extremely goal-oriented (e.g.: “Catch targeted attacks against my SWIFT servers, especially focused on breaches from third-party networks.”).
\nThe Fix: Make a list of your top 3 nightmare scenarios, and identify the assets (endpoints / servers / people / credentials / network zones) that are a part of those nightmares.
\nThere’s a reason some of the best deception specialists moonlight as threat hunters or red-teamers. Deception is an ‘active defence‘ capability — where deep knowledge of the attacker’s modus operandi is crucial. Knowing the critical paths an attacker will follow will massively boost the effectiveness of your deception capabilities.
\nThe Fix: Have your in-house / external red-team build attack trees to the assets you’ve identified at risk. Train your blue-team on how to think adversarially.
\nOne of the best things about deception technology is that the alerts are low false positive and real-time. That’s great, but when the metaphorical (or literal) phone rings, do you have a plan for how to respond? The attacker is very likely still ‘live and squirming’ on your infrastructure. This leads to interesting new opportunities and questions:
\nThe Fix: Have a specific set of incident response play-books for responding to deception alerts. War-game the scenarios end-to-end, ideally without your DFIR / blue-team being aware. Start basic and build a roadmap to advanced deception use cases.
\nConfident and experienced deception specialists will encourage (even insist) that you test the deception realism in your environment after you implement it. Not only does this validate that the deception is ‘working’ to meet your business objectives, but it will give you useful metrics like time-to-decieve, deception engagement time, coverage, and kill-chain hit ratios.
\nThe Fix: Blind test the strategy underlying your deception technology deployment. See how ‘real’ your simulated adversary believes the decoys are. Did you miss something? This is worth doing regularly.
\nThe best way to increase deception engagement time is to customise the decoys to your environment. There are a number of nifty tricks here (our MirageMaker feature does a lot of this for you), but never underestimate the power of human ingenuity.
\nThe Fix: Find the most devious folks in your infosec team and brainstorm how you can decieve, degrade, deny, disrupt, and dazzle an attacker even better. You want your deception to maximise the economic burden to the attacker in terms of time, effort, and cognitive load.
\nWell planned deception systems unify three perspectives to quickly arrive at the root cause of an incident:
\nWe call this the ‘deception trifecta’, and your entire strategy must be built around it.
\nThe Fix: Study the deception trifecta and determine how weak or strong you are on each side. Improve visibility, collection, and analysis speed for each perspective. Ensure supporting systems can flesh out context when deception systems alert you (e.g. do you have an updated asset inventory?)
\nRemember IDS? DLP? NAC? cough SIEM cough?
\nThe success of cybersecurity technologies is pretty binary: Either they’re well implemented by people who knew how to do it right, or far more often, they’re a mess of false promises and mismatched expectations. If you’re just being sold a box, AMC, and product training, there’s a lot missing. Sure, you might make it work, but the onus should be on the vendor to ensure you operationalise deception capabilities and see success for stuff that matters to you (we do this for every customer, big or small).
\nThe Fix: Talk to your provider to understand the depth of their knowledge on deception technology deployments, adversarial thinking, and most importantly, how they’ll make it all work for you. Get into specifics. Speak to their people. Hint: if their title says ‘Sales’… well… caveat emptor 🙂
\nDeception technology is more than just a new way to detect lateral movement, privilege escalation, ransomware, data-theft or solve any other current cybersecurity woes. It’s a fundamentally different way of thinking about how you defend your organisation, irrespective of shiny boxes (ours or anybody else’s)!
\nAvoid the mistakes above, and your security team will really see the benefits behind the hype. We have customers that now use deception as their ‘concertmaster‘ — the single most important pillar in their security stack, with everything else supporting it.
\nAt Smokescreen, we believe we’ve solved these problems through our technology, support, and experience. If you’d like to learn more about how we think it should be done, get in touch for a chat with our specialists!
\nIf you’re in the process of evaluating deception technology vendors, read our blog post on 10 questions you need to ask them or download our guide that dives deep into capabilities that make for a great deception solution.
\n\n\n\n","excerpt":"Since there’s precious little information on how security teams can make deception implementations successful (some folks like to keep it a secret), there’s plenty that can go wrong. Here are 7 ways to completely botch your deployment of deception technology.\n","slug":"7-deadly-sins-how-to-fail-at-implementing-deception-technology","date":"2017-09-18T14:01:05.000Z","status":"publish","modified":"2020-01-05T09:25:57.000Z","wordpress_id":16912,"featured_media":{"id":"940f3e3f-92f9-56f6-91a1-525330dda41c","source_url":"https://ss-website-content-prod.s3.ap-south-1.amazonaws.com/wp-content/uploads/2017/09/failwin.png","alt_text":"Fail At Deception Technology","large":{"childImageSharp":{"fluid":{"base64":"data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAABQAAAAMCAIAAADtbgqsAAAACXBIWXMAABYlAAAWJQFJUiTwAAABqklEQVQoz41SW0sCURCeWf9E1FMEvUWa1/VumpnXzdveLFN3VZDKCsmgf9BT4ENkQUpBUA/9xObsLrpUD8HHYc4538x85zsD6OL/hZ0gW52BZeziwbrb9lsXtFL8M9k4pBx3yCD7bMlOP4ZSkKuDoEJOxEjaKmSCYiePyQKWj6DWQqGB8axJAFaSNrLmkHWOoOgo65jML/sTL1uDRp/OHQZQ7WNaIAKgN0r1QNLgsAl5iaF6AvU2+mPGE3wY3gOlB5VjdpUTGSpNkLvIJ4CL7lO0UpJOr8bth1lnMl3rXVA5LpFjzT0RzItI5dpD9/3z5XQ+eJytdoeMkCoCF8tQ8kZJap2Puk+vN/P3zbMxNedIOTnE76KgctSqf+2bvNx9fN2+fa4PRoyQFgB9MRIJogZlki1DQWayRQ0DcSZ7y4tUXe0xqUUFCgYoVrrMY2Y1CVB0TtIYZJ1dkB8Lw6l/SaVno9gxOUCG0VucAbD8jB1ASYFqk35r8RNLt91hpI8UOyC2mZeZsnluGxJarRn4NSTm5HgjGEyiJ2wQArYJc9mmzxX8e0LNEjZR32MQjkf1g0MQAAAAAElFTkSuQmCC","aspectRatio":1.680672268907563,"src":"/static/741aacdb6ba2e8df1b88b93b521715a6/ee604/failwin.png","srcSet":"/static/741aacdb6ba2e8df1b88b93b521715a6/69585/failwin.png 200w,\n/static/741aacdb6ba2e8df1b88b93b521715a6/497c6/failwin.png 400w,\n/static/741aacdb6ba2e8df1b88b93b521715a6/ee604/failwin.png 800w,\n/static/741aacdb6ba2e8df1b88b93b521715a6/a8378/failwin.png 1024w","srcWebp":"/static/741aacdb6ba2e8df1b88b93b521715a6/58556/failwin.webp","srcSetWebp":"/static/741aacdb6ba2e8df1b88b93b521715a6/61e93/failwin.webp 200w,\n/static/741aacdb6ba2e8df1b88b93b521715a6/1f5c5/failwin.webp 400w,\n/static/741aacdb6ba2e8df1b88b93b521715a6/58556/failwin.webp 800w,\n/static/741aacdb6ba2e8df1b88b93b521715a6/cc834/failwin.webp 1024w","sizes":"(max-width: 800px) 100vw, 800px"}}},"medium":{"childImageSharp":{"fluid":{"base64":"data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAABQAAAAMCAIAAADtbgqsAAAACXBIWXMAABYlAAAWJQFJUiTwAAABqklEQVQoz41SW0sCURCeWf9E1FMEvUWa1/VumpnXzdveLFN3VZDKCsmgf9BT4ENkQUpBUA/9xObsLrpUD8HHYc4538x85zsD6OL/hZ0gW52BZeziwbrb9lsXtFL8M9k4pBx3yCD7bMlOP4ZSkKuDoEJOxEjaKmSCYiePyQKWj6DWQqGB8axJAFaSNrLmkHWOoOgo65jML/sTL1uDRp/OHQZQ7WNaIAKgN0r1QNLgsAl5iaF6AvU2+mPGE3wY3gOlB5VjdpUTGSpNkLvIJ4CL7lO0UpJOr8bth1lnMl3rXVA5LpFjzT0RzItI5dpD9/3z5XQ+eJytdoeMkCoCF8tQ8kZJap2Puk+vN/P3zbMxNedIOTnE76KgctSqf+2bvNx9fN2+fa4PRoyQFgB9MRIJogZlki1DQWayRQ0DcSZ7y4tUXe0xqUUFCgYoVrrMY2Y1CVB0TtIYZJ1dkB8Lw6l/SaVno9gxOUCG0VucAbD8jB1ASYFqk35r8RNLt91hpI8UOyC2mZeZsnluGxJarRn4NSTm5HgjGEyiJ2wQArYJc9mmzxX8e0LNEjZR32MQjkf1g0MQAAAAAElFTkSuQmCC","aspectRatio":1.6865671641791045,"src":"/static/741aacdb6ba2e8df1b88b93b521715a6/62b1f/failwin.png","srcSet":"/static/741aacdb6ba2e8df1b88b93b521715a6/e7519/failwin.png 113w,\n/static/741aacdb6ba2e8df1b88b93b521715a6/7e7e9/failwin.png 225w,\n/static/741aacdb6ba2e8df1b88b93b521715a6/62b1f/failwin.png 450w,\n/static/741aacdb6ba2e8df1b88b93b521715a6/e2e7f/failwin.png 675w,\n/static/741aacdb6ba2e8df1b88b93b521715a6/db955/failwin.png 900w,\n/static/741aacdb6ba2e8df1b88b93b521715a6/a8378/failwin.png 1024w","srcWebp":"/static/741aacdb6ba2e8df1b88b93b521715a6/b8a88/failwin.webp","srcSetWebp":"/static/741aacdb6ba2e8df1b88b93b521715a6/3a3bf/failwin.webp 113w,\n/static/741aacdb6ba2e8df1b88b93b521715a6/975bf/failwin.webp 225w,\n/static/741aacdb6ba2e8df1b88b93b521715a6/b8a88/failwin.webp 450w,\n/static/741aacdb6ba2e8df1b88b93b521715a6/761da/failwin.webp 675w,\n/static/741aacdb6ba2e8df1b88b93b521715a6/210c1/failwin.webp 900w,\n/static/741aacdb6ba2e8df1b88b93b521715a6/cc834/failwin.webp 1024w","sizes":"(max-width: 450px) 100vw, 450px"}}}},"author":{"id":"9257cd1e-ca7f-578b-a2dd-9c2e74282caf","name":"Smokescreen Team"}}}]},"costSectionImage":{"childImageSharp":{"fluid":{"base64":"data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAABQAAAANCAYAAACpUE5eAAAACXBIWXMAAAsTAAALEwEAmpwYAAADUklEQVQ4yzWSW2gcZRzFzzcze02y273OfWdnZ3dmr9mmSUsiaaJtV+0lNppaGmukTcEHgygWtS8iKAUFRSEvggj6JoJPPha1j74IfREUBC+ICIKgD2K7mfn7n10dOAzfzHy/Od/5H4xGDVzb6aPSaeeyhl2ZdepW2qx5Sd3qirK2JKnWCaHb56HZO9DMZ4Rm3YBm3YRq7kuq8aFQjU8yVv3LGct5F4AEuVyBVCofl8rqT6xfpKr+h6Sa/0iaSUK3SJgOgSVbdUrbLgmjRtBtYiihqk9VqvLa/A7HH/aAQinWCyiWCWV+UeYPVIM3WRFsNxQ1L4TjhTPNzkGx1T3g9QFDxwwdJwx7LFT9LooVgt34Gucv98ELBpbfQ4kfVrS7SaMWJq16lPH8SHJakahPJTfaLD8SthvBqEXsOso5XsTRhBOH9dbneHzXgmyYMfRWDEzxH3Nei3LNNhUGC5T1+wTXJ+EGJPFdbgTEQJIdj7IshaEczRTY7H6KK88VIfKVOT7u95wd5erNcC4IorQXUL6/QIeGiyS1eiS8DkN9Uvgu1RoTKXG2GsdS1SOUVULn8Pt45Z00RKHiMnCc4CHkXT+aZRfJoEf5zgLlh0skMxDsMHYn11sTh1LskqGp+Oj/AwdHb+LWN0qc3ygeiKyaYY6zyrd7UX7+MBXmj9CMP5g44wxJZqjitlj+ZOoZBiZjYEXj7PV7WFi+LhFxcw4Vn50ORL2Xc1vhXKcb5oJeWOwNo1SzG8FpRiJWrRGBh8XZRXIM0u2I2zB1pxp/4djaVcSXUlE/Ev9VRqgWZdwmzbTapLADxL2zG7HiqYYwWLodcnYhqgZLG087aP2G1dEmllaBREV9OuF4d9Kdwbey3/0x3Rv+qjSD36WG/2cq6P2d6Q7HuaMrlPK7pDiNScEli4tu2qRw7txhLrv9Mx58dA3nLgGnYpubO6s4e2kDDz22JU5uXBHrp/dw36mXxfIDr8srJ96SV+7fTyyvf5BcXPlYHix+JnXmv1Da/a+yQf9Ooub+kPL7t3Hm4hE8chkozWUFntwD1jeQeXVf4MbbCl58IyleejOD51+bxe71Ap7Y07B1zcGFXR9bV+ex+dQx3ryGje0Rzm2fwekL2+yuibMX8S+BMBcPGVLWLQAAAABJRU5ErkJggg==","aspectRatio":1.528735632183908,"src":"/static/739e365bb81f8bf83185927701d2793f/651c0/cost-image-2x.png","srcSet":"/static/739e365bb81f8bf83185927701d2793f/e223a/cost-image-2x.png 133w,\n/static/739e365bb81f8bf83185927701d2793f/66882/cost-image-2x.png 265w,\n/static/739e365bb81f8bf83185927701d2793f/651c0/cost-image-2x.png 530w,\n/static/739e365bb81f8bf83185927701d2793f/a384c/cost-image-2x.png 795w,\n/static/739e365bb81f8bf83185927701d2793f/c884a/cost-image-2x.png 1056w","srcWebp":"/static/739e365bb81f8bf83185927701d2793f/46494/cost-image-2x.webp","srcSetWebp":"/static/739e365bb81f8bf83185927701d2793f/a5ef1/cost-image-2x.webp 133w,\n/static/739e365bb81f8bf83185927701d2793f/4dc00/cost-image-2x.webp 265w,\n/static/739e365bb81f8bf83185927701d2793f/46494/cost-image-2x.webp 530w,\n/static/739e365bb81f8bf83185927701d2793f/5b747/cost-image-2x.webp 795w,\n/static/739e365bb81f8bf83185927701d2793f/950f5/cost-image-2x.webp 1056w","sizes":"(max-width: 530px) 100vw, 530px"}}}},"pageContext":{"id":"e7f2f716-139d-5a7e-b47a-a996bcfc50f1","relatedPostsIDs":[18707,18639,18716,18421,16912]}},"staticQueryHashes":["1478079672"]}