{"componentChunkName":"component---src-templates-article-js","path":"/why-deception-matters/","result":{"data":{"wordpressPost":{"title":"Why Deception Matters in Cybersecurity","content":"

A History of Deception

\n

Deception has a centuries-old successful history in military warfare. Military doctrine from Sun Tzu, Genghis Khan, Clausewitz, Machiavelli and Chanakya, all the way through the Second World War has stressed the importance of deceiving the enemy to know their plans and thwart their objectives. Clearly, deception matters.

\n

Military history is rife with examples of crucial victories, won through subterfuge:

\n\n\n\n\n

Information today is the coin of the realm, and as such, using deception and misinformation have never been more topical to modern conflict.

\n

Old Strategies, New Battles

\n

Early in computer security, many attacks were famously thwarted through ingenious deception by the defenders. The most famous examples are Clifford Stoll’s tracking a Russian hacker in the 80’s. The story is told best in his book, The Cuckoo’s Egg

\n

\n

However, as computing evolved and became more complex, this form of active defence was superceded by protective measures — firewalls and antivirus.

\n

Unfortunately, today’s attacks on computer security have shown that protection is both overrated, and impossible to achieve. The largest organisations, from Target Corp. to J.P. Morgan and Sony have been victims of massive hacks, despite
\nhaving every conceivable protection mechanism.

\n

Hackers themselves rely heavily on deception. Social-engineering, or hacking the human, is the number one mechanism used to gain a foothold in the organisation.

\n

\"\"

\n

Why then don’t defenders deploy deception? Up until now it was too hard. Too complex to maintain. That has changed now. Active defence is the future of cyber-security, and organisations that forget the foundational principles of warfare will be on the back-foot in dealing with the most modern form of war.

\n","excerpt":"Deception has a centuries-old successful history in military warfare. Military doctrine from Sun Tzu, Genghis Khan, and Machiavelli, all the way through the Second World War has stressed the importance of deceiving the enemy to know their plans and thwart their objectives.\n","slug":"why-deception-matters","date":"2016-01-10T15:26:16.000Z","modified":"2020-04-20T03:58:10.000Z","status":"publish","featured_media":{"id":"e2ba9fa4-3a90-5b34-8703-e21ac1e41a0d","source_url":"https://ss-website-content-prod.s3.ap-south-1.amazonaws.com/wp-content/uploads/2016/08/Theprocessionofthetrojanhorseintroybygiovannidomenicotiepolo.jpg","alt_text":"Deception matters","large":{"childImageSharp":{"fluid":{"base64":"data:image/jpeg;base64,/9j/2wBDABALDA4MChAODQ4SERATGCgaGBYWGDEjJR0oOjM9PDkzODdASFxOQERXRTc4UG1RV19iZ2hnPk1xeXBkeFxlZ2P/2wBDARESEhgVGC8aGi9jQjhCY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2P/wgARCAASABQDASIAAhEBAxEB/8QAGQABAQADAQAAAAAAAAAAAAAAAAQBAgMF/8QAFgEBAQEAAAAAAAAAAAAAAAAAAQAC/9oADAMBAAIQAxAAAAHebl0zu95yc1EWAf/EABoQAAIDAQEAAAAAAAAAAAAAAAECAAMREiP/2gAIAQEAAQUCR/NS1lvUdsi9FeTLgNUAEAZ//8QAFhEAAwAAAAAAAAAAAAAAAAAAABAR/9oACAEDAQE/ASP/xAAWEQADAAAAAAAAAAAAAAAAAAAAEBH/2gAIAQIBAT8BK//EABwQAAICAgMAAAAAAAAAAAAAAAABAiEQMRESYf/aAAgBAQAGPwJ+I7OuMJRG4lpsVGjR/8QAGhABAQEBAQEBAAAAAAAAAAAAAREAITFhgf/aAAgBAQABPyExp0E77r1R7DTuFVnVxcifMIqpcaAL80QA/NI43//aAAwDAQACAAMAAAAQtCB+/8QAFxEBAAMAAAAAAAAAAAAAAAAAEAERQf/aAAgBAwEBPxCoGn//xAAYEQACAwAAAAAAAAAAAAAAAAAAEQEQQf/aAAgBAgEBPxByMZX/xAAcEAEBAAICAwAAAAAAAAAAAAABEQAhYaFRkcH/2gAIAQEAAT8QbbbxFNPmDZbV9HDl9tOHT3htM9pATcneL6OGibAPeVUgXZifabgLowIKtgDONHjP/9k=","aspectRatio":1.1049723756906078,"src":"/static/581ea041147a2c712100ab856de90452/dcf4f/Theprocessionofthetrojanhorseintroybygiovannidomenicotiepolo.jpg","srcSet":"/static/581ea041147a2c712100ab856de90452/f836f/Theprocessionofthetrojanhorseintroybygiovannidomenicotiepolo.jpg 200w,\n/static/581ea041147a2c712100ab856de90452/2244e/Theprocessionofthetrojanhorseintroybygiovannidomenicotiepolo.jpg 400w,\n/static/581ea041147a2c712100ab856de90452/dcf4f/Theprocessionofthetrojanhorseintroybygiovannidomenicotiepolo.jpg 774w","srcWebp":"/static/581ea041147a2c712100ab856de90452/e9050/Theprocessionofthetrojanhorseintroybygiovannidomenicotiepolo.webp","srcSetWebp":"/static/581ea041147a2c712100ab856de90452/61e93/Theprocessionofthetrojanhorseintroybygiovannidomenicotiepolo.webp 200w,\n/static/581ea041147a2c712100ab856de90452/1f5c5/Theprocessionofthetrojanhorseintroybygiovannidomenicotiepolo.webp 400w,\n/static/581ea041147a2c712100ab856de90452/e9050/Theprocessionofthetrojanhorseintroybygiovannidomenicotiepolo.webp 774w","sizes":"(max-width: 774px) 100vw, 774px"}}},"medium":{"childImageSharp":{"fluid":{"base64":"data:image/jpeg;base64,/9j/2wBDABALDA4MChAODQ4SERATGCgaGBYWGDEjJR0oOjM9PDkzODdASFxOQERXRTc4UG1RV19iZ2hnPk1xeXBkeFxlZ2P/2wBDARESEhgVGC8aGi9jQjhCY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2P/wgARCAASABQDASIAAhEBAxEB/8QAGQABAQADAQAAAAAAAAAAAAAAAAQBAgMF/8QAFgEBAQEAAAAAAAAAAAAAAAAAAQAC/9oADAMBAAIQAxAAAAHebl0zu95yc1EWAf/EABoQAAIDAQEAAAAAAAAAAAAAAAECAAMREiP/2gAIAQEAAQUCR/NS1lvUdsi9FeTLgNUAEAZ//8QAFhEAAwAAAAAAAAAAAAAAAAAAABAR/9oACAEDAQE/ASP/xAAWEQADAAAAAAAAAAAAAAAAAAAAEBH/2gAIAQIBAT8BK//EABwQAAICAgMAAAAAAAAAAAAAAAABAiEQMRESYf/aAAgBAQAGPwJ+I7OuMJRG4lpsVGjR/8QAGhABAQEBAQEBAAAAAAAAAAAAAREAITFhgf/aAAgBAQABPyExp0E77r1R7DTuFVnVxcifMIqpcaAL80QA/NI43//aAAwDAQACAAMAAAAQtCB+/8QAFxEBAAMAAAAAAAAAAAAAAAAAEAERQf/aAAgBAwEBPxCoGn//xAAYEQACAwAAAAAAAAAAAAAAAAAAEQEQQf/aAAgBAgEBPxByMZX/xAAcEAEBAAICAwAAAAAAAAAAAAABEQAhYaFRkcH/2gAIAQEAAT8QbbbxFNPmDZbV9HDl9tOHT3htM9pATcneL6OGibAPeVUgXZifabgLowIKtgDONHjP/9k=","aspectRatio":1.107843137254902,"src":"/static/581ea041147a2c712100ab856de90452/32fd5/Theprocessionofthetrojanhorseintroybygiovannidomenicotiepolo.jpg","srcSet":"/static/581ea041147a2c712100ab856de90452/06e94/Theprocessionofthetrojanhorseintroybygiovannidomenicotiepolo.jpg 113w,\n/static/581ea041147a2c712100ab856de90452/07ab6/Theprocessionofthetrojanhorseintroybygiovannidomenicotiepolo.jpg 225w,\n/static/581ea041147a2c712100ab856de90452/32fd5/Theprocessionofthetrojanhorseintroybygiovannidomenicotiepolo.jpg 450w,\n/static/581ea041147a2c712100ab856de90452/4a838/Theprocessionofthetrojanhorseintroybygiovannidomenicotiepolo.jpg 675w,\n/static/581ea041147a2c712100ab856de90452/dcf4f/Theprocessionofthetrojanhorseintroybygiovannidomenicotiepolo.jpg 774w","srcWebp":"/static/581ea041147a2c712100ab856de90452/b8a88/Theprocessionofthetrojanhorseintroybygiovannidomenicotiepolo.webp","srcSetWebp":"/static/581ea041147a2c712100ab856de90452/3a3bf/Theprocessionofthetrojanhorseintroybygiovannidomenicotiepolo.webp 113w,\n/static/581ea041147a2c712100ab856de90452/975bf/Theprocessionofthetrojanhorseintroybygiovannidomenicotiepolo.webp 225w,\n/static/581ea041147a2c712100ab856de90452/b8a88/Theprocessionofthetrojanhorseintroybygiovannidomenicotiepolo.webp 450w,\n/static/581ea041147a2c712100ab856de90452/761da/Theprocessionofthetrojanhorseintroybygiovannidomenicotiepolo.webp 675w,\n/static/581ea041147a2c712100ab856de90452/e9050/Theprocessionofthetrojanhorseintroybygiovannidomenicotiepolo.webp 774w","sizes":"(max-width: 450px) 100vw, 450px"}}}},"categories":[{"id":"a725b316-af4b-5d16-8453-4b07c65d8fca","slug":"deception","name":"deception"},{"id":"4ad3d811-65ca-5083-8d66-680c86cef053","slug":"history","name":"history"},{"id":"cb312b9c-68d1-53f5-99b1-3127e4bead1c","slug":"philosophy","name":"philosophy"},{"id":"0aaaa4e2-c9fd-5357-95d2-3884b38b33c0","slug":"strategy","name":"strategy"}],"author":{"id":"9257cd1e-ca7f-578b-a2dd-9c2e74282caf","name":"Smokescreen Team"},"yoast_meta":{"yoast_wpseo_twitter_title":"","yoast_wpseo_twitter_description":"","yoast_wpseo_redirect":"","yoast_wpseo_opengraph_title":"","yoast_wpseo_opengraph_description":"","yoast_wpseo_metakeywords":"","yoast_wpseo_metadesc":"Deception has a centuries-old successful history in military warfare. Military doctrine has stressed its importance. Here's why deception matters.","yoast_wpseo_meta_robots_noindex":"","yoast_wpseo_meta_robots_nofollow":"","yoast_wpseo_meta_robots_adv":"","yoast_wpseo_linkdex":"74","yoast_wpseo_focuskw":"Deception matters","yoast_wpseo_canonical":""}},"relatedPosts":{"edges":[{"node":{"id":"58eb6f3c-c8ac-5680-a020-d1cc788cadbb","title":"The pragmatic security leader’s guide to deception technology","content":"\n

Deception technology provides a unique approach to detecting adversary activity in a network. Compared to other detection controls, it’s easier to deploy, gives you greater visibility, and solves your false positives problem.

\n\n\n\n

Let’s cut to the chase, shall we? Of course, I’m going to say this. I work for a company that sells a deception solution. I’m quite sure that if you’ve ever spoken to a deception vendor, you would have heard a similar pitch. If you haven’t talked to one, well, that’s more or less what you’re going to hear in a nutshell.

\n\n\n\n

While what I’ve stated above is accurate, there are nuances to every approach. As they say, when it comes to cybersecurity, there are no silver bullets. I’m writing this post because when you’re evaluating technology or deploying it, you must understand the conditions under which it can be effective. It allows you to be pragmatic and set realistic expectations.

\n\n\n\n

In the next couple of paragraphs, I’m going to delve into nuances of deception technology that often don’t make it to marketing materials.

\n\n\n\n

Visibility, realism, and fingerprinting – The deception trifecta

\n\n\n\n

As with any security control, there are several components that come together to make deception effective. For now, I’m going to focus on the three most important properties that can make or break a deception technology deployment. These are:

\n\n\n\n
  1. Visibility: The deceptive component/decoys must be visible to none but the adversary so that they lead to detection without raising any false positives.
  2. Realism: The deceptive component/decoys should be indistinguishable from your real assets so that malicious actors can’t tell the difference between what’s real and what’s fake.
  3. Fingerprinting: The deceptive component/decoys should not exhibit any property that would reveal their true nature resulting in the adversary not interacting with them.
\n\n\n\n

In an ideal world, every deceptive component should exhibit all three properties in totality. The reality, however, is different.

\n\n\n\n

Some decoys will be visible to folks inside your company but will be a popular target for attackers. Some will have limited realism but will not be fingeprintable. The point is, when you’re deploying deception in a living, breathing network, trade-offs have to be made – sometimes because of internal limitations, and other times because that’s the best strategy.

\n\n\n\n

In my experience, an understanding of these three properties helps in deciding what trade-offs to make and what you can expect. Let’s break them down one by one.

\n\n\n\n

Visibility

\n\n\n\n

Visibility is an important consideration when deploying deceptive components. In organizations, highly visible decoys will lead to false positives and noise. However, the decoys themselves may be the only effective way to detect an adversary. Being aware of different deceptive components and their visibility property can help inform your thinking about what to do. Here’s a handy table.

\n\n\n\n
Component Visibility to regular users
Private Threat Intelligence (Internet-facing decoys) Not visible
Internal network decoys Not visible
Active Directory decoys Not visible
MiTM Deception Not visible
Endpoint Deception – File Decoys * Invisible unless the user chooses the option to show hidden files. 

* The Endpoint deception policy allows file decoys to be hidden to make them invisible to regular users.
Endpoint Deception – Browser Lures * Cookies are invisible to the user.

* Credentials may be viewed if the user browses to the Saved Password page.

* Browser Favorites will be visible to the user.
Endpoint Deception – Session Lures * Network Shares and Windows Credentials are placed in Credential Manager and rarely accessed by regular users and are therefore effectively invisible.

* Session Lures created for software like PuTTY and WinSCP will be visible in the panel of saved sessions.
Endpoint Deception – Privilege Escalation Not visible
Endpoint Deception – Defense Evasion Effectively invisible. Fake Processes are visible in Task Manager but they masquerade as a real process and hide in plain sight.
\n\n\n\n

Fingerprintability

\n\n\n\n

If an adversary can fingerprint your deceptive assets, she will be able to avoid them altogether. That can’t be good, can it? Here are a couple of things to consider when looking at deception solutions to figure out if they’re fingerprintable.

\n\n\n\n

What are the characteristics of the decoys?

\n\n\n\n

For decoys deployed to the network, network characteristics can result in fingerprinting. While it’s relatively easy to fake characteristics like MAC addresses, Hostnames, and IP addresses, NetBIOS names are harder to spoof as they are tied to the machine itself. 

\n\n\n\n

Are they high interaction?

\n\n\n\n

All deception components have a limitation to the extent to which they fool an adversary. However, it’s important to test whether interacting with a deception component gives away large portions of your deployment. If decoys are created using multiple virtual network adapters from a single machine, it is likely that once you login to a decoy and run “ipconfig / ifconfig”, you will be able to figure out all the decoys projected from that host.

\n\n\n\n

Test open-source fingerprinting tools

\n\n\n\n

Open-source fingerprinting tools like HoneypotBuster, attempt to fingerprint deception in active directory and fake credentials in memory. We recommend testing these tools, especially on computer objects in Active Directory as they contain properties that cannot be easily modified in a deception scenario. Also, tools like HoneypotBuster check only the domain from which the tool is run and will not check domains that are trusted in any way. Ensure that you run the tool against the domain where the deception has been configured in Active Directory.

\n\n\n\n

Realism

\n\n\n\n

The realism of a deception component is critical to keeping an attacker engaged. Ideally, the component should be real enough that it allows the adversary to reveal tools, tactics, and techniques that are being used in your environment. It should also provide you with enough telemetry to determine what the next steps should be. 

\n\n\n\n

The overarching goal here is to make the deception component real enough to engage the adversary for long enough so that you can respond to the event. 

\n\n\n\n

Here is some guidance for ensuring that the deception technology components you opt for meet the realism criteria:

\n\n\n\n\n\n\n\n

In summary

\n\n\n\n

When evaluating deception technology, visibility, realism, and fingerprinting should be some of the key components that you should closely look at to figure how the solution will play out in your network.

\n","excerpt":"When evaluating deception technology, look at three key components of the solution to ascertain how effective it will be in your environment – visibility, realism, and fingerprintability.\n","slug":"the-pragmatic-security-leaders-guide-to-deception-technology","date":"2021-02-01T04:04:10.000Z","status":"publish","modified":"2021-02-01T12:39:33.000Z","wordpress_id":18727,"featured_media":{"id":"2a4ed0d8-6b54-5c32-b562-d58644b889bc","source_url":"https://ss-website-content-prod.s3.ap-south-1.amazonaws.com/wp-content/uploads/2021/02/Maze.jpeg","alt_text":"deception technology","large":{"childImageSharp":{"fluid":{"base64":"data:image/jpeg;base64,/9j/2wBDABALDA4MChAODQ4SERATGCgaGBYWGDEjJR0oOjM9PDkzODdASFxOQERXRTc4UG1RV19iZ2hnPk1xeXBkeFxlZ2P/2wBDARESEhgVGC8aGi9jQjhCY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2P/wgARCAANABQDASIAAhEBAxEB/8QAFwABAQEBAAAAAAAAAAAAAAAAAAUCBP/EABYBAQEBAAAAAAAAAAAAAAAAAAABAv/aAAwDAQACEAMQAAAB6EXObaQR/8QAGxAAAgMAAwAAAAAAAAAAAAAAAAMBAhMREjL/2gAIAQEAAQUC1WbLNaC/Kp5O81P/xAAUEQEAAAAAAAAAAAAAAAAAAAAQ/9oACAEDAQE/AT//xAAUEQEAAAAAAAAAAAAAAAAAAAAQ/9oACAECAQE/AT//xAAaEAACAgMAAAAAAAAAAAAAAAAAAQIxEBFR/9oACAEBAAY/ArLxJse+DR//xAAcEAACAgIDAAAAAAAAAAAAAAAAAREhYZExUfH/2gAIAQEAAT8hXkMzRJMN6LW3NDsaj6E0hzDP/9oADAMBAAIAAwAAABAP/wD/xAAVEQEBAAAAAAAAAAAAAAAAAAAAIf/aAAgBAwEBPxBH/8QAFxEBAAMAAAAAAAAAAAAAAAAAAAERIf/aAAgBAgEBPxC5a//EAB0QAAIDAAIDAAAAAAAAAAAAAAERACExUaFBYZH/2gAIAQEAAT8QCDJ0VveITtcW4CWCKPtC86gnxhX31DgsS5l2VfYJIzZGz//Z","aspectRatio":1.5037593984962405,"src":"/static/bb6b3e0811f2e1fac8c855c6c38b11f2/14b42/Maze.jpg","srcSet":"/static/bb6b3e0811f2e1fac8c855c6c38b11f2/f836f/Maze.jpg 200w,\n/static/bb6b3e0811f2e1fac8c855c6c38b11f2/2244e/Maze.jpg 400w,\n/static/bb6b3e0811f2e1fac8c855c6c38b11f2/14b42/Maze.jpg 800w,\n/static/bb6b3e0811f2e1fac8c855c6c38b11f2/47498/Maze.jpg 1200w,\n/static/bb6b3e0811f2e1fac8c855c6c38b11f2/0e329/Maze.jpg 1600w,\n/static/bb6b3e0811f2e1fac8c855c6c38b11f2/42f14/Maze.jpg 1651w","srcWebp":"/static/bb6b3e0811f2e1fac8c855c6c38b11f2/58556/Maze.webp","srcSetWebp":"/static/bb6b3e0811f2e1fac8c855c6c38b11f2/61e93/Maze.webp 200w,\n/static/bb6b3e0811f2e1fac8c855c6c38b11f2/1f5c5/Maze.webp 400w,\n/static/bb6b3e0811f2e1fac8c855c6c38b11f2/58556/Maze.webp 800w,\n/static/bb6b3e0811f2e1fac8c855c6c38b11f2/99238/Maze.webp 1200w,\n/static/bb6b3e0811f2e1fac8c855c6c38b11f2/7c22d/Maze.webp 1600w,\n/static/bb6b3e0811f2e1fac8c855c6c38b11f2/34b00/Maze.webp 1651w","sizes":"(max-width: 800px) 100vw, 800px"}}},"medium":{"childImageSharp":{"fluid":{"base64":"data:image/jpeg;base64,/9j/2wBDABALDA4MChAODQ4SERATGCgaGBYWGDEjJR0oOjM9PDkzODdASFxOQERXRTc4UG1RV19iZ2hnPk1xeXBkeFxlZ2P/2wBDARESEhgVGC8aGi9jQjhCY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2P/wgARCAANABQDASIAAhEBAxEB/8QAFwABAQEBAAAAAAAAAAAAAAAAAAUCBP/EABYBAQEBAAAAAAAAAAAAAAAAAAABAv/aAAwDAQACEAMQAAAB6EXObaQR/8QAGxAAAgMAAwAAAAAAAAAAAAAAAAMBAhMREjL/2gAIAQEAAQUC1WbLNaC/Kp5O81P/xAAUEQEAAAAAAAAAAAAAAAAAAAAQ/9oACAEDAQE/AT//xAAUEQEAAAAAAAAAAAAAAAAAAAAQ/9oACAECAQE/AT//xAAaEAACAgMAAAAAAAAAAAAAAAAAAQIxEBFR/9oACAEBAAY/ArLxJse+DR//xAAcEAACAgIDAAAAAAAAAAAAAAAAAREhYZExUfH/2gAIAQEAAT8hXkMzRJMN6LW3NDsaj6E0hzDP/9oADAMBAAIAAwAAABAP/wD/xAAVEQEBAAAAAAAAAAAAAAAAAAAAIf/aAAgBAwEBPxBH/8QAFxEBAAMAAAAAAAAAAAAAAAAAAAERIf/aAAgBAgEBPxC5a//EAB0QAAIDAAIDAAAAAAAAAAAAAAERACExUaFBYZH/2gAIAQEAAT8QCDJ0VveITtcW4CWCKPtC86gnxhX31DgsS5l2VfYJIzZGz//Z","aspectRatio":1.5066666666666666,"src":"/static/bb6b3e0811f2e1fac8c855c6c38b11f2/32fd5/Maze.jpg","srcSet":"/static/bb6b3e0811f2e1fac8c855c6c38b11f2/06e94/Maze.jpg 113w,\n/static/bb6b3e0811f2e1fac8c855c6c38b11f2/07ab6/Maze.jpg 225w,\n/static/bb6b3e0811f2e1fac8c855c6c38b11f2/32fd5/Maze.jpg 450w,\n/static/bb6b3e0811f2e1fac8c855c6c38b11f2/4a838/Maze.jpg 675w,\n/static/bb6b3e0811f2e1fac8c855c6c38b11f2/9842e/Maze.jpg 900w,\n/static/bb6b3e0811f2e1fac8c855c6c38b11f2/42f14/Maze.jpg 1651w","srcWebp":"/static/bb6b3e0811f2e1fac8c855c6c38b11f2/b8a88/Maze.webp","srcSetWebp":"/static/bb6b3e0811f2e1fac8c855c6c38b11f2/3a3bf/Maze.webp 113w,\n/static/bb6b3e0811f2e1fac8c855c6c38b11f2/975bf/Maze.webp 225w,\n/static/bb6b3e0811f2e1fac8c855c6c38b11f2/b8a88/Maze.webp 450w,\n/static/bb6b3e0811f2e1fac8c855c6c38b11f2/761da/Maze.webp 675w,\n/static/bb6b3e0811f2e1fac8c855c6c38b11f2/210c1/Maze.webp 900w,\n/static/bb6b3e0811f2e1fac8c855c6c38b11f2/34b00/Maze.webp 1651w","sizes":"(max-width: 450px) 100vw, 450px"}}}},"author":{"id":"765e8417-7ed6-55b7-95a7-1d561141e760","name":"Sudarshan Pisupati"}}},{"node":{"id":"e3cd17da-d028-5fad-bd26-31d9b3a4604d","title":"Using deception to shield the insurance sector","content":"\n

Let’s cut to the chase, insurance companies are under siege from cyberattacks. An Accenture report from 2020 shows that attacks on insurers have more than doubled from 240 to 519, on average. Insurers also sit on top of sensitive customer data and are at risk of losing it – 44% exposed more than 500,000 customer records in 2019 compared to 15% for cross-industry peers.

\n\n\n\n

As more people around the world come under the ambit of insurance policies, the risk to insurers continues to grow. In this post, we take a look at some of the key pieces of an insurer’s infrastructure that adversaries target, why they go after it, and how you can use deception to build active defenses that mitigate the risk of these attacks and put you in a better position to detect and contain these threats,

\n\n\n\n

For a moment, step into the shoes of a malicious entity targeting an insurance company. Your goal is to get $$$. What are your best opportunities?

\n\n\n\n

Opportunity #1 – Compromise the database cluster or core application

\n\n\n\n

The database of all policyholders and their policy details, complete with confidential and protected information is perhaps the most valuable asset of an insurer. This would be the holy grail of compromises. Given that a lot of this information is distributed across many systems (some of them legacy), protecting them is a challenge for the sector. 

\n\n\n\n

Adversary Opportunities

\n\n\n\n

Not only would this data sell for a neat sum on the underground market, but it can also be weaponized in numerous ways, including and not limited to: 

\n\n\n\n\n\n\n\n

Adversary Considerations

\n\n\n\n

To achieve this target, adversaries will have to invest time and money into:

\n\n\n\n\n\n\n\n

Adversary Decision Criteria

\n\n\n\n

Cost-benefit analysis reveals Low to medium risk with an extremely high payout. 

\n\n\n\n

Adversary Profiles

\n\n\n\n

Advanced and organized criminal syndicates.

\n\n\n\n

Opportunity #2 – Deploy Ransomware

\n\n\n\n

Insurance companies deal with lots of files. Lots and lots of files. If an adversary succeeds in encrypting as many files as possible, the payout from this activity can be significant. 

\n\n\n\n

Adversary Opportunities

\n\n\n\n\n\n\n\n

Considerations

\n\n\n\n\n\n\n\n

Adversary Profile 

\n\n\n\n

Ransomware operators of any sophistication. 

\n\n\n\n

Opportunity #3 – Attacking public-facing Direct-to-Consumer applications

\n\n\n\n

Insurance companies worldwide are expected to digitize their interactions with consumers. Everything from pre-sales to claims management is expected to be made available to consumers directly in a bid to simplify the consumer experience. This involves the adoption of cloud services, moving previously internal systems to Internet-facing infrastructure, and spinning up even more infrastructure to support business objectives. Adversaries now have a wider attack surface available to them to exploit. 

\n\n\n\n

Adversary Opportunities

\n\n\n\n\n\n\n\n

Adversary Considerations

\n\n\n\n

Mapping external infrastructure is a trivial task and therefore there are minimal considerations for groups adopting this approach. 

\n\n\n\n

Decision Criteria

\n\n\n\n

Low effort with payout equivalent to the criticality of the infrastructure they compromise.

\n\n\n\n

Adversary Profile

\n\n\n\n

Cybercriminals of any sophistication. 

\n\n\n\n

Your Defense Plan in a nutshell

\n\n\n\n\n\n\n\n

Enter Deception

\n\n\n\n

Deception is about tilting the odds of winning in your favor. It’s about making reasonable judgments about what the adversary might go after and presenting that information to them on a platter. Deception is about abstracting defenses to individual attacker techniques with lesser effort and increased cost to the attacker. 

\n\n\n\n

The core principle of deception is the idea that any interaction with a decoy can be viewed as suspicious and warrants immediate action.  

\n\n\n\n

Using deception to beat adversary motivations

\n\n\n\n

Broadly, the plan is to plant decoys across the network, from perimeter to end-point, to deceive the adversary. At a high-level, the following locations will be configured with decoys:

\n\n\n\n
  1. Decoys in the perimeter.
  2. Decoys in the network.
  3. Decoys on the endpoint.
  4. Decoys in Active Directory.
\n\n\n\n

By spreading decoys across the infrastructure, we maximize our chances of detecting adversaries. Remember, we only need to be able to detect the adversary once. 

\n\n\n\n

The following is a break-down of what this might look like in practice. 

\n\n\n\n

Decoy applications at the perimeter

\n\n\n\n\n\n\n\n

Decoy Systems on the network

\n\n\n\n\n\n\n\n

Decoy core application and database users in Active Directory

\n\n\n\n\n\n\n\n

Decoys on the endpoint

\n\n\n\n\n\n\n\n

What’s the alternative?

\n\n\n\n

Let’s say you don’t want to use deception. The alternative is to understand and defend yourself against every attacker technique. As per MITRE ATT&CK, these are over 100 and this does not account for variations in how these attacks might be executed. 

\n\n\n\n

Deception is grounded in addressing the motivations of the adversary and presenting fake information on a platter that adversaries find attractive. It is technique-agnostic and abstracts away the complexity that arises from blocking individual tools, techniques, and behaviors. 

\n\n\n\n

Deception is a form of Active Defense, where security teams take proactive steps to channel the adversary and make their life difficult. It varies from regular defense where you wait for an existing system to generate an alarm and then react.

\n\n\n\n

MITRE new active defense framework, Shield, is being adopted by CISOs around the world and we see this approach being embraced by more and more security teams at insurance companies.

\n","excerpt":"Insurance companies are under siege from cyberattacks. We take a look at some of the key pieces of an insurer’s infrastructure the adversaries target and how you can use deception to build active defenses.\n","slug":"using-deception-to-shield-the-insurance-sector","date":"2021-01-26T12:23:04.000Z","status":"publish","modified":"2021-02-01T03:41:54.000Z","wordpress_id":18716,"featured_media":{"id":"906d7d6e-966b-59f3-9c9d-9b14d27d8746","source_url":"https://ss-website-content-prod.s3.ap-south-1.amazonaws.com/wp-content/uploads/2021/01/Shield-insurance.png","alt_text":"Active defense and deception for insurance","large":{"childImageSharp":{"fluid":{"base64":"data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAABQAAAALCAYAAAB/Ca1DAAAACXBIWXMAAAsTAAALEwEAmpwYAAACeElEQVQozz1Ta28SQRSdNGm1DaTE0oL0IQgFlncBeSwIC8tLHqUsUIRiRYqV2NZEU6OxNtUPxp99nHs/+OFkdmf2njn33LOiO55gPL+AMZnCrQTgC4URjEbx3OOB3+9HKpVCIpH4D13Xkc1m+czr9SISifB7oVBgiJRWgqpXUKjV4QtHEIrHET46ghIMIiiRy+VQKpVQr9dRqVTQarUQCASwurqKjY0NrK2t4eDgAB4pgFaRyBegxJOIpNLIFDW8UHNIS2QlEamj29PpNPL5PMrlMq+0T8UWiwVbW1sIhULw+XysVmjNFhzuQzj9CjSpcvb+EsbpKbKqimKxiEajgWazye2ocq/T6aDf77PSTCbD6mezGZbLJYbDIcTmUwceWZ7AvG3D400L9MYrLK+uYQwGGEicSvLRaATDMJhoMpGej8c4OztDrVbj58Vigel0ypaI4dsZ8tUaXP4Anh16kXlZQNfoo9PtcgEppBapJWq3Wq1yYTKZZC9dLheDOqAz8fXhF+7//MXHL7e4vfvJLauS1LqzA5PJBJvNxhBCYGVlBU6nkwkVRcHu7i4cDgf29vYQDofZb+GNHsEfi6NYb2Dybo75hyVC0RjcnkOeHKmiD6mILiA1pJymrmkax6jdbrM1ZJGIZFTYXW44fQpyZR0TacF4+gZD6dvx8TEbTxExm82IxWK8RyR0EUWKSGlQNJBerwfx6fsP9CWB3mpjIMPdkf6l5YeqBBWRSorGjrSAgk0k5J/VasX6+jrsdjt7R4rpIvH57h7fHn7j4uoGCzndy+sbTKXK0esxR2J/f5+LaDgnJyeshlTF5Q9AK03//Pwc8/mcU/APvBh2nCQ8QXsAAAAASUVORK5CYII=","aspectRatio":1.9047619047619047,"src":"/static/12a9f2eabb7e883c4f03074601938551/ee604/Shield-insurance.png","srcSet":"/static/12a9f2eabb7e883c4f03074601938551/69585/Shield-insurance.png 200w,\n/static/12a9f2eabb7e883c4f03074601938551/497c6/Shield-insurance.png 400w,\n/static/12a9f2eabb7e883c4f03074601938551/ee604/Shield-insurance.png 800w,\n/static/12a9f2eabb7e883c4f03074601938551/f3583/Shield-insurance.png 1200w,\n/static/12a9f2eabb7e883c4f03074601938551/5707d/Shield-insurance.png 1600w,\n/static/12a9f2eabb7e883c4f03074601938551/0ef64/Shield-insurance.png 2400w","srcWebp":"/static/12a9f2eabb7e883c4f03074601938551/58556/Shield-insurance.webp","srcSetWebp":"/static/12a9f2eabb7e883c4f03074601938551/61e93/Shield-insurance.webp 200w,\n/static/12a9f2eabb7e883c4f03074601938551/1f5c5/Shield-insurance.webp 400w,\n/static/12a9f2eabb7e883c4f03074601938551/58556/Shield-insurance.webp 800w,\n/static/12a9f2eabb7e883c4f03074601938551/99238/Shield-insurance.webp 1200w,\n/static/12a9f2eabb7e883c4f03074601938551/7c22d/Shield-insurance.webp 1600w,\n/static/12a9f2eabb7e883c4f03074601938551/f1e40/Shield-insurance.webp 2400w","sizes":"(max-width: 800px) 100vw, 800px"}}},"medium":{"childImageSharp":{"fluid":{"base64":"data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAABQAAAAKCAYAAAC0VX7mAAAACXBIWXMAAAsTAAALEwEAmpwYAAACR0lEQVQozy2S608aURDFrx8LiFjaqOWVKiCPFVjCc3mW54IgKPIuYgFtSU2NNa1pq239y0/vTPrhZncne39z5pwRWqWGcquNQk2HVzlCMKJCCYfh8XoRjUaRzWZRqVRQKpXQaDSQy+VgNBr5GAwGuFwuBAIB7O/v8xGqloVPjUJNaYhpGcQ1DfFUGslUColEAplMBpqslctlFAoFfifI1tYWzGYzDg4OGOTz+biZKDSasLk98IbC0E86uFiuUNUbSKXTrKperzMsJRvQs9vtotVqIZlMMnw8HmO1WqHX63FDsf3GjhfbVhheWmF+9Rr98QTL64/oyIvD4RD9fh+DwQCdTgfT6RSj0Qiz2QzNZhNnZ2cMm8/nqFar3FAMLhfISB/dSgjugIJSrY6u7KZLv+gn6krjhKWvdIFqaane7/fD7Xbz+KSU6vl8HuLu1xMe/jzj5v4bvj8+YfR+Bl8wiM1Nszyb7A8FIISAyWRin+LxOBwOB5xOJwNDoRBbcnh4COH0+fE2EES6WMLk8gMmF3OEZboBCaVQCEAKrVYrbDYbK278V1+r1dBut9lHsoIsENlqnYGeoxAqzWMMJlP0BkOcyIDo4u7uLjY2NmC32/mbQqJAVFVFLBaDruscFIHJZ3H/+BszGcJx7xzTxRKt01Nkcnm8kwnTHhJoZ2cHkUiEV4hgVKMd3Nvb4x2l1EkxBSVuf/zEw99nrO++4tOXW1x/vsFcgs9lugSxWCw8+mKx4LFITbFYxKlsTOleXV1hvV7zRiiKgn/xCVdoxa/hfwAAAABJRU5ErkJggg==","aspectRatio":1.9152542372881356,"src":"/static/12a9f2eabb7e883c4f03074601938551/62b1f/Shield-insurance.png","srcSet":"/static/12a9f2eabb7e883c4f03074601938551/e7519/Shield-insurance.png 113w,\n/static/12a9f2eabb7e883c4f03074601938551/7e7e9/Shield-insurance.png 225w,\n/static/12a9f2eabb7e883c4f03074601938551/62b1f/Shield-insurance.png 450w,\n/static/12a9f2eabb7e883c4f03074601938551/e2e7f/Shield-insurance.png 675w,\n/static/12a9f2eabb7e883c4f03074601938551/db955/Shield-insurance.png 900w,\n/static/12a9f2eabb7e883c4f03074601938551/0ef64/Shield-insurance.png 2400w","srcWebp":"/static/12a9f2eabb7e883c4f03074601938551/b8a88/Shield-insurance.webp","srcSetWebp":"/static/12a9f2eabb7e883c4f03074601938551/3a3bf/Shield-insurance.webp 113w,\n/static/12a9f2eabb7e883c4f03074601938551/975bf/Shield-insurance.webp 225w,\n/static/12a9f2eabb7e883c4f03074601938551/b8a88/Shield-insurance.webp 450w,\n/static/12a9f2eabb7e883c4f03074601938551/761da/Shield-insurance.webp 675w,\n/static/12a9f2eabb7e883c4f03074601938551/210c1/Shield-insurance.webp 900w,\n/static/12a9f2eabb7e883c4f03074601938551/f1e40/Shield-insurance.webp 2400w","sizes":"(max-width: 450px) 100vw, 450px"}}}},"author":{"id":"765e8417-7ed6-55b7-95a7-1d561141e760","name":"Sudarshan Pisupati"}}},{"node":{"id":"e68006e7-ad47-5422-b7f1-7966cba61573","title":"Finding active defense opportunities in a pentest report","content":"\n

Pentest reports tell a story. The story of how the team managed to break into your environment. In my experience, a critical component usually missing from these reports is the rationale behind the choices made by the pentesters who ran the assessment.

\n\n\n\n\n\n\n\n

Asking why allows you to deconstruct choices that real threat actors might make in your environment. Having a sense of those choices will give you some active defense opportunities.

\n\n\n\n

Let me demonstrate this with a little thought experiment. Let’s consider a pentest where the objective was to demonstrate access to the customer database. Here’s what the pentesters broadly did:

\n\n\n\n
  1. Established a C2 using PowerShell.
  2. Enumerated the Active Directory domain for users and groups, specifically privileged groups.
  3. Enumerated the domain to find computers.
  4. Attempted privilege escalation techniques and compromised the domain admin.
  5. Scanned a subset of computers to identify the customer DB.
  6. Used the domain admin account to login to the database server.
  7. Logged into the Customer DB.
\n\n\n\n

In each of these steps, the pentesters made some choices. As you’ll now see, deconstructing these choices can help build better defenses.

\n\n\n\n

Deconstructing the pentest report to find Active Defense plays

\n\n\n\n

The Active Defense matrix was released by MITRE to provide a framework for identifying opportunities where adversary behavior can be influenced to enable defenders to easily spot threats.

\n\n\n\n

The foundation of the Active Defense approach rests on three principles:

\n\n\n\n
  1. Beat the human behind the software
  2. Do simple things the adversary does not anticipate to encourage or complicate their operation.
  3. Make sure the things you do allows the corresponding telemetry to stand out i.e. collect more effective telemetry.
\n\n\n\n

So let’s begin by deconstructing each of the 7 steps in the report to identify Active Defense opportunities

\n\n\n\n

#1 – C2 using PowerShell

\n\n\n\n

Why PowerShell? 

\n\n\n\n
  1. Sophisticated off the shelf tooling
  2. PowerShell logging & blocking not widely implemented
  3. Great obfuscation capabilities
\n\n\n\n

Active Defense Opportunity

\n\n\n\n

Block PowerShell to force the adversary to use non-PowerShell options.

\n\n\n\n

Advantage

\n\n\n\n

Since PowerShell usage for C2 is fairly common, it reduces the risk of being hit with commodity malware that uses PowerShell even today.

\n\n\n\n

MITRE Shield Technique: Security Controls

\n\n\n\n

#2 – Enumerated the domain for users and groups

\n\n\n\n

Why enumerate the users?

\n\n\n\n
  1. Find privileged group members of groups like Domain and Enterprise Admin. Successful compromise of DA / EA will almost certainly result in customer DB access down the line, so it’s important to know who they are.
  2. Run keyword searches across attributes like username, SPN, description, etc. to find accounts that can be used for SQL logins. Example ‘SQL’, ‘DB’, ‘etc’. This will be useful down the line when it’s time to figure out how to login to the database, regardless of whether you have domain admin credentials or not.
\n\n\n\n

Active Defense Opportunity

\n\n\n\n

Setup attractive decoy accounts, assign attractive privileges, and setup attribute level auditing on description, SPN, etc. to monitor enumeration attempts. This has the added advantage of detecting password spraying regardless of intensity and staggering strategies.

\n\n\n\n

Advantage

\n\n\n\n

Gain insight into enumeration activities being conducted against the domain from a user perspective.

\n\n\n\n

(Note: Don’t ever use these accounts for any operations. There are ways to make this opsec safe)

\n\n\n\n

MITRE Shield Technique: Decoy Account

\n\n\n\n

#3 – Enumerated the domain for computers

\n\n\n\n

Why enumerate the computers?

\n\n\n\n
  1. Run keyword searches across attributes like hostname, SPN, description, etc. to find accounts that could be SQL servers. Example ‘SQL’, ‘DB’, ‘etc’. This will be useful down the line when it’s time to figure out where the DB is located.
\n\n\n\n

Active Defense Opportunity

\n\n\n\n

Setup decoy computers, assign attractive hostnames to databases, and setup attribute level auditing on description, SPN, etc. to monitor enumeration attempts.

\n\n\n\n

Advantage

\n\n\n\n

Gain insight into enumeration activities being conducted against the domain from a computer perspective.

\n\n\n\n

MITRE Shield Technique: Decoy System

\n\n\n\n

#4 – Privilege Escalation

\n\n\n\n

Why Privilege Escalation?

\n\n\n\n
  1. Get to a higher level of privilege. In this case, the target privilege level is the database/server administrator on the customer database.
  2. Escalated privileges can allow you admin access to one, few, many, or all systems on the network.
  3. With high privileges, you have the opportunity to log in to more systems and steal credentials.
\n\n\n\n

Let’s assume that Kerberoasting was the privilege escalation technique that worked. In this case, let’s also assume that the service account was a domain admin.

\n\n\n\n

Why Kerberoasting?

\n\n\n\n
  1. It targets service accounts i.e. accounts that have an SPN attribute configured.
  2. Service account passwords never expire.
  3. Sometimes, service accounts are granted DA privileges. At the very least, they have admin privileges somewhere.
  4. Some service accounts are so old that no one remembers they exist and have weak passwords.
  5. It’s really difficult to detect on the wire.
  6. Logs related to service ticket operations are not logged by default. If they are, it is difficult to tell the difference between legitimate and malicious service ticket operations.
\n\n\n\n

Active Defense Opportunity

\n\n\n\n
  1. Setup a decoy kerberoastable account, assign attractive usernames to databases (e.g. SQLAdmin), add a SQL-related SPN (e.g. MSSQLSvc/custdb.domain.com), and write a rule to capture Event ID 4769 for the decoy account.
  2. Remove the real domain admin service account from being kerberoastable or downgrade its privileges.
\n\n\n\n

Advantage

\n\n\n\n

Makes the adversary believe they have obtained hashes to the customer database SQL service account while at the same time removing the risk of kerberoasting a real domain admin account.

\n\n\n\n

A similar approach can be used for other popular privilege escalation techniques.

\n\n\n\n
  1. Tomcat Manager exploit – Plan a decoy system with Tomcat manager and monitor for connections and interactions towards this system.
  2. LLMNR poisoning – Use a tool like Conveigh to send decoy broadcasts over the subnet and monitor for responses to these broadcasts.
  3. Credential Dumping – Use Invoke-runas to plant fake domain admin credentials in memory using the /netonly technique.
\n\n\n\n

There are many techniques available for privilege escalation, and some of them lend themselves well to an Active Defense approach. However, in cases where that doesn’t work, focus on what the adversary intends to accomplish with those privileged credentials.

\n\n\n\n

MITRE Shield Technique: Decoy Account, Decoy System, Security Controls

\n\n\n\n

#5 – Scanned a subset of computers to identify the customer DB

\n\n\n\n

Why Scan?

\n\n\n\n
  1. Check if the database server is reachable from the target list compiled in #3.
  2. Check if the database port is open.
  3. Check if any banners reveal which might be the customer database.
  4. Check for default passwords on SQL servers for the ‘sa’ account.
\n\n\n\n

Active Defense Opportunities

\n\n\n\n
  1. Plant a decoy SQL server on the network. Alert when you see port enumeration.
  2. Make the real customer database accessible only from certain machines.
\n\n\n\n

Advantage

\n\n\n\n

Even a single port query against the decoy SQL server system is worth investigating while complicating access to the real customer database.

\n\n\n\n

MITRE Shield Technique: Network Diversity, Decoy Diversity, Network Manipulation

\n\n\n\n

#6 – Used the domain admin account to login to the customer database server

\n\n\n\n

Why log in to the customer database server?

\n\n\n\n
  1. With domain admin privileges, you can extract credentials from memory from the customer database.
  2. Helps you compromise the logged-on SQL administrator account (whether it’s a user or service doesn’t matter).
\n\n\n\n

Active Defense Opportunities

\n\n\n\n
  1. Implement a standard operating procedure to prevent a domain admin from ever logging into the database server. Implement the corresponding rule for this server alone in your SIEM.
  2. Plant decoy SQL administrator credentials in memory.
\n\n\n\n

Advantage

\n\n\n\n

Even a single port query against the decoy SQL server system is worth investigating while complicating access to the real customer database

\n\n\n\n

MITRE Shield Technique: Standard Operating Procedure, Decoy Credentials

\n\n\n\n

#7 – Login to the database itself

\n\n\n\n

Unfortunately, if the adversary has reached this point, detection difficulty increases. This is because, from an analytics perspective, you are looking for a legitimate account, logging into a legitimate database, and running possibly legitimate queries. However, there are still things we can do.

\n\n\n\n

Active Defense Opportunities

\n\n\n\n
  1. Setup query auditing on the SQL server for accounts with DB admin rights.
  2. Hunt for non-standard queries in the hope of spotting the adversary running ‘select *’ operations and join operations to fully extract the customer database.
\n\n\n\n

MITRE Shield Technique: Hunting, System Activity Monitoring

\n\n\n\n

Apply Active Defense Approach to any use case

\n\n\n\n

I present an abstracted approach to applying Active Defense use cases. It has 4 pieces:

\n\n\n\n
  1. Deceive – Can I do something to trick the adversary en route to/on the system?
  2. Standardize – Can I define how a particular system must be used/controlled?
  3. Analyze – Can I bubble-up anomalies against the system I am protecting?
  4. Control – Can I make it more difficult to reach and compromise the system?
\n\n\n\n

You can use the above as a combination to assess a use case beyond just analyzing pentest reports. The pentest report was just a means for me to present my idea.

\n\n\n\n

Closing Notes

\n\n\n\n

I would like you to note a few things.

\n\n\n\n
  1. Use of the Active Defense approach covers the kill-chain and encourages you to think about the ‘why’ to build better defenses and how your network, endpoints, and active directory are all interconnected.
  2. It reduces complexity otherwise introduced by large scale data analytics across GBs of logs a day.
  3. The active defense approach is not limited to decoys alone, but it is a significant component.
  4. You don’t have to baseline and standardize operating procedures across everything. Just the stuff that matters to you.
  5. You can tighten your hunt use cases with Active Defense, making hunting a lot more productive.
  6. You can take a targeted approach to apply controls, rather than spray controls all over the network that costs time and requires effort.
\n","excerpt":"Pentest reports tell a story. By asking why a pentester made certain choices, you can find opportunities to influence attacker behavior and actively defend your network.\n","slug":"finding-active-defense-opportunities-in-a-pentest-report","date":"2021-01-24T16:36:47.000Z","status":"publish","modified":"2021-02-01T04:52:23.000Z","wordpress_id":18707,"featured_media":{"id":"c2327fb5-d82c-5803-a242-8195b7731a09","source_url":"https://ss-website-content-prod.s3.ap-south-1.amazonaws.com/wp-content/uploads/2021/01/Finding-active-defense-opportunities.jpeg","alt_text":"active defense opportunities","large":{"childImageSharp":{"fluid":{"base64":"data:image/jpeg;base64,/9j/2wBDABALDA4MChAODQ4SERATGCgaGBYWGDEjJR0oOjM9PDkzODdASFxOQERXRTc4UG1RV19iZ2hnPk1xeXBkeFxlZ2P/2wBDARESEhgVGC8aGi9jQjhCY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2P/wgARCAANABQDASIAAhEBAxEB/8QAGAAAAgMAAAAAAAAAAAAAAAAAAAMBAgX/xAAUAQEAAAAAAAAAAAAAAAAAAAAB/9oADAMBAAIQAxAAAAHBIYiiwP8A/8QAGBABAQEBAQAAAAAAAAAAAAAAAQIAEBH/2gAIAQEAAQUCzKdm2cvr/8QAFBEBAAAAAAAAAAAAAAAAAAAAEP/aAAgBAwEBPwE//8QAFBEBAAAAAAAAAAAAAAAAAAAAEP/aAAgBAgEBPwE//8QAGBAAAgMAAAAAAAAAAAAAAAAAAAERICH/2gAIAQEABj8Crig//8QAHBABAAEEAwAAAAAAAAAAAAAAAQARITFREEFh/9oACAEBAAE/IQHyAVpbfODudjiEqA0T/9oADAMBAAIAAwAAABB8D//EABQRAQAAAAAAAAAAAAAAAAAAABD/2gAIAQMBAT8QP//EABcRAAMBAAAAAAAAAAAAAAAAAAEQEUH/2gAIAQIBAT8QE1f/xAAbEAEAAgIDAAAAAAAAAAAAAAABABExcRBBkf/aAAgBAQABPxBml2gBK+Bh5vBi4drZGyruUPZ//9k=","aspectRatio":1.5037593984962405,"src":"/static/7db01658f4566de6549893fda89ba90f/14b42/Finding-active-defense-opportunities.jpg","srcSet":"/static/7db01658f4566de6549893fda89ba90f/f836f/Finding-active-defense-opportunities.jpg 200w,\n/static/7db01658f4566de6549893fda89ba90f/2244e/Finding-active-defense-opportunities.jpg 400w,\n/static/7db01658f4566de6549893fda89ba90f/14b42/Finding-active-defense-opportunities.jpg 800w,\n/static/7db01658f4566de6549893fda89ba90f/47498/Finding-active-defense-opportunities.jpg 1200w,\n/static/7db01658f4566de6549893fda89ba90f/0e329/Finding-active-defense-opportunities.jpg 1600w,\n/static/7db01658f4566de6549893fda89ba90f/eeda9/Finding-active-defense-opportunities.jpg 1650w","srcWebp":"/static/7db01658f4566de6549893fda89ba90f/58556/Finding-active-defense-opportunities.webp","srcSetWebp":"/static/7db01658f4566de6549893fda89ba90f/61e93/Finding-active-defense-opportunities.webp 200w,\n/static/7db01658f4566de6549893fda89ba90f/1f5c5/Finding-active-defense-opportunities.webp 400w,\n/static/7db01658f4566de6549893fda89ba90f/58556/Finding-active-defense-opportunities.webp 800w,\n/static/7db01658f4566de6549893fda89ba90f/99238/Finding-active-defense-opportunities.webp 1200w,\n/static/7db01658f4566de6549893fda89ba90f/7c22d/Finding-active-defense-opportunities.webp 1600w,\n/static/7db01658f4566de6549893fda89ba90f/36d36/Finding-active-defense-opportunities.webp 1650w","sizes":"(max-width: 800px) 100vw, 800px"}}},"medium":{"childImageSharp":{"fluid":{"base64":"data:image/jpeg;base64,/9j/2wBDABALDA4MChAODQ4SERATGCgaGBYWGDEjJR0oOjM9PDkzODdASFxOQERXRTc4UG1RV19iZ2hnPk1xeXBkeFxlZ2P/2wBDARESEhgVGC8aGi9jQjhCY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2P/wgARCAANABQDASIAAhEBAxEB/8QAGAAAAgMAAAAAAAAAAAAAAAAAAAMBAgX/xAAUAQEAAAAAAAAAAAAAAAAAAAAB/9oADAMBAAIQAxAAAAHBIYiiwP8A/8QAGBABAQEBAQAAAAAAAAAAAAAAAQIAEBH/2gAIAQEAAQUCzKdm2cvr/8QAFBEBAAAAAAAAAAAAAAAAAAAAEP/aAAgBAwEBPwE//8QAFBEBAAAAAAAAAAAAAAAAAAAAEP/aAAgBAgEBPwE//8QAGBAAAgMAAAAAAAAAAAAAAAAAAAERICH/2gAIAQEABj8Crig//8QAHBABAAEEAwAAAAAAAAAAAAAAAQARITFREEFh/9oACAEBAAE/IQHyAVpbfODudjiEqA0T/9oADAMBAAIAAwAAABB8D//EABQRAQAAAAAAAAAAAAAAAAAAABD/2gAIAQMBAT8QP//EABcRAAMBAAAAAAAAAAAAAAAAAAEQEUH/2gAIAQIBAT8QE1f/xAAbEAEAAgIDAAAAAAAAAAAAAAABABExcRBBkf/aAAgBAQABPxBml2gBK+Bh5vBi4drZGyruUPZ//9k=","aspectRatio":1.5066666666666666,"src":"/static/7db01658f4566de6549893fda89ba90f/32fd5/Finding-active-defense-opportunities.jpg","srcSet":"/static/7db01658f4566de6549893fda89ba90f/06e94/Finding-active-defense-opportunities.jpg 113w,\n/static/7db01658f4566de6549893fda89ba90f/07ab6/Finding-active-defense-opportunities.jpg 225w,\n/static/7db01658f4566de6549893fda89ba90f/32fd5/Finding-active-defense-opportunities.jpg 450w,\n/static/7db01658f4566de6549893fda89ba90f/4a838/Finding-active-defense-opportunities.jpg 675w,\n/static/7db01658f4566de6549893fda89ba90f/9842e/Finding-active-defense-opportunities.jpg 900w,\n/static/7db01658f4566de6549893fda89ba90f/eeda9/Finding-active-defense-opportunities.jpg 1650w","srcWebp":"/static/7db01658f4566de6549893fda89ba90f/b8a88/Finding-active-defense-opportunities.webp","srcSetWebp":"/static/7db01658f4566de6549893fda89ba90f/3a3bf/Finding-active-defense-opportunities.webp 113w,\n/static/7db01658f4566de6549893fda89ba90f/975bf/Finding-active-defense-opportunities.webp 225w,\n/static/7db01658f4566de6549893fda89ba90f/b8a88/Finding-active-defense-opportunities.webp 450w,\n/static/7db01658f4566de6549893fda89ba90f/761da/Finding-active-defense-opportunities.webp 675w,\n/static/7db01658f4566de6549893fda89ba90f/210c1/Finding-active-defense-opportunities.webp 900w,\n/static/7db01658f4566de6549893fda89ba90f/36d36/Finding-active-defense-opportunities.webp 1650w","sizes":"(max-width: 450px) 100vw, 450px"}}}},"author":{"id":"765e8417-7ed6-55b7-95a7-1d561141e760","name":"Sudarshan Pisupati"}}},{"node":{"id":"ea4f620c-95dd-5361-8f79-ff8b1fa8ff02","title":"7 Ways to Fail At Implementing Deception Technology","content":"

Distributed Deception Platforms are a hot topic today. Most CISOs are thinking of implementing deception technology or road-mapping it into their evaluations and budgets. The promises sound great:

\n\n

Unfortunately, due to the unique secretive nature of deception (after all, you may not want people to know about it), there’s precious little information on how a security team can implement deception tecnology successfully and make it useful.

\n

If you’re being pushed to power-up a sleek appliance and kiss your cybersecurity woes goodbye, don’t believe the marketing hype — that’s not going to happen.

\n

After implementing deception technology campaigns for the better part of a decade, we’ve compiled a list of the 7 deadly sins that will guarantee that your deception investment will disappoint you. Here we go:

\n

1. You’re Not Sure What You’re Protecting

\n

It’s quite obvious that for a deception technology deployment to be successful, you need an objective and a strategy. At a minimum, make sure you know what assets you’re trying to protect (they’re not all equal to the hacker). The best deception campaigns are extremely goal-oriented (e.g.: “Catch targeted attacks against my SWIFT servers, especially focused on breaches from third-party networks.”).

\n

The Fix: Make a list of your top 3 nightmare scenarios, and identify the assets (endpoints / servers / people / credentials / network zones) that are a part of those nightmares.

\n

 

\n

2. You Don’t Know Your Enemy

\n

There’s a reason some of the best deception specialists moonlight as threat hunters or red-teamers. Deception is an ‘active defence‘ capability — where deep knowledge of the attacker’s modus operandi is crucial. Knowing the critical paths an attacker will follow will massively boost the effectiveness of your deception capabilities.

\n

The Fix: Have your in-house / external red-team build attack trees to the assets you’ve identified at risk. Train your blue-team on how to think adversarially.

\n

 

\n

3. You’re Not Prepared for Deception Alerts

\n

One of the best things about deception technology is that the alerts are low false positive and real-time. That’s great, but when the metaphorical (or literal) phone rings, do you have a plan for how to respond? The attacker is very likely still ‘live and squirming’ on your infrastructure. This leads to interesting new opportunities and questions:

\n\n

The Fix: Have a specific set of incident response play-books for responding to deception alerts. War-game the scenarios end-to-end, ideally without your DFIR / blue-team being aware. Start basic and build a roadmap to advanced deception use cases.

\n

 

\n

4. You Haven’t Tested Your Deception Strategy

\n

Confident and experienced deception specialists will encourage (even insist) that you test the deception realism in your environment after you implement it. Not only does this validate that the deception is ‘working’ to meet your business objectives, but it will give you useful metrics like time-to-decieve, deception engagement time, coverage, and kill-chain hit ratios.

\n

The Fix: Blind test the strategy underlying your deception technology deployment. See how ‘real’ your simulated adversary believes the decoys are. Did you miss something? This is worth doing regularly.

\n

 

\n

5. Your Deception is Not Customised

\n

The best way to increase deception engagement time is to customise the decoys to your environment. There are a number of nifty tricks here (our MirageMaker feature does a lot of this for you), but never underestimate the power of human ingenuity.

\n

The Fix: Find the most devious folks in your infosec team and brainstorm how you can decieve, degrade, deny, disrupt, and dazzle an attacker even better. You want your deception to maximise the economic burden to the attacker in terms of time, effort, and cognitive load.

\n

 

\n

6. You Don’t Know the ‘Deception Trifecta’

\n

Well planned deception systems unify three perspectives to quickly arrive at the root cause of an incident:

\n
    \n
  1. What is happening? (decoy telemetry)
    2. \n
  2. How is it happening? (endpoint forensics)
    3. \n
  3. Where else is it happening? (estate integrations / correlation)
    4. \n
\n

We call this the ‘deception trifecta’, and your entire strategy must be built around it.

\n

The Fix: Study the deception trifecta and determine how weak or strong you are on each side. Improve visibility, collection, and analysis speed for each perspective. Ensure supporting systems can flesh out context when deception systems alert you (e.g. do you have an updated asset inventory?)

\n

 

\n

7. Your Deception Provider Doesn’t ‘Get’ Strategy

\n

Remember IDS? DLP? NAC? cough SIEM cough?

\n

The success of cybersecurity technologies is pretty binary: Either they’re well implemented by people who knew how to do it right, or far more often, they’re a mess of false promises and mismatched expectations. If you’re just being sold a box, AMC, and product training, there’s a lot missing. Sure, you might make it work, but the onus should be on the vendor to ensure you operationalise deception capabilities and see success for stuff that matters to you (we do this for every customer, big or small).

\n

The Fix: Talk to your provider to understand the depth of their knowledge on deception technology deployments, adversarial thinking, and most importantly, how they’ll make it all work for you. Get into specifics. Speak to their people. Hint: if their title says ‘Sales’… well… caveat emptor 🙂

\n

 

\n

In Summary – How To Get It Right

\n
\n
    \n
  1. Identify what will hurt you, and where those assets reside
    2. \n
  2. Know how your enemy will likely traverse your environment
    3. \n
  3. Create a tactical plan for handling deception alerts
    4. \n
  4. Blind test your deception strategy regularly
    5. \n
  5. Customise your deception environment ‘by hand’
    6. \n
  6. Know the ‘Deception Trifecta’ and improve how you use it
    7. \n
  7. Choose a provider who will build a capability, not sell a box
    8. \n
\n

Deception technology is more than just a new way to detect lateral movement, privilege escalation, ransomware, data-theft or solve any other current cybersecurity woes. It’s a fundamentally different way of thinking about how you defend your organisation, irrespective of shiny boxes (ours or anybody else’s)!

\n

Avoid the mistakes above, and your security team will really see the benefits behind the hype. We have customers that now use deception as their ‘concertmaster‘ — the single most important pillar in their security stack, with everything else supporting it.

\n

At Smokescreen, we believe we’ve solved these problems through our technology, support, and experience. If you’d like to learn more about how we think it should be done, get in touch for a chat with our specialists!

\n

If you’re in the process of evaluating deception technology vendors, read our blog post on 10 questions you need to ask them or download our guide that dives deep into capabilities that make for a great deception solution.

\n\n\n

\n","excerpt":"Since there’s precious little information on how security teams can make deception implementations successful (some folks like to keep it a secret), there’s plenty that can go wrong. Here are 7 ways to completely botch your deployment of deception technology.\n","slug":"7-deadly-sins-how-to-fail-at-implementing-deception-technology","date":"2017-09-18T14:01:05.000Z","status":"publish","modified":"2020-01-05T09:25:57.000Z","wordpress_id":16912,"featured_media":{"id":"940f3e3f-92f9-56f6-91a1-525330dda41c","source_url":"https://ss-website-content-prod.s3.ap-south-1.amazonaws.com/wp-content/uploads/2017/09/failwin.png","alt_text":"Fail At Deception Technology","large":{"childImageSharp":{"fluid":{"base64":"data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAABQAAAAMCAIAAADtbgqsAAAACXBIWXMAABYlAAAWJQFJUiTwAAABqklEQVQoz41SW0sCURCeWf9E1FMEvUWa1/VumpnXzdveLFN3VZDKCsmgf9BT4ENkQUpBUA/9xObsLrpUD8HHYc4538x85zsD6OL/hZ0gW52BZeziwbrb9lsXtFL8M9k4pBx3yCD7bMlOP4ZSkKuDoEJOxEjaKmSCYiePyQKWj6DWQqGB8axJAFaSNrLmkHWOoOgo65jML/sTL1uDRp/OHQZQ7WNaIAKgN0r1QNLgsAl5iaF6AvU2+mPGE3wY3gOlB5VjdpUTGSpNkLvIJ4CL7lO0UpJOr8bth1lnMl3rXVA5LpFjzT0RzItI5dpD9/3z5XQ+eJytdoeMkCoCF8tQ8kZJap2Puk+vN/P3zbMxNedIOTnE76KgctSqf+2bvNx9fN2+fa4PRoyQFgB9MRIJogZlki1DQWayRQ0DcSZ7y4tUXe0xqUUFCgYoVrrMY2Y1CVB0TtIYZJ1dkB8Lw6l/SaVno9gxOUCG0VucAbD8jB1ASYFqk35r8RNLt91hpI8UOyC2mZeZsnluGxJarRn4NSTm5HgjGEyiJ2wQArYJc9mmzxX8e0LNEjZR32MQjkf1g0MQAAAAAElFTkSuQmCC","aspectRatio":1.680672268907563,"src":"/static/741aacdb6ba2e8df1b88b93b521715a6/ee604/failwin.png","srcSet":"/static/741aacdb6ba2e8df1b88b93b521715a6/69585/failwin.png 200w,\n/static/741aacdb6ba2e8df1b88b93b521715a6/497c6/failwin.png 400w,\n/static/741aacdb6ba2e8df1b88b93b521715a6/ee604/failwin.png 800w,\n/static/741aacdb6ba2e8df1b88b93b521715a6/a8378/failwin.png 1024w","srcWebp":"/static/741aacdb6ba2e8df1b88b93b521715a6/58556/failwin.webp","srcSetWebp":"/static/741aacdb6ba2e8df1b88b93b521715a6/61e93/failwin.webp 200w,\n/static/741aacdb6ba2e8df1b88b93b521715a6/1f5c5/failwin.webp 400w,\n/static/741aacdb6ba2e8df1b88b93b521715a6/58556/failwin.webp 800w,\n/static/741aacdb6ba2e8df1b88b93b521715a6/cc834/failwin.webp 1024w","sizes":"(max-width: 800px) 100vw, 800px"}}},"medium":{"childImageSharp":{"fluid":{"base64":"data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAABQAAAAMCAIAAADtbgqsAAAACXBIWXMAABYlAAAWJQFJUiTwAAABqklEQVQoz41SW0sCURCeWf9E1FMEvUWa1/VumpnXzdveLFN3VZDKCsmgf9BT4ENkQUpBUA/9xObsLrpUD8HHYc4538x85zsD6OL/hZ0gW52BZeziwbrb9lsXtFL8M9k4pBx3yCD7bMlOP4ZSkKuDoEJOxEjaKmSCYiePyQKWj6DWQqGB8axJAFaSNrLmkHWOoOgo65jML/sTL1uDRp/OHQZQ7WNaIAKgN0r1QNLgsAl5iaF6AvU2+mPGE3wY3gOlB5VjdpUTGSpNkLvIJ4CL7lO0UpJOr8bth1lnMl3rXVA5LpFjzT0RzItI5dpD9/3z5XQ+eJytdoeMkCoCF8tQ8kZJap2Puk+vN/P3zbMxNedIOTnE76KgctSqf+2bvNx9fN2+fa4PRoyQFgB9MRIJogZlki1DQWayRQ0DcSZ7y4tUXe0xqUUFCgYoVrrMY2Y1CVB0TtIYZJ1dkB8Lw6l/SaVno9gxOUCG0VucAbD8jB1ASYFqk35r8RNLt91hpI8UOyC2mZeZsnluGxJarRn4NSTm5HgjGEyiJ2wQArYJc9mmzxX8e0LNEjZR32MQjkf1g0MQAAAAAElFTkSuQmCC","aspectRatio":1.6865671641791045,"src":"/static/741aacdb6ba2e8df1b88b93b521715a6/62b1f/failwin.png","srcSet":"/static/741aacdb6ba2e8df1b88b93b521715a6/e7519/failwin.png 113w,\n/static/741aacdb6ba2e8df1b88b93b521715a6/7e7e9/failwin.png 225w,\n/static/741aacdb6ba2e8df1b88b93b521715a6/62b1f/failwin.png 450w,\n/static/741aacdb6ba2e8df1b88b93b521715a6/e2e7f/failwin.png 675w,\n/static/741aacdb6ba2e8df1b88b93b521715a6/db955/failwin.png 900w,\n/static/741aacdb6ba2e8df1b88b93b521715a6/a8378/failwin.png 1024w","srcWebp":"/static/741aacdb6ba2e8df1b88b93b521715a6/b8a88/failwin.webp","srcSetWebp":"/static/741aacdb6ba2e8df1b88b93b521715a6/3a3bf/failwin.webp 113w,\n/static/741aacdb6ba2e8df1b88b93b521715a6/975bf/failwin.webp 225w,\n/static/741aacdb6ba2e8df1b88b93b521715a6/b8a88/failwin.webp 450w,\n/static/741aacdb6ba2e8df1b88b93b521715a6/761da/failwin.webp 675w,\n/static/741aacdb6ba2e8df1b88b93b521715a6/210c1/failwin.webp 900w,\n/static/741aacdb6ba2e8df1b88b93b521715a6/cc834/failwin.webp 1024w","sizes":"(max-width: 450px) 100vw, 450px"}}}},"author":{"id":"9257cd1e-ca7f-578b-a2dd-9c2e74282caf","name":"Smokescreen Team"}}},{"node":{"id":"0b6fe724-d0b1-5b1a-a31b-daeeb17e0310","title":"Deception and Kerckhoffs’s Cryptographic Principle","content":"

Conceptually, deception is an incredibly intuitive approach to cybersecurity. The parallels between deception in the real-world, and deception in cyberspace are clear and easy to understand. However, in the digital battlefield it’s far more nuanced — it’s easy to do it badly, and far harder to get it right. Which makes it rather similar to a more traditional security practice — cryptography.

\n

Cryptographers are familiar with a well-known axiom called Kerckhoff’s principle, which states:

\n

A cryptosystem should be secure even if everything about the system, except the key, is public knowledge.

\n

This was famously paraphrased by Claude Shannon in what is known as Shannon’s Maxim:

\n

“The enemy knows the system“, i.e., “one ought to design systems under the assumption that the enemy will immediately gain full familiarity with them“

\n

The applicability to deception is immediately apparent. It should remain effective, even when an attacker:

\n\n

However, the exact map of the minefield — the specific placement of decoys, their running services, and their content is not known. This deception map is the equivalent of the secret key in a crypto-system. As long as the map is not known to the attacker, the illusion should still remain extremely effective, despite the attacker having complete visibility into the rest of the system.

\n

At Smokescreen, we are laser focused on making sure deception is ‘done right’ — with the necessary rigour and formal reasoning to hold up in real-world conditions. How do we do this? Our depth of experience in related cybersecurity disciplines is our secret weapon. We apply hard earned knowledge from red-teaming, asymmetric thinking, threat hunting, cryptography and incident response to build the most formidable and effective deception system available.

\n","excerpt":"The parallels between deception in the real-world, and deception in cyberspace are clear and easy to understand. However, deception in the digital battlefield is far more nuanced — it’s easy to do it badly, and far harder to get it right. Which makes it rather similar to a more traditional security practice — cryptography.\n","slug":"deception-and-kerckhoffss-cryptographic-principle","date":"2017-02-16T10:50:52.000Z","status":"publish","modified":"2020-01-06T07:05:07.000Z","wordpress_id":16772,"featured_media":{"id":"c7ca7a31-c5f1-5880-8111-9cbfd1198f24","source_url":"https://ss-website-content-prod.s3.ap-south-1.amazonaws.com/wp-content/uploads/2017/02/Enigma-plugboard.jpg","alt_text":"Deception","large":{"childImageSharp":{"fluid":{"base64":"data:image/jpeg;base64,/9j/2wBDABALDA4MChAODQ4SERATGCgaGBYWGDEjJR0oOjM9PDkzODdASFxOQERXRTc4UG1RV19iZ2hnPk1xeXBkeFxlZ2P/2wBDARESEhgVGC8aGi9jQjhCY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2P/wgARCAAOABQDASIAAhEBAxEB/8QAFwAAAwEAAAAAAAAAAAAAAAAAAAMEBf/EABYBAQEBAAAAAAAAAAAAAAAAAAIAAf/aAAwDAQACEAMQAAABQ6NgWaUG3//EABoQAAIDAQEAAAAAAAAAAAAAAAECAAMRBBL/2gAIAQEAAQUC5l8LaodDWwK7DsKHf//EABURAQEAAAAAAAAAAAAAAAAAAAAR/9oACAEDAQE/AUf/xAAVEQEBAAAAAAAAAAAAAAAAAAAAEf/aAAgBAgEBPwFX/8QAGRABAAIDAAAAAAAAAAAAAAAAAQAhAhIg/9oACAEBAAY/AryLibnP/8QAGhABAAMBAQEAAAAAAAAAAAAAAQARITFBYf/aAAgBAQABPyEVqOqJ0KesQFX9GbGx0OTQKn//2gAMAwEAAgADAAAAEDzP/8QAFREBAQAAAAAAAAAAAAAAAAAAARD/2gAIAQMBAT8QCf/EABURAQEAAAAAAAAAAAAAAAAAAAEQ/9oACAECAQE/EFn/xAAbEAEBAAMBAQEAAAAAAAAAAAABEQAhMcFxkf/aAAgBAQABPxAAdtioQ7gVpEDn5kg4eBH5gNDyQ5wxJMSOmeY1IR3LfM//2Q==","aspectRatio":1.4705882352941178,"src":"/static/33488cec05051fdb0cde315fb03b25b1/14b42/Enigma-plugboard.jpg","srcSet":"/static/33488cec05051fdb0cde315fb03b25b1/f836f/Enigma-plugboard.jpg 200w,\n/static/33488cec05051fdb0cde315fb03b25b1/2244e/Enigma-plugboard.jpg 400w,\n/static/33488cec05051fdb0cde315fb03b25b1/14b42/Enigma-plugboard.jpg 800w,\n/static/33488cec05051fdb0cde315fb03b25b1/a1fc1/Enigma-plugboard.jpg 921w","srcWebp":"/static/33488cec05051fdb0cde315fb03b25b1/58556/Enigma-plugboard.webp","srcSetWebp":"/static/33488cec05051fdb0cde315fb03b25b1/61e93/Enigma-plugboard.webp 200w,\n/static/33488cec05051fdb0cde315fb03b25b1/1f5c5/Enigma-plugboard.webp 400w,\n/static/33488cec05051fdb0cde315fb03b25b1/58556/Enigma-plugboard.webp 800w,\n/static/33488cec05051fdb0cde315fb03b25b1/147d5/Enigma-plugboard.webp 921w","sizes":"(max-width: 800px) 100vw, 800px"}}},"medium":{"childImageSharp":{"fluid":{"base64":"data:image/jpeg;base64,/9j/2wBDABALDA4MChAODQ4SERATGCgaGBYWGDEjJR0oOjM9PDkzODdASFxOQERXRTc4UG1RV19iZ2hnPk1xeXBkeFxlZ2P/2wBDARESEhgVGC8aGi9jQjhCY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2P/wgARCAAOABQDASIAAhEBAxEB/8QAFwAAAwEAAAAAAAAAAAAAAAAAAAMEBf/EABYBAQEBAAAAAAAAAAAAAAAAAAIAAf/aAAwDAQACEAMQAAABQ6NgWaUG3//EABoQAAIDAQEAAAAAAAAAAAAAAAECAAMRBBL/2gAIAQEAAQUC5l8LaodDWwK7DsKHf//EABURAQEAAAAAAAAAAAAAAAAAAAAR/9oACAEDAQE/AUf/xAAVEQEBAAAAAAAAAAAAAAAAAAAAEf/aAAgBAgEBPwFX/8QAGRABAAIDAAAAAAAAAAAAAAAAAQAhAhIg/9oACAEBAAY/AryLibnP/8QAGhABAAMBAQEAAAAAAAAAAAAAAQARITFBYf/aAAgBAQABPyEVqOqJ0KesQFX9GbGx0OTQKn//2gAMAwEAAgADAAAAEDzP/8QAFREBAQAAAAAAAAAAAAAAAAAAARD/2gAIAQMBAT8QCf/EABURAQEAAAAAAAAAAAAAAAAAAAEQ/9oACAECAQE/EFn/xAAbEAEBAAMBAQEAAAAAAAAAAAABEQAhMcFxkf/aAAgBAQABPxAAdtioQ7gVpEDn5kg4eBH5gNDyQ5wxJMSOmeY1IR3LfM//2Q==","aspectRatio":1.4675324675324675,"src":"/static/33488cec05051fdb0cde315fb03b25b1/32fd5/Enigma-plugboard.jpg","srcSet":"/static/33488cec05051fdb0cde315fb03b25b1/06e94/Enigma-plugboard.jpg 113w,\n/static/33488cec05051fdb0cde315fb03b25b1/07ab6/Enigma-plugboard.jpg 225w,\n/static/33488cec05051fdb0cde315fb03b25b1/32fd5/Enigma-plugboard.jpg 450w,\n/static/33488cec05051fdb0cde315fb03b25b1/4a838/Enigma-plugboard.jpg 675w,\n/static/33488cec05051fdb0cde315fb03b25b1/9842e/Enigma-plugboard.jpg 900w,\n/static/33488cec05051fdb0cde315fb03b25b1/a1fc1/Enigma-plugboard.jpg 921w","srcWebp":"/static/33488cec05051fdb0cde315fb03b25b1/b8a88/Enigma-plugboard.webp","srcSetWebp":"/static/33488cec05051fdb0cde315fb03b25b1/3a3bf/Enigma-plugboard.webp 113w,\n/static/33488cec05051fdb0cde315fb03b25b1/975bf/Enigma-plugboard.webp 225w,\n/static/33488cec05051fdb0cde315fb03b25b1/b8a88/Enigma-plugboard.webp 450w,\n/static/33488cec05051fdb0cde315fb03b25b1/761da/Enigma-plugboard.webp 675w,\n/static/33488cec05051fdb0cde315fb03b25b1/210c1/Enigma-plugboard.webp 900w,\n/static/33488cec05051fdb0cde315fb03b25b1/147d5/Enigma-plugboard.webp 921w","sizes":"(max-width: 450px) 100vw, 450px"}}}},"author":{"id":"9257cd1e-ca7f-578b-a2dd-9c2e74282caf","name":"Smokescreen Team"}}}]},"costSectionImage":{"childImageSharp":{"fluid":{"base64":"data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAABQAAAANCAYAAACpUE5eAAAACXBIWXMAAAsTAAALEwEAmpwYAAADUklEQVQ4yzWSW2gcZRzFzzcze02y273OfWdnZ3dmr9mmSUsiaaJtV+0lNppaGmukTcEHgygWtS8iKAUFRSEvggj6JoJPPha1j74IfREUBC+ICIKgD2K7mfn7n10dOAzfzHy/Od/5H4xGDVzb6aPSaeeyhl2ZdepW2qx5Sd3qirK2JKnWCaHb56HZO9DMZ4Rm3YBm3YRq7kuq8aFQjU8yVv3LGct5F4AEuVyBVCofl8rqT6xfpKr+h6Sa/0iaSUK3SJgOgSVbdUrbLgmjRtBtYiihqk9VqvLa/A7HH/aAQinWCyiWCWV+UeYPVIM3WRFsNxQ1L4TjhTPNzkGx1T3g9QFDxwwdJwx7LFT9LooVgt34Gucv98ELBpbfQ4kfVrS7SaMWJq16lPH8SHJakahPJTfaLD8SthvBqEXsOso5XsTRhBOH9dbneHzXgmyYMfRWDEzxH3Nei3LNNhUGC5T1+wTXJ+EGJPFdbgTEQJIdj7IshaEczRTY7H6KK88VIfKVOT7u95wd5erNcC4IorQXUL6/QIeGiyS1eiS8DkN9Uvgu1RoTKXG2GsdS1SOUVULn8Pt45Z00RKHiMnCc4CHkXT+aZRfJoEf5zgLlh0skMxDsMHYn11sTh1LskqGp+Oj/AwdHb+LWN0qc3ygeiKyaYY6zyrd7UX7+MBXmj9CMP5g44wxJZqjitlj+ZOoZBiZjYEXj7PV7WFi+LhFxcw4Vn50ORL2Xc1vhXKcb5oJeWOwNo1SzG8FpRiJWrRGBh8XZRXIM0u2I2zB1pxp/4djaVcSXUlE/Ev9VRqgWZdwmzbTapLADxL2zG7HiqYYwWLodcnYhqgZLG087aP2G1dEmllaBREV9OuF4d9Kdwbey3/0x3Rv+qjSD36WG/2cq6P2d6Q7HuaMrlPK7pDiNScEli4tu2qRw7txhLrv9Mx58dA3nLgGnYpubO6s4e2kDDz22JU5uXBHrp/dw36mXxfIDr8srJ96SV+7fTyyvf5BcXPlYHix+JnXmv1Da/a+yQf9Ooub+kPL7t3Hm4hE8chkozWUFntwD1jeQeXVf4MbbCl58IyleejOD51+bxe71Ap7Y07B1zcGFXR9bV+ex+dQx3ryGje0Rzm2fwekL2+yuibMX8S+BMBcPGVLWLQAAAABJRU5ErkJggg==","aspectRatio":1.528735632183908,"src":"/static/739e365bb81f8bf83185927701d2793f/651c0/cost-image-2x.png","srcSet":"/static/739e365bb81f8bf83185927701d2793f/e223a/cost-image-2x.png 133w,\n/static/739e365bb81f8bf83185927701d2793f/66882/cost-image-2x.png 265w,\n/static/739e365bb81f8bf83185927701d2793f/651c0/cost-image-2x.png 530w,\n/static/739e365bb81f8bf83185927701d2793f/a384c/cost-image-2x.png 795w,\n/static/739e365bb81f8bf83185927701d2793f/c884a/cost-image-2x.png 1056w","srcWebp":"/static/739e365bb81f8bf83185927701d2793f/46494/cost-image-2x.webp","srcSetWebp":"/static/739e365bb81f8bf83185927701d2793f/a5ef1/cost-image-2x.webp 133w,\n/static/739e365bb81f8bf83185927701d2793f/4dc00/cost-image-2x.webp 265w,\n/static/739e365bb81f8bf83185927701d2793f/46494/cost-image-2x.webp 530w,\n/static/739e365bb81f8bf83185927701d2793f/5b747/cost-image-2x.webp 795w,\n/static/739e365bb81f8bf83185927701d2793f/950f5/cost-image-2x.webp 1056w","sizes":"(max-width: 530px) 100vw, 530px"}}}},"pageContext":{"id":"a88fcb7f-3bf0-5a47-9ada-d4cfbf6e2ab9","relatedPostsIDs":[16912,16772,18727,18716,18707]}},"staticQueryHashes":["1478079672"]}