Information security is a complex field. The list of available security technologies starts deceptively simple, beginning with firewalls and antivirus but quickly becomes complex and well, intimidating.
\r\n\r\n\r\n\r\nYou can ascertain the maturity of a cybersecurity program by the types of security controls implemented in a network. Most organizations have at least a firewall, antivirus, and maybe a VPN. As security programs develop, patch management technology, email filtering, and vulnerability scanning get implemented next.
\r\n\r\n\r\n\r\nAs organizations mature further, IDS, IPS, SIEM, and web application firewalls become common. Then comes Network Traffic Analysis (NTA), Network Access Control (NAC), Data Loss Prevention (DLP), User Entity and Behavior Analytics (UBA/UEBA), various types of encryption, single sign-on, file integrity validation, mobile device management, web filtering, and two-factor authentication. There are a lot more, but you get the idea.
\r\n\r\n\r\n\r\nEfforts to simplify the list often break security controls down into categories, such as protective or detective controls. Many of these technologies can be easily categorized based on their primary function. Firewalls, antivirus, NAC, VPN, IPS, email filtering, and vulnerability scanning are primarily protective. IDS, SIEM, DLP, UBA/UEBA, and file integrity validation are detective in nature.
\r\n\r\n\r\n\r\nThese are, of course, general categorizations. Firewalls, for example, can generate logs that act as detections while DLP often utilizes active blocking that is protective. Different vendor solutions can blur the distinction between preventive and detective, while solutions such as Unified Threat Management (UTM) and many next-gen firewalls incorporate the features of multiple technologies into a single solution. Functionally, though, it is still possible to categorize security technologies.
\r\n\r\n\r\n\r\nWhen it comes to deception technology, things get a lot more unclear – Is it protective? Is it detective? Is it suited for mature security programs? Or can it be implemented small security teams with limited security controls as well? The answer to all these questions is – Yes. Wait, how can this be?
\r\n\r\n\r\n\r\nWell, the problem is one involving the framing of the question. Before we look at deception technology, we are going to look at another aspect of security – physical security.
\r\n\r\n\r\n\r\nCybersecurity practitioners are aware of the impact physical security controls have. Physical security is generally considered a related but separate discipline. Weak physical security can often render highly effective cybersecurity controls moot. Why? Because attackers have two channels with which they can interact with your assets: cyber and physical.
\r\n\r\n\r\n\r\nCyber interactions occur via packets, bits, and bytes. They happen over the network and are relatively independent of the physical world. It does not matter what physical form the computer takes or if the connection to the Internet is via Ethernet or coax cable. You counter cyberattacks with cybersecurity controls.
\r\n\r\n\r\n\r\nPhysical interactions, on the other hand, occur in the real world and involve direct interactions with objects that have mass and can move from one location to another. You counter physical attacks using physical security controls.
\r\n\r\n\r\n\r\nWhile there is a relationship between physical and cyber, they are not directly related. Addressing one area provides no guarantee of protection in the other.
\r\n\r\n\r\n\r\nConsider data that is protected by theoretically perfect cyber controls. Assume there is absolutely no way for an attacker to harm an organization via any form of cyberattack. Weaknesses in physical security can still result in significant harm. An attacker with physical access can retrieve the output of a printer, listen to spoken conversations, or even shoulder surf an authorized user to obtain sensitive data. Even if none of these are possible, an attacker with a sledgehammer and an angle grinder in a data center can cause serious harm.
\r\n\r\n\r\n\r\nThe converse is also true. An organization with theoretically perfect physical security can be compromised if they have cyber weaknesses. Locked doors, security cameras, motion sensors, and security guards do little to stop an attack consisting of packets going across wires.
\r\n\r\n\r\n\r\nAnother way of looking at this relationship between physical and cybersecurity is from the perspective of an attacker. When planning their attack, adversaries can target cyber or physical controls depending on identified weaknesses.
\r\n\r\n\r\n\r\nThese, however, are not the only options available to attackers. To facilitate either physical or cyber compromise, attackers often target the human. Techniques such as phishing, spear-phishing, and social engineering exploit long-established habits, patterns, and biases to break into systems. These techniques could be employed to facilitate a cyberattack, such as when sending a malicious attachment in an email. They can also be used as part of a physical attack, for instance, when an adversary pretends to be delivering a package to gain access to a building.
\r\n\r\n\r\n\r\nAccording to the 2020 Ponemon Institute Cost of a Data Breach Report, the combination of phishing and social engineering represents 17% of data breaches, more than vulnerabilities in third-party software (16%), physical security compromise (10%), malicious insiders (7%), misconfigurations/system error (6%), or business email compromise (5%).
\r\n\r\n\r\n\r\nAdversaries attack us physically, and we employ physical security controls to counter those attacks. They launch cyberattacks, and we use cybersecurity controls as countermeasures. But what about attackers targeting the human mind? That is when cyber deception comes into play.
\r\n\r\n\r\n\r\nIn his book Practice to Deceive, noted deception author Barton Whaley writes, “In combat, deception strengthens the weaker side. When all other factors are equal, the more deceptive player or team will always win.”
\r\n\r\n\r\n\r\nSocial engineering, phishing, and cyberattacks such as antivirus evasion employ deception. Traditionally, however, defenders have not relied on cyber-deception. As a result, attackers consistently compromise our environments and remain on them for days, weeks, or even months before being detected. Deception technology allows us to change the game entirely.
\r\n\r\n\r\n\r\nDeception technology allows defenders to influence the thoughts and actions of attackers. Your network is yours. You have created it and, therefore, can control its every aspect, down to the individual packet. As a result, you have the capability of manipulating what the attackers see once they are inside. By using deception techniques, you can place attackers into a real-life version of The Matrix.
\r\n\r\n\r\n\r\nYou can place deceptive systems, services, credentials, files, and other resources on the network. As these resources have no real production function, there should be no legitimate interaction with them. Any attempt to interact with these resources is, therefore, suspicious at a minimum and malicious at worse. Alerting on this interaction results in a high-fidelity, low noise detection solution.
\r\n\r\n\r\n\r\nBy carefully designing and placing these deceptive assets on the network, you can distract attackers away from your truly critical resources, not only allowing for detection of the attack but also delaying its progress.
\r\n\r\n\r\n\r\nBy analyzing the interaction of the attackers with these deceptive resources, you can learn more about their tactics, techniques, and procedures. This threat intelligence can create a better defensive security architecture and improve the effectiveness of the deceptive environment.
\r\n\r\n\r\n\r\nFaster and more effective attack detection combined with comprehensive information about the attack allows for increased efficiency of security operations and a more effective incident response. You will not only minimize the harm resulting from the attacks but also reduce your SOC overhead.
\r\n\r\n\r\n\r\nHigher fidelity detection allows you to take a more active role in defensive operations. Traditionally, defensive security makes use of static technology to combat human and automated threats alike. Security technology can combat automated threats as humans cannot operate at the speeds necessary to counter automated attacks such as fast-spreading malware.
\r\n\r\n\r\n\r\nTechnology controls, however, are constrained by their programming. Creative attackers have a history of discovering the limits of, and then circumventing those controls. Given enough time and the necessary skills, creative human attackers will always win against technology – this is where the real value of deception technology comes into play.
\r\n\r\n\r\n\r\nThe only truly effective way to combat a creative human attacker is with another human. Unfortunately, most organizations lack the budget to maintain a staff of active defenders because, in part, SOC analysts are spending as much as one-third of their time dealing with false-positive alerts.
\r\n\r\n\r\n\r\nDeception technology significantly reduces the number of false positives, generates detailed attack intelligence, and detects attackers more quickly. As a result, your analysts save a ton of time that they would otherwise spend chasing ghosts. Without these benefits, having your analysts actively respond to attacks is an exercise in futility. With deception, you will identify attacks more quickly and have the time to engage attackers.
\r\n\r\n\r\n\r\nWhen discussing active attacker engagement, we are not talking about hacking back. There may be situations where nation-state operators engage in offensive counter-hacking, but this is illegal for most organizations. There are, however, many options available to active defenders that do not cross the hack-back line.
\r\n\r\n\r\n\r\nAs defenders, there is a lot you can do once you have identified an attacker on your network. You can manipulate, in real-time, the deceptive environment and the deception cover story based on your knowledge of the attack. Here are some examples of what is possible:
\r\n\r\n\r\n\r\nThese tactics are effective after the attacker has gained a solid foothold in the environment. Ideally, defenders could even slow down or distract attackers while law enforcement is engaged if the circumstances were appropriate.
\r\n\r\n\r\n\r\nTraditionally, information security professions like penetration testing, red-teaming, digital forensics, and incident response have been considered cool. It is because defenders appear to be responsible for babysitting technology and wading through copious amounts of log data.
\r\n\r\n\r\n\r\nWith deception technology, we can change that paradigm. You will be able to create active defense professionals who turn the adversary’s playbook against them. When you get to this stage, it will be easier for an attacker to physically compromise an environment than to compromise it across a wire. That is when defenders truly achieve ultimate victory.
\r\n\r\n\r\n\r\nDeception technology enables you to distract attackers away from critical resources and delay their progress in your network. It allows you to detect them more quickly, but none of these represent the superpower of cyber deception. Cyber deception can, when fully utilized, cause an attacker to second-guess everything they think they know about your environment. It can create the impression that detection and possible capture is imminent. And it can lead the attacker to conclude that attacking a deceptive environment is more trouble than it is worth. In every real sense, cyber deception can stop an attack before it even begins.
\r\n\r\n\r\n\r\nSo, back to where we started – Where does cyber deception fit into the landscape of information security? Is it detective or protective? Does it require a robust cybersecurity program? These questions assume that cyber-deception is a component of cybersecurity. It is not.
\r\n\r\n\r\n\r\nDefensive security operations involve three functions: cyber, physical, and mental. Like a stool with three legs, a failure in any one of these functions can lead to compromise.
\r\n\r\n\r\n\r\nCyber deception is the answer to the mental component, and like physical security, it works with but is separate from traditional cyber controls. As such, it can and should be deployed by every organization, regardless of size or technical complexity. It requires no other technical security controls, yet can benefit from and, in turn, can provide benefits to any existing security program. It is the missing piece of the defensive security puzzle. Without it, attackers have had the advantage. With cyber deception, defenders can finally take that advantage back.
\r\n","excerpt":"Deception technology is a different way of thinking about cybersecurity. Without it, attackers have the advantage. You can take that advantage back.\n","slug":"you-need-deception-technology","date":"2020-09-10T15:49:12.000Z","modified":"2020-09-14T09:22:29.000Z","status":"publish","featured_media":{"id":"859ade4b-22e8-546a-8993-e72933193226","source_url":"https://ss-website-content-prod.s3.ap-south-1.amazonaws.com/wp-content/uploads/2020/09/You-need-deception-technology.jpeg","alt_text":"You need deception technology","large":{"childImageSharp":{"fluid":{"base64":"data:image/jpeg;base64,/9j/2wBDABALDA4MChAODQ4SERATGCgaGBYWGDEjJR0oOjM9PDkzODdASFxOQERXRTc4UG1RV19iZ2hnPk1xeXBkeFxlZ2P/2wBDARESEhgVGC8aGi9jQjhCY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2P/wgARCAANABQDASIAAhEBAxEB/8QAGAAAAgMAAAAAAAAAAAAAAAAAAAMBAgX/xAAUAQEAAAAAAAAAAAAAAAAAAAAA/9oADAMBAAIQAxAAAAHJq5AEh//EABsQAAICAwEAAAAAAAAAAAAAAAECABMQERIh/9oACAEBAAEFAq2aV6JPquTjif/EABQRAQAAAAAAAAAAAAAAAAAAABD/2gAIAQMBAT8BP//EABQRAQAAAAAAAAAAAAAAAAAAABD/2gAIAQIBAT8BP//EABYQAAMAAAAAAAAAAAAAAAAAAAAgMf/aAAgBAQAGPwJaf//EABkQAQACAwAAAAAAAAAAAAAAAAEAIRExQf/aAAgBAQABPyHUDsVv5mcDCG7iq4zqpYI//9oADAMBAAIAAwAAABDDz//EABQRAQAAAAAAAAAAAAAAAAAAABD/2gAIAQMBAT8QP//EABQRAQAAAAAAAAAAAAAAAAAAABD/2gAIAQIBAT8QP//EAB0QAAICAgMBAAAAAAAAAAAAAAEhABExQVFx0YH/2gAIAQEAAT8QDFQA0OvZXaJJRIfkMSNAOJglsefkvrA1agsLBJT/2Q==","aspectRatio":1.5037593984962405,"src":"/static/b62f4738daa35d16f49ade4155876bd2/14b42/You-need-deception-technology.jpg","srcSet":"/static/b62f4738daa35d16f49ade4155876bd2/f836f/You-need-deception-technology.jpg 200w,\n/static/b62f4738daa35d16f49ade4155876bd2/2244e/You-need-deception-technology.jpg 400w,\n/static/b62f4738daa35d16f49ade4155876bd2/14b42/You-need-deception-technology.jpg 800w,\n/static/b62f4738daa35d16f49ade4155876bd2/47498/You-need-deception-technology.jpg 1200w,\n/static/b62f4738daa35d16f49ade4155876bd2/0e329/You-need-deception-technology.jpg 1600w,\n/static/b62f4738daa35d16f49ade4155876bd2/eeda9/You-need-deception-technology.jpg 1650w","srcWebp":"/static/b62f4738daa35d16f49ade4155876bd2/58556/You-need-deception-technology.webp","srcSetWebp":"/static/b62f4738daa35d16f49ade4155876bd2/61e93/You-need-deception-technology.webp 200w,\n/static/b62f4738daa35d16f49ade4155876bd2/1f5c5/You-need-deception-technology.webp 400w,\n/static/b62f4738daa35d16f49ade4155876bd2/58556/You-need-deception-technology.webp 800w,\n/static/b62f4738daa35d16f49ade4155876bd2/99238/You-need-deception-technology.webp 1200w,\n/static/b62f4738daa35d16f49ade4155876bd2/7c22d/You-need-deception-technology.webp 1600w,\n/static/b62f4738daa35d16f49ade4155876bd2/36d36/You-need-deception-technology.webp 1650w","sizes":"(max-width: 800px) 100vw, 800px"}}},"medium":{"childImageSharp":{"fluid":{"base64":"data:image/jpeg;base64,/9j/2wBDABALDA4MChAODQ4SERATGCgaGBYWGDEjJR0oOjM9PDkzODdASFxOQERXRTc4UG1RV19iZ2hnPk1xeXBkeFxlZ2P/2wBDARESEhgVGC8aGi9jQjhCY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2P/wgARCAANABQDASIAAhEBAxEB/8QAGAAAAgMAAAAAAAAAAAAAAAAAAAMBAgX/xAAUAQEAAAAAAAAAAAAAAAAAAAAA/9oADAMBAAIQAxAAAAHJq5AEh//EABsQAAICAwEAAAAAAAAAAAAAAAECABMQERIh/9oACAEBAAEFAq2aV6JPquTjif/EABQRAQAAAAAAAAAAAAAAAAAAABD/2gAIAQMBAT8BP//EABQRAQAAAAAAAAAAAAAAAAAAABD/2gAIAQIBAT8BP//EABYQAAMAAAAAAAAAAAAAAAAAAAAgMf/aAAgBAQAGPwJaf//EABkQAQACAwAAAAAAAAAAAAAAAAEAIRExQf/aAAgBAQABPyHUDsVv5mcDCG7iq4zqpYI//9oADAMBAAIAAwAAABDDz//EABQRAQAAAAAAAAAAAAAAAAAAABD/2gAIAQMBAT8QP//EABQRAQAAAAAAAAAAAAAAAAAAABD/2gAIAQIBAT8QP//EAB0QAAICAgMBAAAAAAAAAAAAAAEhABExQVFx0YH/2gAIAQEAAT8QDFQA0OvZXaJJRIfkMSNAOJglsefkvrA1agsLBJT/2Q==","aspectRatio":1.5066666666666666,"src":"/static/b62f4738daa35d16f49ade4155876bd2/32fd5/You-need-deception-technology.jpg","srcSet":"/static/b62f4738daa35d16f49ade4155876bd2/06e94/You-need-deception-technology.jpg 113w,\n/static/b62f4738daa35d16f49ade4155876bd2/07ab6/You-need-deception-technology.jpg 225w,\n/static/b62f4738daa35d16f49ade4155876bd2/32fd5/You-need-deception-technology.jpg 450w,\n/static/b62f4738daa35d16f49ade4155876bd2/4a838/You-need-deception-technology.jpg 675w,\n/static/b62f4738daa35d16f49ade4155876bd2/9842e/You-need-deception-technology.jpg 900w,\n/static/b62f4738daa35d16f49ade4155876bd2/eeda9/You-need-deception-technology.jpg 1650w","srcWebp":"/static/b62f4738daa35d16f49ade4155876bd2/b8a88/You-need-deception-technology.webp","srcSetWebp":"/static/b62f4738daa35d16f49ade4155876bd2/3a3bf/You-need-deception-technology.webp 113w,\n/static/b62f4738daa35d16f49ade4155876bd2/975bf/You-need-deception-technology.webp 225w,\n/static/b62f4738daa35d16f49ade4155876bd2/b8a88/You-need-deception-technology.webp 450w,\n/static/b62f4738daa35d16f49ade4155876bd2/761da/You-need-deception-technology.webp 675w,\n/static/b62f4738daa35d16f49ade4155876bd2/210c1/You-need-deception-technology.webp 900w,\n/static/b62f4738daa35d16f49ade4155876bd2/36d36/You-need-deception-technology.webp 1650w","sizes":"(max-width: 450px) 100vw, 450px"}}}},"categories":[{"id":"a725b316-af4b-5d16-8453-4b07c65d8fca","slug":"deception","name":"deception"},{"id":"91492045-3e86-5e2f-a34f-b0855c540ccf","slug":"industry","name":"industry"},{"id":"a968152c-f7b0-528a-95cc-b0e28c991f79","slug":"sans","name":"SANS"}],"author":{"id":"2c2c7385-0c4f-5556-b304-3cae025c33da","name":"Kevin Fiscus"},"yoast_meta":{"yoast_wpseo_twitter_title":"","yoast_wpseo_twitter_description":"","yoast_wpseo_redirect":"","yoast_wpseo_opengraph_title":"","yoast_wpseo_opengraph_description":"","yoast_wpseo_metakeywords":"","yoast_wpseo_metadesc":"Deception technology is a different way of thinking about cybersecurity. Without it, attackers have the advantage. You can take it back.","yoast_wpseo_meta_robots_noindex":"","yoast_wpseo_meta_robots_nofollow":"","yoast_wpseo_meta_robots_adv":"","yoast_wpseo_linkdex":"67","yoast_wpseo_focuskw":"Deception technology","yoast_wpseo_canonical":""}},"relatedPosts":{"edges":[{"node":{"id":"ea0aa0bf-7d16-5925-b1f2-594f99da9771","title":"6 takeaways from GOV.UK’s 2021 cybersecurity breaches survey","content":"\nUK’s Department for Digital, Culture, Media and Sports has published the 6th edition of its annual cybersecurity breaches survey on GOV.UK.
\n\n\n\nWe sifted through this year’s report to compile the top 6 takeaways. Let’s go.
\n\n\n\nFewer businesses are now deploying security monitoring tools (35% vs. 40% last year) or undertaking any form of user monitoring (32% vs. 38%).
\n\n\n\nCompared to 46% of businesses in 2017, only 39% said that they detected any breach or attack. This can be attributed to fewer organizations deploying security controls and their limited ability to monitor remote employees.
\n\n\n\n83% of attacks on businesses and 79% on charities were in the form of phishing. These are consistent with the attack vectors reported in 2019 and 2020.
\n\n\n\n4 in 10 businesses and 1 in 4 charities were hit by a security breach/attack in the last 12 months.
\n\n\n\nOf the businesses and charities that reported a security breach/attack, a quarter of them were hit at least once a week,
\n\n\n\nThe data from this survey reinforces what we’re seeing globally:
\n\n\n\nYou can read the full report here.
\n\n\n\nThere’s no silver bullet. We can recommend four easy-to-implement active defense strategies that address security challenges around phishing and remote work access. These deception-based active defense recommendations are easy to implement, do not require complex tooling, and detect threats early.
\n\n\n\nEmail decoys are fake email accounts that intercept attackers attempting to mount social-engineering/spear-phishing attacks on high-value personnel.
\n\n\n\nSeed these decoys on social media and other Internet-facing assets where attackers scour for spear-phishing targets. These email decoys are enumerated by hackers and added to their target lists for sending spear-phishing emails. There is no reason for anyone to send any emails to the decoy email addresses. Therefore, any email sent to these addresses is a high-fidelity indication of an attack.
\n\n\n\nYou can integrate these with your SIEM to find other targets. Additionally, you can integrate with proxies to block access to spear-phishing domains.
\n\n\n\nEnabling employees to work from anywhere requires security teams to use VPNs, Citrix servers, and expose applications to the Internet.
\n\n\n\nAttackers target vulnerabilities in these remote access services to get into your network. Use that against them.
\n\n\n\nDeploy Internet-facing decoys that resemble vulnerable applications, databases, and servers. E.g., you can easily set up decoys that have the recent Citrix and ManageEngine vulnerabilities, making them attractive targets for the attackers.
\n\n\n\nAttackers looking for these assets during recon will discover and engage with the decoys as well. Any attempt to seek out these assets will alert you of incoming threats with low alert volume.
\n\n\n\nAttackers use credential stuffing and stolen credentials to break into organizations. These are hard to detect because the activity seems legitimate. You have two simple active defense plays here:
\n\n\n\nAs you’ve seen in the survey finding, fewer organizations have visibility into endpoints because now they are outside the perimeter. Consider using endpoint deception to build this visibility, detect attacks early, and stop lateral movement.
\n\n\n\nPlant endpoint decoys like fake files, processes, passwords, and cookies on the work machines of all your remote employees.
\n\n\n\nAn attacker on your employees’ machines will encounter these decoys and will be caught.
\n\n\n\nEndpoint deception follows the end-user, so even when they’re working from home, your ability to detect threats is not diminished. You gain visibility into home networks that are compromised without having to deploy appliances or network traffic monitoring choke-points.
\n\n\n\nActive defense is emerging as a viable approach to dealing with advanced attacks. MITRE has a new knowledge base dedicated to active defense. If you want to understand why this approach is gaining prominence in infosec circles, read this.
\n\n\n\nFor more on using active defense and deception for remote work security, check out the white paper.
Let’s cut to the chase, insurance companies are under siege from cyberattacks. An Accenture report from 2020 shows that attacks on insurers have more than doubled from 240 to 519, on average. Insurers also sit on top of sensitive customer data and are at risk of losing it – 44% exposed more than 500,000 customer records in 2019 compared to 15% for cross-industry peers.
\n\n\n\nAs more people around the world come under the ambit of insurance policies, the risk to insurers continues to grow. In this post, we take a look at some of the key pieces of an insurer’s infrastructure that adversaries target, why they go after it, and how you can use deception to build active defenses that mitigate the risk of these attacks and put you in a better position to detect and contain these threats,
\n\n\n\nFor a moment, step into the shoes of a malicious entity targeting an insurance company. Your goal is to get $$$. What are your best opportunities?
\n\n\n\nThe database of all policyholders and their policy details, complete with confidential and protected information is perhaps the most valuable asset of an insurer. This would be the holy grail of compromises. Given that a lot of this information is distributed across many systems (some of them legacy), protecting them is a challenge for the sector.
\n\n\n\nNot only would this data sell for a neat sum on the underground market, but it can also be weaponized in numerous ways, including and not limited to:
\n\n\n\nTo achieve this target, adversaries will have to invest time and money into:
\n\n\n\nCost-benefit analysis reveals Low to medium risk with an extremely high payout.
\n\n\n\nAdvanced and organized criminal syndicates.
\n\n\n\nInsurance companies deal with lots of files. Lots and lots of files. If an adversary succeeds in encrypting as many files as possible, the payout from this activity can be significant.
\n\n\n\nRansomware operators of any sophistication.
\n\n\n\nInsurance companies worldwide are expected to digitize their interactions with consumers. Everything from pre-sales to claims management is expected to be made available to consumers directly in a bid to simplify the consumer experience. This involves the adoption of cloud services, moving previously internal systems to Internet-facing infrastructure, and spinning up even more infrastructure to support business objectives. Adversaries now have a wider attack surface available to them to exploit.
\n\n\n\nMapping external infrastructure is a trivial task and therefore there are minimal considerations for groups adopting this approach.
\n\n\n\nLow effort with payout equivalent to the criticality of the infrastructure they compromise.
\n\n\n\nCybercriminals of any sophistication.
\n\n\n\nDeception is about tilting the odds of winning in your favor. It’s about making reasonable judgments about what the adversary might go after and presenting that information to them on a platter. Deception is about abstracting defenses to individual attacker techniques with lesser effort and increased cost to the attacker.
\n\n\n\nThe core principle of deception is the idea that any interaction with a decoy can be viewed as suspicious and warrants immediate action.
\n\n\n\nBroadly, the plan is to plant decoys across the network, from perimeter to end-point, to deceive the adversary. At a high-level, the following locations will be configured with decoys:
\n\n\n\nBy spreading decoys across the infrastructure, we maximize our chances of detecting adversaries. Remember, we only need to be able to detect the adversary once.
\n\n\n\nThe following is a break-down of what this might look like in practice.
\n\n\n\nLet’s say you don’t want to use deception. The alternative is to understand and defend yourself against every attacker technique. As per MITRE ATT&CK, these are over 100 and this does not account for variations in how these attacks might be executed.
\n\n\n\nDeception is grounded in addressing the motivations of the adversary and presenting fake information on a platter that adversaries find attractive. It is technique-agnostic and abstracts away the complexity that arises from blocking individual tools, techniques, and behaviors.
\n\n\n\nDeception is a form of Active Defense, where security teams take proactive steps to channel the adversary and make their life difficult. It varies from regular defense where you wait for an existing system to generate an alarm and then react.
\n\n\n\nMITRE new active defense framework, Shield, is being adopted by CISOs around the world and we see this approach being embraced by more and more security teams at insurance companies.
Distributed Deception Platforms are a hot topic today. Most CISOs are thinking of implementing deception technology or road-mapping it into their evaluations and budgets. The promises sound great:
\nUnfortunately, due to the unique secretive nature of deception (after all, you may not want people to know about it), there’s precious little information on how a security team can implement deception tecnology successfully and make it useful.
\nIf you’re being pushed to power-up a sleek appliance and kiss your cybersecurity woes goodbye, don’t believe the marketing hype — that’s not going to happen.
\nAfter implementing deception technology campaigns for the better part of a decade, we’ve compiled a list of the 7 deadly sins that will guarantee that your deception investment will disappoint you. Here we go:
\nIt’s quite obvious that for a deception technology deployment to be successful, you need an objective and a strategy. At a minimum, make sure you know what assets you’re trying to protect (they’re not all equal to the hacker). The best deception campaigns are extremely goal-oriented (e.g.: “Catch targeted attacks against my SWIFT servers, especially focused on breaches from third-party networks.”).
\nThe Fix: Make a list of your top 3 nightmare scenarios, and identify the assets (endpoints / servers / people / credentials / network zones) that are a part of those nightmares.
\nThere’s a reason some of the best deception specialists moonlight as threat hunters or red-teamers. Deception is an ‘active defence‘ capability — where deep knowledge of the attacker’s modus operandi is crucial. Knowing the critical paths an attacker will follow will massively boost the effectiveness of your deception capabilities.
\nThe Fix: Have your in-house / external red-team build attack trees to the assets you’ve identified at risk. Train your blue-team on how to think adversarially.
\nOne of the best things about deception technology is that the alerts are low false positive and real-time. That’s great, but when the metaphorical (or literal) phone rings, do you have a plan for how to respond? The attacker is very likely still ‘live and squirming’ on your infrastructure. This leads to interesting new opportunities and questions:
\nThe Fix: Have a specific set of incident response play-books for responding to deception alerts. War-game the scenarios end-to-end, ideally without your DFIR / blue-team being aware. Start basic and build a roadmap to advanced deception use cases.
\nConfident and experienced deception specialists will encourage (even insist) that you test the deception realism in your environment after you implement it. Not only does this validate that the deception is ‘working’ to meet your business objectives, but it will give you useful metrics like time-to-decieve, deception engagement time, coverage, and kill-chain hit ratios.
\nThe Fix: Blind test the strategy underlying your deception technology deployment. See how ‘real’ your simulated adversary believes the decoys are. Did you miss something? This is worth doing regularly.
\nThe best way to increase deception engagement time is to customise the decoys to your environment. There are a number of nifty tricks here (our MirageMaker feature does a lot of this for you), but never underestimate the power of human ingenuity.
\nThe Fix: Find the most devious folks in your infosec team and brainstorm how you can decieve, degrade, deny, disrupt, and dazzle an attacker even better. You want your deception to maximise the economic burden to the attacker in terms of time, effort, and cognitive load.
\nWell planned deception systems unify three perspectives to quickly arrive at the root cause of an incident:
\nWe call this the ‘deception trifecta’, and your entire strategy must be built around it.
\nThe Fix: Study the deception trifecta and determine how weak or strong you are on each side. Improve visibility, collection, and analysis speed for each perspective. Ensure supporting systems can flesh out context when deception systems alert you (e.g. do you have an updated asset inventory?)
\nRemember IDS? DLP? NAC? cough SIEM cough?
\nThe success of cybersecurity technologies is pretty binary: Either they’re well implemented by people who knew how to do it right, or far more often, they’re a mess of false promises and mismatched expectations. If you’re just being sold a box, AMC, and product training, there’s a lot missing. Sure, you might make it work, but the onus should be on the vendor to ensure you operationalise deception capabilities and see success for stuff that matters to you (we do this for every customer, big or small).
\nThe Fix: Talk to your provider to understand the depth of their knowledge on deception technology deployments, adversarial thinking, and most importantly, how they’ll make it all work for you. Get into specifics. Speak to their people. Hint: if their title says ‘Sales’… well… caveat emptor 🙂
\nDeception technology is more than just a new way to detect lateral movement, privilege escalation, ransomware, data-theft or solve any other current cybersecurity woes. It’s a fundamentally different way of thinking about how you defend your organisation, irrespective of shiny boxes (ours or anybody else’s)!
\nAvoid the mistakes above, and your security team will really see the benefits behind the hype. We have customers that now use deception as their ‘concertmaster‘ — the single most important pillar in their security stack, with everything else supporting it.
\nAt Smokescreen, we believe we’ve solved these problems through our technology, support, and experience. If you’d like to learn more about how we think it should be done, get in touch for a chat with our specialists!
\nIf you’re in the process of evaluating deception technology vendors, read our blog post on 10 questions you need to ask them or download our guide that dives deep into capabilities that make for a great deception solution.
\n\n\n\n","excerpt":"Since there’s precious little information on how security teams can make deception implementations successful (some folks like to keep it a secret), there’s plenty that can go wrong. Here are 7 ways to completely botch your deployment of deception technology.\n","slug":"7-deadly-sins-how-to-fail-at-implementing-deception-technology","date":"2017-09-18T14:01:05.000Z","status":"publish","modified":"2020-01-05T09:25:57.000Z","wordpress_id":16912,"featured_media":{"id":"940f3e3f-92f9-56f6-91a1-525330dda41c","source_url":"https://ss-website-content-prod.s3.ap-south-1.amazonaws.com/wp-content/uploads/2017/09/failwin.png","alt_text":"Fail At Deception Technology","large":{"childImageSharp":{"fluid":{"base64":"data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAABQAAAAMCAIAAADtbgqsAAAACXBIWXMAABYlAAAWJQFJUiTwAAABqklEQVQoz41SW0sCURCeWf9E1FMEvUWa1/VumpnXzdveLFN3VZDKCsmgf9BT4ENkQUpBUA/9xObsLrpUD8HHYc4538x85zsD6OL/hZ0gW52BZeziwbrb9lsXtFL8M9k4pBx3yCD7bMlOP4ZSkKuDoEJOxEjaKmSCYiePyQKWj6DWQqGB8axJAFaSNrLmkHWOoOgo65jML/sTL1uDRp/OHQZQ7WNaIAKgN0r1QNLgsAl5iaF6AvU2+mPGE3wY3gOlB5VjdpUTGSpNkLvIJ4CL7lO0UpJOr8bth1lnMl3rXVA5LpFjzT0RzItI5dpD9/3z5XQ+eJytdoeMkCoCF8tQ8kZJap2Puk+vN/P3zbMxNedIOTnE76KgctSqf+2bvNx9fN2+fa4PRoyQFgB9MRIJogZlki1DQWayRQ0DcSZ7y4tUXe0xqUUFCgYoVrrMY2Y1CVB0TtIYZJ1dkB8Lw6l/SaVno9gxOUCG0VucAbD8jB1ASYFqk35r8RNLt91hpI8UOyC2mZeZsnluGxJarRn4NSTm5HgjGEyiJ2wQArYJc9mmzxX8e0LNEjZR32MQjkf1g0MQAAAAAElFTkSuQmCC","aspectRatio":1.680672268907563,"src":"/static/741aacdb6ba2e8df1b88b93b521715a6/ee604/failwin.png","srcSet":"/static/741aacdb6ba2e8df1b88b93b521715a6/69585/failwin.png 200w,\n/static/741aacdb6ba2e8df1b88b93b521715a6/497c6/failwin.png 400w,\n/static/741aacdb6ba2e8df1b88b93b521715a6/ee604/failwin.png 800w,\n/static/741aacdb6ba2e8df1b88b93b521715a6/a8378/failwin.png 1024w","srcWebp":"/static/741aacdb6ba2e8df1b88b93b521715a6/58556/failwin.webp","srcSetWebp":"/static/741aacdb6ba2e8df1b88b93b521715a6/61e93/failwin.webp 200w,\n/static/741aacdb6ba2e8df1b88b93b521715a6/1f5c5/failwin.webp 400w,\n/static/741aacdb6ba2e8df1b88b93b521715a6/58556/failwin.webp 800w,\n/static/741aacdb6ba2e8df1b88b93b521715a6/cc834/failwin.webp 1024w","sizes":"(max-width: 800px) 100vw, 800px"}}},"medium":{"childImageSharp":{"fluid":{"base64":"data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAABQAAAAMCAIAAADtbgqsAAAACXBIWXMAABYlAAAWJQFJUiTwAAABqklEQVQoz41SW0sCURCeWf9E1FMEvUWa1/VumpnXzdveLFN3VZDKCsmgf9BT4ENkQUpBUA/9xObsLrpUD8HHYc4538x85zsD6OL/hZ0gW52BZeziwbrb9lsXtFL8M9k4pBx3yCD7bMlOP4ZSkKuDoEJOxEjaKmSCYiePyQKWj6DWQqGB8axJAFaSNrLmkHWOoOgo65jML/sTL1uDRp/OHQZQ7WNaIAKgN0r1QNLgsAl5iaF6AvU2+mPGE3wY3gOlB5VjdpUTGSpNkLvIJ4CL7lO0UpJOr8bth1lnMl3rXVA5LpFjzT0RzItI5dpD9/3z5XQ+eJytdoeMkCoCF8tQ8kZJap2Puk+vN/P3zbMxNedIOTnE76KgctSqf+2bvNx9fN2+fa4PRoyQFgB9MRIJogZlki1DQWayRQ0DcSZ7y4tUXe0xqUUFCgYoVrrMY2Y1CVB0TtIYZJ1dkB8Lw6l/SaVno9gxOUCG0VucAbD8jB1ASYFqk35r8RNLt91hpI8UOyC2mZeZsnluGxJarRn4NSTm5HgjGEyiJ2wQArYJc9mmzxX8e0LNEjZR32MQjkf1g0MQAAAAAElFTkSuQmCC","aspectRatio":1.6865671641791045,"src":"/static/741aacdb6ba2e8df1b88b93b521715a6/62b1f/failwin.png","srcSet":"/static/741aacdb6ba2e8df1b88b93b521715a6/e7519/failwin.png 113w,\n/static/741aacdb6ba2e8df1b88b93b521715a6/7e7e9/failwin.png 225w,\n/static/741aacdb6ba2e8df1b88b93b521715a6/62b1f/failwin.png 450w,\n/static/741aacdb6ba2e8df1b88b93b521715a6/e2e7f/failwin.png 675w,\n/static/741aacdb6ba2e8df1b88b93b521715a6/db955/failwin.png 900w,\n/static/741aacdb6ba2e8df1b88b93b521715a6/a8378/failwin.png 1024w","srcWebp":"/static/741aacdb6ba2e8df1b88b93b521715a6/b8a88/failwin.webp","srcSetWebp":"/static/741aacdb6ba2e8df1b88b93b521715a6/3a3bf/failwin.webp 113w,\n/static/741aacdb6ba2e8df1b88b93b521715a6/975bf/failwin.webp 225w,\n/static/741aacdb6ba2e8df1b88b93b521715a6/b8a88/failwin.webp 450w,\n/static/741aacdb6ba2e8df1b88b93b521715a6/761da/failwin.webp 675w,\n/static/741aacdb6ba2e8df1b88b93b521715a6/210c1/failwin.webp 900w,\n/static/741aacdb6ba2e8df1b88b93b521715a6/cc834/failwin.webp 1024w","sizes":"(max-width: 450px) 100vw, 450px"}}}},"author":{"id":"9257cd1e-ca7f-578b-a2dd-9c2e74282caf","name":"Smokescreen Team"}}},{"node":{"id":"faa742a1-4c12-586e-9304-8a6f65d02427","title":"10 Questions To Ask Deception Technology Vendors","content":"In order for you to cut through the marketing hype, here’s a set of evaluation questions to ask deception technology vendors that will help you better understand disparate offerings.
\nIf you’re currently evaluating deception technology vendors, we’ve written a guide that goes deeper into some of the questions that we’ve listed above. You can download it here.
\n","excerpt":"Deception technology is a major buzzword today. In order for you to cut through the marketing hype, here’s a set of evaluation questions that will help you better understand disparate deception offerings and identify vendors that know what they’re doing.\n","slug":"10-questions-to-ask-your-deception-technology-provider","date":"2017-09-18T12:58:47.000Z","status":"publish","modified":"2020-01-05T09:26:06.000Z","wordpress_id":16901,"featured_media":{"id":"cbfa76e5-6c88-57a7-a370-c16bd4df05ad","source_url":"https://ss-website-content-prod.s3.ap-south-1.amazonaws.com/wp-content/uploads/2017/09/10questions-1.png","alt_text":"Deception technology vendors","large":{"childImageSharp":{"fluid":{"base64":"data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAABQAAAANCAYAAACpUE5eAAAACXBIWXMAABYlAAAWJQFJUiTwAAACrklEQVQ4y51TS0+TURCdyyNpXBjUoEaNJG40UWIiMcbyKPZNH7bFttDSUqSFlvKwhdIGKOVRKUVolYiiGNSNG1f+w+NMrzFx62Lud7/7nTnfnZlzqPOJCWS0gIacIIsXZA+AXCGQNwLyT4ACcdDopA7Z+/jMO64xguUcJblPzTBwUKeRl0E7lNkDJQB3mJOimiD0EjSWAo3P6JC9nMk3wQiWcyRXOAwDNibkRQ2PgKw+0EgQ9DyqbxJOgqKzoNgcRxYU55jIaGL5JhjB8k2Vzdeq0DDkALUP8mLyot3Jt/NwKb6YToww2eQCKJkHpVdBMyugWX6mlvW3aFqTCqFUxmF45gJddVqxWX2AlZ1HCBcGQFPLUNvvQOUjULEGanwF1T6BDs9Bm0293zkGrR2Att7ys65xi2UYzG5Qx7ALx427OPt4j0n7QEuboPoZqPkdtM/J57/0e+Mb6OALkzZApz9BpX1+5/P3PzSuuAeDjwfZZnLhTsgO27wZvSmecjjTuqFa2dU3qjShqh84TqA2DqFyW/zTMmj1NVSmCMW9VckcaDoHg3OUhyJ1W3lj5f65uSfBKT3NCR7GtPSvCJrf4FjXPZSz+LzuY4Cn7R4D2fygYTf3kEvu5An3z+XRl83DW6nhYW4dxnINpt0Gest12Juf8XjvGP31E9iOTmE/OEFvqQrL9hsYSzsYLFTgWa/ifmIOFywsnw6e8iVPGN3BBG7FM7gSS+PiZBY9CyV0pQu4vrSBa6/K6Clso2e5gpuLa7icyqMrkUU342/EZnE7kmxxGER+okMS6Yg4W8LmEvzijoTWXITlEc3okDJFg0EWtz+msZIjpQ7YtQ61UxzaKY5RKFa/YheoFwkodoXifiomboXsQ9NQ7JQWRrCOANrEsn+d8sfL6n+9bP7Xy78B/QzPO9OV/CAAAAAASUVORK5CYII=","aspectRatio":1.5267175572519085,"src":"/static/b18c94100d3b034bc59158680ab07e07/ee604/10questions-1.png","srcSet":"/static/b18c94100d3b034bc59158680ab07e07/69585/10questions-1.png 200w,\n/static/b18c94100d3b034bc59158680ab07e07/497c6/10questions-1.png 400w,\n/static/b18c94100d3b034bc59158680ab07e07/ee604/10questions-1.png 800w,\n/static/b18c94100d3b034bc59158680ab07e07/a8378/10questions-1.png 1024w","srcWebp":"/static/b18c94100d3b034bc59158680ab07e07/58556/10questions-1.webp","srcSetWebp":"/static/b18c94100d3b034bc59158680ab07e07/61e93/10questions-1.webp 200w,\n/static/b18c94100d3b034bc59158680ab07e07/1f5c5/10questions-1.webp 400w,\n/static/b18c94100d3b034bc59158680ab07e07/58556/10questions-1.webp 800w,\n/static/b18c94100d3b034bc59158680ab07e07/cc834/10questions-1.webp 1024w","sizes":"(max-width: 800px) 100vw, 800px"}}},"medium":{"childImageSharp":{"fluid":{"base64":"data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAABQAAAANCAYAAACpUE5eAAAACXBIWXMAABYlAAAWJQFJUiTwAAACrklEQVQ4y51TS0+TURCdyyNpXBjUoEaNJG40UWIiMcbyKPZNH7bFttDSUqSFlvKwhdIGKOVRKUVolYiiGNSNG1f+w+NMrzFx62Lud7/7nTnfnZlzqPOJCWS0gIacIIsXZA+AXCGQNwLyT4ACcdDopA7Z+/jMO64xguUcJblPzTBwUKeRl0E7lNkDJQB3mJOimiD0EjSWAo3P6JC9nMk3wQiWcyRXOAwDNibkRQ2PgKw+0EgQ9DyqbxJOgqKzoNgcRxYU55jIaGL5JhjB8k2Vzdeq0DDkALUP8mLyot3Jt/NwKb6YToww2eQCKJkHpVdBMyugWX6mlvW3aFqTCqFUxmF45gJddVqxWX2AlZ1HCBcGQFPLUNvvQOUjULEGanwF1T6BDs9Bm0293zkGrR2Att7ys65xi2UYzG5Qx7ALx427OPt4j0n7QEuboPoZqPkdtM/J57/0e+Mb6OALkzZApz9BpX1+5/P3PzSuuAeDjwfZZnLhTsgO27wZvSmecjjTuqFa2dU3qjShqh84TqA2DqFyW/zTMmj1NVSmCMW9VckcaDoHg3OUhyJ1W3lj5f65uSfBKT3NCR7GtPSvCJrf4FjXPZSz+LzuY4Cn7R4D2fygYTf3kEvu5An3z+XRl83DW6nhYW4dxnINpt0Gest12Juf8XjvGP31E9iOTmE/OEFvqQrL9hsYSzsYLFTgWa/ifmIOFywsnw6e8iVPGN3BBG7FM7gSS+PiZBY9CyV0pQu4vrSBa6/K6Clso2e5gpuLa7icyqMrkUU342/EZnE7kmxxGER+okMS6Yg4W8LmEvzijoTWXITlEc3okDJFg0EWtz+msZIjpQ7YtQ61UxzaKY5RKFa/YheoFwkodoXifiomboXsQ9NQ7JQWRrCOANrEsn+d8sfL6n+9bP7Xy78B/QzPO9OV/CAAAAAASUVORK5CYII=","aspectRatio":1.527027027027027,"src":"/static/b18c94100d3b034bc59158680ab07e07/62b1f/10questions-1.png","srcSet":"/static/b18c94100d3b034bc59158680ab07e07/e7519/10questions-1.png 113w,\n/static/b18c94100d3b034bc59158680ab07e07/7e7e9/10questions-1.png 225w,\n/static/b18c94100d3b034bc59158680ab07e07/62b1f/10questions-1.png 450w,\n/static/b18c94100d3b034bc59158680ab07e07/e2e7f/10questions-1.png 675w,\n/static/b18c94100d3b034bc59158680ab07e07/db955/10questions-1.png 900w,\n/static/b18c94100d3b034bc59158680ab07e07/a8378/10questions-1.png 1024w","srcWebp":"/static/b18c94100d3b034bc59158680ab07e07/b8a88/10questions-1.webp","srcSetWebp":"/static/b18c94100d3b034bc59158680ab07e07/3a3bf/10questions-1.webp 113w,\n/static/b18c94100d3b034bc59158680ab07e07/975bf/10questions-1.webp 225w,\n/static/b18c94100d3b034bc59158680ab07e07/b8a88/10questions-1.webp 450w,\n/static/b18c94100d3b034bc59158680ab07e07/761da/10questions-1.webp 675w,\n/static/b18c94100d3b034bc59158680ab07e07/210c1/10questions-1.webp 900w,\n/static/b18c94100d3b034bc59158680ab07e07/cc834/10questions-1.webp 1024w","sizes":"(max-width: 450px) 100vw, 450px"}}}},"author":{"id":"9257cd1e-ca7f-578b-a2dd-9c2e74282caf","name":"Smokescreen Team"}}},{"node":{"id":"0b6fe724-d0b1-5b1a-a31b-daeeb17e0310","title":"Deception and Kerckhoffs’s Cryptographic Principle","content":"Conceptually, deception is an incredibly intuitive approach to cybersecurity. The parallels between deception in the real-world, and deception in cyberspace are clear and easy to understand. However, in the digital battlefield it’s far more nuanced — it’s easy to do it badly, and far harder to get it right. Which makes it rather similar to a more traditional security practice — cryptography.
\nCryptographers are familiar with a well-known axiom called Kerckhoff’s principle, which states:
\n\nA cryptosystem should be secure even if everything about the system, except the key, is public knowledge.
This was famously paraphrased by Claude Shannon in what is known as Shannon’s Maxim:
\n\n“The enemy knows the system“, i.e., “one ought to design systems under the assumption that the enemy will immediately gain full familiarity with them“
The applicability to deception is immediately apparent. It should remain effective, even when an attacker:
\nHowever, the exact map of the minefield — the specific placement of decoys, their running services, and their content is not known. This deception map is the equivalent of the secret key in a crypto-system. As long as the map is not known to the attacker, the illusion should still remain extremely effective, despite the attacker having complete visibility into the rest of the system.
\nAt Smokescreen, we are laser focused on making sure deception is ‘done right’ — with the necessary rigour and formal reasoning to hold up in real-world conditions. How do we do this? Our depth of experience in related cybersecurity disciplines is our secret weapon. We apply hard earned knowledge from red-teaming, asymmetric thinking, threat hunting, cryptography and incident response to build the most formidable and effective deception system available.
\n","excerpt":"The parallels between deception in the real-world, and deception in cyberspace are clear and easy to understand. However, deception in the digital battlefield is far more nuanced — it’s easy to do it badly, and far harder to get it right. Which makes it rather similar to a more traditional security practice — cryptography.\n","slug":"deception-and-kerckhoffss-cryptographic-principle","date":"2017-02-16T10:50:52.000Z","status":"publish","modified":"2020-01-06T07:05:07.000Z","wordpress_id":16772,"featured_media":{"id":"c7ca7a31-c5f1-5880-8111-9cbfd1198f24","source_url":"https://ss-website-content-prod.s3.ap-south-1.amazonaws.com/wp-content/uploads/2017/02/Enigma-plugboard.jpg","alt_text":"Deception","large":{"childImageSharp":{"fluid":{"base64":"data:image/jpeg;base64,/9j/2wBDABALDA4MChAODQ4SERATGCgaGBYWGDEjJR0oOjM9PDkzODdASFxOQERXRTc4UG1RV19iZ2hnPk1xeXBkeFxlZ2P/2wBDARESEhgVGC8aGi9jQjhCY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2P/wgARCAAOABQDASIAAhEBAxEB/8QAFwAAAwEAAAAAAAAAAAAAAAAAAAMEBf/EABYBAQEBAAAAAAAAAAAAAAAAAAIAAf/aAAwDAQACEAMQAAABQ6NgWaUG3//EABoQAAIDAQEAAAAAAAAAAAAAAAECAAMRBBL/2gAIAQEAAQUC5l8LaodDWwK7DsKHf//EABURAQEAAAAAAAAAAAAAAAAAAAAR/9oACAEDAQE/AUf/xAAVEQEBAAAAAAAAAAAAAAAAAAAAEf/aAAgBAgEBPwFX/8QAGRABAAIDAAAAAAAAAAAAAAAAAQAhAhIg/9oACAEBAAY/AryLibnP/8QAGhABAAMBAQEAAAAAAAAAAAAAAQARITFBYf/aAAgBAQABPyEVqOqJ0KesQFX9GbGx0OTQKn//2gAMAwEAAgADAAAAEDzP/8QAFREBAQAAAAAAAAAAAAAAAAAAARD/2gAIAQMBAT8QCf/EABURAQEAAAAAAAAAAAAAAAAAAAEQ/9oACAECAQE/EFn/xAAbEAEBAAMBAQEAAAAAAAAAAAABEQAhMcFxkf/aAAgBAQABPxAAdtioQ7gVpEDn5kg4eBH5gNDyQ5wxJMSOmeY1IR3LfM//2Q==","aspectRatio":1.4705882352941178,"src":"/static/33488cec05051fdb0cde315fb03b25b1/14b42/Enigma-plugboard.jpg","srcSet":"/static/33488cec05051fdb0cde315fb03b25b1/f836f/Enigma-plugboard.jpg 200w,\n/static/33488cec05051fdb0cde315fb03b25b1/2244e/Enigma-plugboard.jpg 400w,\n/static/33488cec05051fdb0cde315fb03b25b1/14b42/Enigma-plugboard.jpg 800w,\n/static/33488cec05051fdb0cde315fb03b25b1/a1fc1/Enigma-plugboard.jpg 921w","srcWebp":"/static/33488cec05051fdb0cde315fb03b25b1/58556/Enigma-plugboard.webp","srcSetWebp":"/static/33488cec05051fdb0cde315fb03b25b1/61e93/Enigma-plugboard.webp 200w,\n/static/33488cec05051fdb0cde315fb03b25b1/1f5c5/Enigma-plugboard.webp 400w,\n/static/33488cec05051fdb0cde315fb03b25b1/58556/Enigma-plugboard.webp 800w,\n/static/33488cec05051fdb0cde315fb03b25b1/147d5/Enigma-plugboard.webp 921w","sizes":"(max-width: 800px) 100vw, 800px"}}},"medium":{"childImageSharp":{"fluid":{"base64":"data:image/jpeg;base64,/9j/2wBDABALDA4MChAODQ4SERATGCgaGBYWGDEjJR0oOjM9PDkzODdASFxOQERXRTc4UG1RV19iZ2hnPk1xeXBkeFxlZ2P/2wBDARESEhgVGC8aGi9jQjhCY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2P/wgARCAAOABQDASIAAhEBAxEB/8QAFwAAAwEAAAAAAAAAAAAAAAAAAAMEBf/EABYBAQEBAAAAAAAAAAAAAAAAAAIAAf/aAAwDAQACEAMQAAABQ6NgWaUG3//EABoQAAIDAQEAAAAAAAAAAAAAAAECAAMRBBL/2gAIAQEAAQUC5l8LaodDWwK7DsKHf//EABURAQEAAAAAAAAAAAAAAAAAAAAR/9oACAEDAQE/AUf/xAAVEQEBAAAAAAAAAAAAAAAAAAAAEf/aAAgBAgEBPwFX/8QAGRABAAIDAAAAAAAAAAAAAAAAAQAhAhIg/9oACAEBAAY/AryLibnP/8QAGhABAAMBAQEAAAAAAAAAAAAAAQARITFBYf/aAAgBAQABPyEVqOqJ0KesQFX9GbGx0OTQKn//2gAMAwEAAgADAAAAEDzP/8QAFREBAQAAAAAAAAAAAAAAAAAAARD/2gAIAQMBAT8QCf/EABURAQEAAAAAAAAAAAAAAAAAAAEQ/9oACAECAQE/EFn/xAAbEAEBAAMBAQEAAAAAAAAAAAABEQAhMcFxkf/aAAgBAQABPxAAdtioQ7gVpEDn5kg4eBH5gNDyQ5wxJMSOmeY1IR3LfM//2Q==","aspectRatio":1.4675324675324675,"src":"/static/33488cec05051fdb0cde315fb03b25b1/32fd5/Enigma-plugboard.jpg","srcSet":"/static/33488cec05051fdb0cde315fb03b25b1/06e94/Enigma-plugboard.jpg 113w,\n/static/33488cec05051fdb0cde315fb03b25b1/07ab6/Enigma-plugboard.jpg 225w,\n/static/33488cec05051fdb0cde315fb03b25b1/32fd5/Enigma-plugboard.jpg 450w,\n/static/33488cec05051fdb0cde315fb03b25b1/4a838/Enigma-plugboard.jpg 675w,\n/static/33488cec05051fdb0cde315fb03b25b1/9842e/Enigma-plugboard.jpg 900w,\n/static/33488cec05051fdb0cde315fb03b25b1/a1fc1/Enigma-plugboard.jpg 921w","srcWebp":"/static/33488cec05051fdb0cde315fb03b25b1/b8a88/Enigma-plugboard.webp","srcSetWebp":"/static/33488cec05051fdb0cde315fb03b25b1/3a3bf/Enigma-plugboard.webp 113w,\n/static/33488cec05051fdb0cde315fb03b25b1/975bf/Enigma-plugboard.webp 225w,\n/static/33488cec05051fdb0cde315fb03b25b1/b8a88/Enigma-plugboard.webp 450w,\n/static/33488cec05051fdb0cde315fb03b25b1/761da/Enigma-plugboard.webp 675w,\n/static/33488cec05051fdb0cde315fb03b25b1/210c1/Enigma-plugboard.webp 900w,\n/static/33488cec05051fdb0cde315fb03b25b1/147d5/Enigma-plugboard.webp 921w","sizes":"(max-width: 450px) 100vw, 450px"}}}},"author":{"id":"9257cd1e-ca7f-578b-a2dd-9c2e74282caf","name":"Smokescreen Team"}}}]},"costSectionImage":{"childImageSharp":{"fluid":{"base64":"data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAABQAAAANCAYAAACpUE5eAAAACXBIWXMAAAsTAAALEwEAmpwYAAADUklEQVQ4yzWSW2gcZRzFzzcze02y273OfWdnZ3dmr9mmSUsiaaJtV+0lNppaGmukTcEHgygWtS8iKAUFRSEvggj6JoJPPha1j74IfREUBC+ICIKgD2K7mfn7n10dOAzfzHy/Od/5H4xGDVzb6aPSaeeyhl2ZdepW2qx5Sd3qirK2JKnWCaHb56HZO9DMZ4Rm3YBm3YRq7kuq8aFQjU8yVv3LGct5F4AEuVyBVCofl8rqT6xfpKr+h6Sa/0iaSUK3SJgOgSVbdUrbLgmjRtBtYiihqk9VqvLa/A7HH/aAQinWCyiWCWV+UeYPVIM3WRFsNxQ1L4TjhTPNzkGx1T3g9QFDxwwdJwx7LFT9LooVgt34Gucv98ELBpbfQ4kfVrS7SaMWJq16lPH8SHJakahPJTfaLD8SthvBqEXsOso5XsTRhBOH9dbneHzXgmyYMfRWDEzxH3Nei3LNNhUGC5T1+wTXJ+EGJPFdbgTEQJIdj7IshaEczRTY7H6KK88VIfKVOT7u95wd5erNcC4IorQXUL6/QIeGiyS1eiS8DkN9Uvgu1RoTKXG2GsdS1SOUVULn8Pt45Z00RKHiMnCc4CHkXT+aZRfJoEf5zgLlh0skMxDsMHYn11sTh1LskqGp+Oj/AwdHb+LWN0qc3ygeiKyaYY6zyrd7UX7+MBXmj9CMP5g44wxJZqjitlj+ZOoZBiZjYEXj7PV7WFi+LhFxcw4Vn50ORL2Xc1vhXKcb5oJeWOwNo1SzG8FpRiJWrRGBh8XZRXIM0u2I2zB1pxp/4djaVcSXUlE/Ev9VRqgWZdwmzbTapLADxL2zG7HiqYYwWLodcnYhqgZLG087aP2G1dEmllaBREV9OuF4d9Kdwbey3/0x3Rv+qjSD36WG/2cq6P2d6Q7HuaMrlPK7pDiNScEli4tu2qRw7txhLrv9Mx58dA3nLgGnYpubO6s4e2kDDz22JU5uXBHrp/dw36mXxfIDr8srJ96SV+7fTyyvf5BcXPlYHix+JnXmv1Da/a+yQf9Ooub+kPL7t3Hm4hE8chkozWUFntwD1jeQeXVf4MbbCl58IyleejOD51+bxe71Ap7Y07B1zcGFXR9bV+ex+dQx3ryGje0Rzm2fwekL2+yuibMX8S+BMBcPGVLWLQAAAABJRU5ErkJggg==","aspectRatio":1.528735632183908,"src":"/static/739e365bb81f8bf83185927701d2793f/651c0/cost-image-2x.png","srcSet":"/static/739e365bb81f8bf83185927701d2793f/e223a/cost-image-2x.png 133w,\n/static/739e365bb81f8bf83185927701d2793f/66882/cost-image-2x.png 265w,\n/static/739e365bb81f8bf83185927701d2793f/651c0/cost-image-2x.png 530w,\n/static/739e365bb81f8bf83185927701d2793f/a384c/cost-image-2x.png 795w,\n/static/739e365bb81f8bf83185927701d2793f/c884a/cost-image-2x.png 1056w","srcWebp":"/static/739e365bb81f8bf83185927701d2793f/46494/cost-image-2x.webp","srcSetWebp":"/static/739e365bb81f8bf83185927701d2793f/a5ef1/cost-image-2x.webp 133w,\n/static/739e365bb81f8bf83185927701d2793f/4dc00/cost-image-2x.webp 265w,\n/static/739e365bb81f8bf83185927701d2793f/46494/cost-image-2x.webp 530w,\n/static/739e365bb81f8bf83185927701d2793f/5b747/cost-image-2x.webp 795w,\n/static/739e365bb81f8bf83185927701d2793f/950f5/cost-image-2x.webp 1056w","sizes":"(max-width: 530px) 100vw, 530px"}}}},"pageContext":{"id":"141a7972-5983-5910-bb47-f0396dbf162f","relatedPostsIDs":[18772,18716,16912,16901,16772]}},"staticQueryHashes":["1478079672"]}