Digital Tripwire: Detecting Threats with Deception

During a digital intrusion, most attackers look for the quickest and easiest way to traverse and compromise your digital infrastructure. Deception-based detection responds to this by placing traps—such as honeytokens, honey accounts and honeypots—to catch the intruder in the act.

Target audience

Are you responsible for—or closely involved in—setting up detection within your organisation? Does your organisation already have a solid detection baseline and are you looking to improve visibility of incidents through the use of digital deception? Read this article to take your first steps.

Deception-based detection

During a digital intrusion, most attackers look for the quickest and easiest way to move through and compromise your digital infrastructure. They are keen to exploit misconfigured environments, poorly secured files, stolen credentials and vulnerable systems. Your digital resilience is centred on keeping attackers away from these assets. But what if we turned this around and deliberately used them to expose the attacker?

With deception-based detection, you place traps in your digital environment: realistic fake assets (decoys) designed to entice interaction from attackers. Think of poorly secured admin accounts (honey accounts), easily accessible sensitive files (honeytokens), or vulnerable systems (honeypots). As soon as someone interacts with these decoys, an alert is triggered. These decoys are not part of normal business operations, so any interaction provides a strong indication of suspicious activity.

Deception-based detection is a valuable addition to standard signature-based and anomaly-based detection solutions. Deception techniques can be deployed more precisely and exploit attackers’ curiosity. Detection is only valuable if an organisation also has the capacity to respond to alerts.

Applications of deception in cyber security

There are many ways deception can be used to strengthen your digital resilience, including:

• Placing honeywords, such as fake email addresses, in datasets to identify data breaches.
• Slowing down automated ransomware attacks by directing them to interact with fake file systems.
• Studying attackers to gather cyber threat intelligence.
• Detecting cyberattacks early and reliably.

Each of these applications comes with its own challenges and requirements. For instance, collecting cyber threat intelligence through deception requires a complex, realistic fake environment (a honeypot) to keep attackers engaged over time. Detecting attacker patterns using deception techniques is, by comparison, more accessible and cost-effective.

More than honeypots

Deception is not a new concept in cyber security. As early as the 1990s, there was extensive experimentation with honeypots—from low-interaction honeypots, which simply respond to network traffic, to high-interaction honeypots that aim to simulate realistic network behaviour. The term “honeypot” was chosen to emphasise that the deception must be irresistible to an attacker (like honey to a bear).

For many professionals, deception is still synonymous with (only) honeypots. This is a missed opportunity, as over the past decade deception has evolved into a set of technologies and tactics that address and complement many of the limitations of traditional honeypots. The rise of honeytokens and honey accounts, automated decoy generation, and management tools makes it possible to deploy deception at scale and address all facets of a digital attack.

Further reading

If you would like to learn more about how deception-based detection can be used and how to get started, read the article “Getting started with deception for detection.” If you already have a good understanding of deception for detection and want to know how to apply it more effectively, read the in-depth article on the subject. You can also explore the three main forms of deception-based detection: honeypots, honey accounts and honeytokens. These articles explain how to deploy each of these effectively within your organisation to strengthen your detection capabilities.

In collaboration with

Architects, consultants, specialists and researchers in the field of deception and deception-based detection from DeepBlue Security, DTACT, Fortinet, Gartner, GriffinGuard, PwC NL, SecurityHive, Thinkst Canary and TU Delft.

Source: NCSC.nl

Photocredits: Istock/Khaosai Wongnatthakan