With multiple security point products and systems set up to monitor identity, authorization, and activity, the number and frequency of alerts can quickly become overwhelming. It can cause IT teams to react to warnings they don’t need to and fail to act on crucial alerts.
Cyber deception technology, including QR codes, lures attackers to interact with fake assets and distracts them from real ones. It decreases their dwell time on an enterprise network and gives IT teams more time to respond to threats.
How Does It Work?
When hackers enter a corporate perimeter, deception technology acts as an additional layer of defense-in-depth to limit the harm they may cause. How deception technology works? It uses phony systems, or decoys, that imitate tangible technological assets throughout an organization’s infrastructure to entice and divert attackers away from sensitive data or assets.
It also uses fake user paths, files, services, OT/IoT, IO, DA, and other resources that look identical to production assets. The result is a simulated attack surface that gives defenders the upper hand by lowering attacker dwell time while improving alerting times for security teams to respond to threats.
The premise is simple: attackers penetrate networks to steal data and move laterally, naturally targeting the most valuable assets they can find. As they move laterally, they drop backdoors to maintain persistence and gain access to critical systems for extended periods.
While moving laterally, they must choose the next target of their choice – this is where deception technology comes into play. By deploying a sea of false assets that look like the high-value systems they are after, they get duped into interacting with them. As they fumble around the ruse, trying to attack the traps and decoys, their behavior is monitored to identify critical indicators of compromise (IOCs) and tools, techniques, and procedures (TTPs). These can then be used to stop attacks in progress.
What Are the Benefits?
As a security strategy, deception technology shifts the burden of success to the attacker. Once a network is populated with fake assets, the attacker must conduct a flawless attack without interacting with any traps, misdirecting, or triggering detection controls to succeed. A single mistake will hand the defenders a win.
In addition, deception solutions do not produce the false positives associated with most behavior-based detection systems. It means that teams can stop tuning out alerts and wasting valuable resources on convoluted triage workflows and instead focus on analyzing forensically relevant alerts with high confidence that they are identifying real threats.
The low false-positive property of deception also helps reduce attacks’ Mean Time To Detect (MTTD). Since deception is scalable and can be deployed in various locations, it leaves the attacker minimal room to maneuver once they breach the network. It drastically reduces the dwell time and can help to shave months off the typical attack timeline.
For CISOs seeking to move the needle on their detect, know and respond metrics, or for security teams drowning in a sea of false positives, deception is an essential tool that can make all the difference. It can provide a reliable way to gain a foothold in the attack surface, observe their TTPs and even detect the stealing of files or data destruction.
What Are the Drawbacks?
Deception technology is different than other cybersecurity tools because it doesn’t depend on pattern matching and signatures that often lead to false positives and alert fatigue. Instead, it deploys realistic-but-fake assets (decoy domains, servers, applications, files, credentials, sessions, and more) across the network that attackers cannot distinguish from the real thing. A silent alarm is raised if they interact with a decoy, and the systems capture information on the attack. This approach drastically reduces what is known as dwell time, or the amount of time an attacker remains undetected inside the organization’s network.
When the attack is detected, an alert is sent to a security information and event management system (SIEM) or threat intelligence platform to inform them of the incident and identify the attacker. The alert can then be analyzed for further insight, and the attacker can be isolated. The decoys can also be used as bait to lure an attacker into a trap and observe their activities in a controlled environment.
The deception system requires many traps to be effective and strategically deployed throughout the enterprise environment. They must also be managed and refreshed at scale across thousands of endpoints, ideally from a single console. This scalability is essential for delivering high-fidelity alerts, tracking an attacker, and providing threat intelligence.
What Can I Do With It?
Deception technology aims to prevent cybercriminals that have successfully breached your network from causing significant damage. It lays a minefield of attractive decoy systems and data that mimic legitimate technology assets throughout your infrastructure. When attackers try to access these decoys (including fake credentials and information), an actual alert is generated, and the attack is detected, recorded, and stopped before it can do much harm. It can dramatically reduce dwell time, or the amount of time an adversary spends in your environment, and it helps to eliminate alert fatigue by providing high-fidelity alerts that are highly relevant and accurate.
As a bonus, these decoys can help you understand the tactics, techniques, and procedures your adversaries use by allowing you to observe their attempts at gaining access to natural systems. It can be conducive for detecting APTs, zero-day attacks, reconnaissance, lateral movement, and malware-less attacks like social engineering and man-in-the-middle.
The best deception technologies are designed to scale, able to be deployed across thousands of endpoints, and managed centrally. They use a combination of traps and lures strategically integrated among natural IT resources and can be customized for specific business functions or regions. They also have a low false positive rate so that when they are triggered, the alert is valuable and actionable.
