In the first episode, we have seen what is deception technology. Let’s discover how to get started.

Deployment

Deploying deception technology is not as straightforward as it seems. Of course, technical details will need to be addressed for the installation to be successful, depending on the technology used:
• IP addresses and DNS hostname for the honeypots, as they must look as they are legitimate part of your domains
• Secured DMZ to ensure the attacker cannot use your honeypot as another foothold or pivot point
• The actual cost of maintaining these new devices must also be considered If you want to install several decoys into your infrastructure, an orchestration system might be needed
• And at every steps, you must ensure that the monitoring is adequate and the alerts forwarded to your other security endpoints (SIEM), and that the analysts are aware of the deployment

But prior looking at these technicalities, a preparation phase must be undertook. Indeed, in order to have a deception system working as its greatest potential, the installation must fit into your company. For example, having a server named deceptionServer will not be very efficient when all the other servers are named following a given convention, such as srv-prod-00n. Likewise, if the honey credentials do not adhere to the company terminology (admin-fake). Being too obvious will be counterproductive for your deception devices.

Moreover, once all the requirements are fulfilled and the platform deployed in your infrastructure, you will still need another grace time to identify the remaining legitimate interactions that can raise false positives. Think on regular, automatic internal vulnerability scans, chances are high that these scans will trigger a honeypot.

Advantage and Drawback over classical cybersecurity technology

The main advantage of deception technology lies in its false positive rate, which, once the grace time is over, should be low if not null. Indeed, deception by design means that regular users should never initiate even a single connection to a honeypot, and that honey credentials should never be used.
Another advantage is that it enables your security teams to use their knowledge of your infrastructure to build their own defense, where attackers will always need some reconnoitering to identify their next targets.
However, deception technology has also some drawbacks. Keep in mind that deception technology is just another tool in the Defense in Depth approach, and should always be used in conjunction with classic cybersecurity technology. Indeed, deception is based on decoys, simulated services or fake documents. If an attacker manages to compromise the enterprise without interacting with any decoys, the only way to detect it is by traditional methods.

Deception classical use case

Deception technology white paper could be summarized like this:

• Target
Medium and big size company looking to improve their cyber-defense capacity. Already having a cybersecurity infrastructure, this company should already have a SIEM to process alerts. Deception technology is most useful when the security posture in place is already high.

• Requirements
Sensors and artefacts deployed in the company network. These decoys must look like real assets, thanks to a detailed analysis phase done beforehand. If your strategy involves multiple deception devices and decoys, an orchestration platform might be needed to easy deployment and maintenance.

• Use-case
Attacker caught by decoys are in their reconnoitering phase, trying to find vulnerable services. Or they are already trying to move laterally, and will need credentials. They might alternatively connect to honeypots use fake data found on the infrastructure, either triggering documents metadata by simply opening them, or using their content.

• Alerts processing
Once triggered, logs generated must contain enough information to identify an attacker and the breach pattern, and the alerts categorized accordingly. These logs must be sent to a SIEM or any centralized, correlation platform available.
As the false positive rate should be low, security analysts should put a high priority on these alerts. However, if the analysis still returns a false positive, the reason need to be identified and remediated. True positives should lead to immediate actions to disrupt the attack.

Conclusion

Gartner previsions regarding deception technology say that, “by 2022, 25% of all threat detection and response projects will include deception features and functionality”. This confirms the actual interest we observed lately in related products. The likelihood for deception technology to grow and become present in many cybersecurity projects is therefore strong.
The corollary is that attackers will start to expect deception technology, and will learn to identify and avoid it. As every security tool in the Defense in Depth approach, we can expect interesting developments in the next years in this trending field.