Cyber Defense Magazine Global Edition for 2019

a wide range of devices that include medical
devices, printers, surveillance systems, energy
substations, and more.
Active Directory:
In addition to providing Active Directory (AD)
decoys, a modern innovation in deception adds
attack prevention with the ability to intercept
queries to AD, hide real data and system users,
and insert deceptive results without interfering
with production AD. This level of deception is a
new and extremely valuable tool for a defender’s
arsenal.
Attack Path Visibility:
Given the ability to learn the network, deception
tools also provide visibility to misconfigurations
and exposed credentials at the endpoints. This
insight, not found in other vulnerability
assessment tools, helps minimize risk by
reducing the available attack surface and
automating remediation of exposures.
Fidelity-Alerts and Company-
Specific Threat-Intelligence:
Deception alerts have exceptional signal-tonoise-ratios
since they activate on attacker
engagement. Plus, the high-interaction
deception environment gathers companyspecific
threat intelligence by recording activities
and policy violations and for safely studying the
attack and collecting Tactics, Techniques, and
Procedures (TTPs). Native integrations (firewall,
SIEM, NAC, EDR, and orchestration tools) also
extend existing security solution value and
facilitate automated blocking, isolation, and
threat hunting.
accurate detection that requires minimal
operational overhead. mMature organizations
increase efficiencies in threat detection and
investigation, as well as valuable context for
triage. Advanced organizations achieve strategic
advantages in building pre-emptive defenses,
automating intelligence gathering and incident
response playbook operations.
Standards are also incorporating deception:
• The National Institute of Standards and
Technology (NIST) draft policy 800-171b
recommending deception for High-Value
Assets holding sensitive information.
• The US Department of Energy granted
funds to Pacific Northwest National Labs,
in partnership with Attivo Networks to
create a deeper level of deception for
cyber-physical-systems.
• The Global Cyber Alliance (GCA) AIDE
Platform enables IoT Device
manufacturers to test security, identify
and mitigate global attack risks in
conjunction with Attivo Networks.
With the cyber battlefield moving inside the
network, deception and the act of setting traps
for one’s adversary has quietly taken its place
within the security stack. It is accurate,
nonintrusive, and reliably detects in areas and
works in ways that other security controls simply
do not. And don’t be deceived; although it is
deceptively simple to operate, it is also
deceptively lethal for both human and automated
adversaries.
Organizations of all sizes are benefitting from
deception-based detection. Smaller
organizations gain immediate value with
39