Cyberstudy
PDF p.202 In progress

Deception Technologies

Open PDF at p.202 19 flashcards

Summary

PDF p.202

Deception and disruption technologies are cybersecurity tools designed to detect and defend against attacks by increasing the cost of attack planning for threat actors. These tools include honeypots, honeynets, honeyfiles, and honeytokens, which help monitor attacker activity, gather intelligence, and divert attention from real systems.

In plain words

Supplementary — not from your PDF

Deception technologies are decoys that detect and study attackers. A honeypot is a fake system, a honeynet is a fake network, a honeyfile is a fake sensitive file, and a honeytoken is fake data or credentials that raise an alert when used. Nobody legitimate should touch them, so any interaction is a strong signal. Disruption techniques such as bogus DNS entries, decoy directories and DNS sinkholes raise the cost of attacking.

Detailed explanation

PDF p.202
  • Honeypots
    • Definition: Decoy systems that mimic real systems and applications.
    • Purpose: Monitor attacker activity and gather information about their tactics and tools.
  • Honeynets
    • Definition: A network of interconnected honeypots simulating an entire network.
    • Purpose: Provide a more extensive and realistic environment for attackers to engage with.
  • Honeyfiles
    • Definition: Fake files that appear to contain sensitive information.
    • Purpose: Detect attempts to access and steal data.
  • Honeytokens
    • Definition: False credentials, login credentials, or other data types.
    • Purpose: Distract attackers, trigger alerts, and provide insight into attacker activity.
  • Benefits
    • Detection and Monitoring: Identify and monitor attacks.
    • Intelligence Gathering: Collect information about attackers and their methods.
    • Proactive Defense: Defend against future attacks.
    • Diversion: Divert attackers' attention from real systems, reducing the risk of successful attacks.
  • Disruption Strategies
    • Purpose: Raise the attack cost and tie up adversary's resources.
    • Examples
      • Bogus DNS Entries: List multiple non-existent hosts.
      • Decoy Directories: Configure web servers with multiple decoy directories or dynamically generated pages.
      • Port Triggering/Spoofing: Return fake telemetry data to slow down port scanning.
      • DNS Sinkhole: Route suspect traffic to a honeynet for analysis.

Important terms

taken from the text above
Honeypots
Decoy systems that mimic real systems and applications.
Honeynets
A network of interconnected honeypots simulating an entire network.
Honeyfiles
Fake files that appear to contain sensitive information.
Honeytokens
False credentials, login credentials, or other data types.
Detection and Monitoring
Identify and monitor attacks.
Intelligence Gathering
Collect information about attackers and their methods.
Proactive Defense
Defend against future attacks.
Diversion
Divert attackers' attention from real systems, reducing the risk of successful attacks.
Bogus DNS Entries
List multiple non-existent hosts.
Decoy Directories
Configure web servers with multiple decoy directories or dynamically generated pages.
Port Triggering/Spoofing
Return fake telemetry data to slow down port scanning.
DNS Sinkhole
Route suspect traffic to a honeynet for analysis.

Examples & real-world scenarios

Supplementary — not from your PDF
  • A fake 'passwords.xlsx' honeyfile that alerts when opened.
  • A decoy admin account whose use triggers an alarm.
  • A DNS sinkhole redirecting known-bad domains to an analysis host.

Scenario

An alert fires because someone used a honeytoken account that isn't used for anything real. The SOC now knows an intruder has harvested credentials, even though no real system has been touched yet.

Common mistakes

Supplementary — not from your PDF
  • Connecting honeypots to production so they become a way in.
  • Mixing up honeyfiles (fake files) and honeytokens (fake credentials or data).

Practical skills

Supplementary — not from your PDF
  • Plan where to place honeytokens for early warning.

What I should remember

Key Points PDF p.202
  • Honeypots
    • Decoy Systems: Mimic real systems.
    • Monitor Activity: Gather attacker information.
  • Honeynets
    • Network of Honeypots: Simulate entire network.
    • Engagement: Realistic environment for attackers.
  • Honeyfiles
    • Fake Files: Detect data access attempts.
    • Sensitive Information: Appear valuable.
  • Honeytokens
    • False Credentials: Distract and trigger alerts.
    • Insight: Provide attacker activity information.
  • Disruption Strategies
    • Raise Attack Cost: Tie up resources.
    • Examples: Bogus DNS, decoy directories, port spoofing, DNS sinkhole.