The knife cuts both ways. Since most people don't look up, it's a good place to be when you're conducting surveillance. The rest of this is security theater br

The knife cuts both ways. Since most people don't look up, it's a good place to be when you're conducting surveillance. The rest of this is security theater brought to you by Kevin McAllister. A trap needs to either contain or kill the prey to be effective. Canary objects do neither and are a waste of fucking time; if the predator isn't interested in your bait enough to trip anything, you're going to assume you're safe when in reality you just failed to anticipate their behavior and appetite. The competent ones already know to check for sandboxed environments. There are only so many ways in and out of your environment. Anybody intruding got in somehow, and will attempt to exfiltrate something or call home for payloads or further instructions at some point. Be the apex predator-- look up. Position yourself to stalk them from above by getting your network logs in order and implementing DPI. Be able to account for where the intruder came from, where they went, and how they exited. Your CISO will ask you these questions when you report that there was an intrusion. Being able to identify which canaries were molested provides zero actionable intelligence.