3 ms·

a lot of security tools and "platforms" (don't get me started) have deception features now which includes stuff like this. https://learn.microsoft.com/en-us/de

a lot of security tools and "platforms" (don't get me started) have deception features now which includes stuff like this. https://learn.microsoft.com/en-us/defender-xdr/deception-overview https://learn.microsoft.com/en-us/defender-xdr/deception-ove... But in my opinion, deception tech is best implemented in-house. Nothing wrong with using externally developed tools, especially for high signal-to-noise things like honeypots but the actual monitoring and alerting data flow should be ideally be environment specific.

waihtis 2y ago
Super biased (founder of a deception software company) but youre right, deception’s cornerstone is building good quality internal threat data and thus spraying random decoys here and there (a la the platform features you mentioned) will not be of much use.
- notepad0x90 2y ago
  the first rule of deception imho is that it needs to deceive the threat actor, and you should assume that the threat actor has done enough recon to know what makes sense and what stands out in an environment. If you have a canary in a file about a project that doesn't exist or use an external "canarytokens.com" domain the document, that might be a low quality decoy. Tools to automate deployment, maintenance and alerting/integration (SIEMS,etc..) are much more useful. If your company is making deception software, then you already know that Microsoft, Google and similar companies are your competition if your strategy is to do what they do, but I'm sure you've already strategized around all this.
  - waihtis 2y ago
    > Tools to automate deployment, maintenance and alerting/integration (SIEMS,etc..) are much more useful Bingo - between this and not confining yourself into the restrictions of a single platform (what the platform feature vendors have to do - Microsoft deception offers solutions only specific to certain Microsoft infrastructure, etc. ), you can create some terrific outcomes in this domain.
    - notepad0x90 2y ago
      I said "don't get me started" earlier because unfortunately vendor lock in is now a prized feature. I could be wrong but it kind of boils down to CISO's and decision makers looking at how we do things today in security and saying "this too complex, me no get it, me want one thing instead of many, me get that!" (this is why I said don't get me started! lol). I totally support your approach, and I hope your startup succeeds. Although you should really name-drop it here.
      - waihtis 2y ago
        Thank you friend! -> defusedcyber.com Hit me up if you'll be at Vegas hacker summer camp next week and want to get a friendly coffee in, the founders email on the website lands into my mailbox.
mdhb 2y ago
I’m currently in the middle of building one at the moment precisely because of how limited I found canary tokens. I also have a lot of security knowledge (mostly from books rather than practical experience) from non infosec case studies like intel agency operations, insurgent groups, law enforcement, military, organised crime and other scenarios where the consequences of making bad decisions is incredibly high and probably involves some level of violence at a minimum. I always thought that this XKCD comic (https://xkcd.com/538/ https://xkcd.com/538/) summed it up nicely precisely how that factor can actually change your threat model fairly significantly in a way that I don’t generally see turn up in the field of cyber security specifically. But more than that I just generally found that to be an invaluable resource for when it comes to how to think about what actually makes these things work in the real world and what you can actually do in order to really make life very miserable for an adversary long before they even realise what’s going on. It’s probably been the most fun thing I’ve built in 20 years.

waihtis 2y ago

Super biased (founder of a deception software company) but youre right, deception’s cornerstone is building good quality internal threat data and thus spraying random decoys here and there (a la the platform features you mentioned) will not be of much use.

notepad0x90 2y ago
the first rule of deception imho is that it needs to deceive the threat actor, and you should assume that the threat actor has done enough recon to know what makes sense and what stands out in an environment. If you have a canary in a file about a project that doesn't exist or use an external "canarytokens.com" domain the document, that might be a low quality decoy. Tools to automate deployment, maintenance and alerting/integration (SIEMS,etc..) are much more useful. If your company is making deception software, then you already know that Microsoft, Google and similar companies are your competition if your strategy is to do what they do, but I'm sure you've already strategized around all this.
- waihtis 2y ago
  > Tools to automate deployment, maintenance and alerting/integration (SIEMS,etc..) are much more useful Bingo - between this and not confining yourself into the restrictions of a single platform (what the platform feature vendors have to do - Microsoft deception offers solutions only specific to certain Microsoft infrastructure, etc. ), you can create some terrific outcomes in this domain.
  - notepad0x90 2y ago
    I said "don't get me started" earlier because unfortunately vendor lock in is now a prized feature. I could be wrong but it kind of boils down to CISO's and decision makers looking at how we do things today in security and saying "this too complex, me no get it, me want one thing instead of many, me get that!" (this is why I said don't get me started! lol). I totally support your approach, and I hope your startup succeeds. Although you should really name-drop it here.
    - waihtis 2y ago
      Thank you friend! -> defusedcyber.com Hit me up if you'll be at Vegas hacker summer camp next week and want to get a friendly coffee in, the founders email on the website lands into my mailbox.

mdhb 2y ago

I’m currently in the middle of building one at the moment precisely because of how limited I found canary tokens. I also have a lot of security knowledge (mostly from books rather than practical experience) from non infosec case studies like intel agency operations, insurgent groups, law enforcement, military, organised crime and other scenarios where the consequences of making bad decisions is incredibly high and probably involves some level of violence at a minimum. I always thought that this XKCD comic (https://xkcd.com/538/ https://xkcd.com/538/) summed it up nicely precisely how that factor can actually change your threat model fairly significantly in a way that I don’t generally see turn up in the field of cyber security specifically. But more than that I just generally found that to be an invaluable resource for when it comes to how to think about what actually makes these things work in the real world and what you can actually do in order to really make life very miserable for an adversary long before they even realise what’s going on. It’s probably been the most fun thing I’ve built in 20 years.