3 ms·

Super biased (founder of a deception software company) but youre right, deception’s cornerstone is building good quality internal threat data and thus spraying

Super biased (founder of a deception software company) but youre right, deception’s cornerstone is building good quality internal threat data and thus spraying random decoys here and there (a la the platform features you mentioned) will not be of much use.

notepad0x90 2y ago
the first rule of deception imho is that it needs to deceive the threat actor, and you should assume that the threat actor has done enough recon to know what makes sense and what stands out in an environment. If you have a canary in a file about a project that doesn't exist or use an external "canarytokens.com" domain the document, that might be a low quality decoy. Tools to automate deployment, maintenance and alerting/integration (SIEMS,etc..) are much more useful. If your company is making deception software, then you already know that Microsoft, Google and similar companies are your competition if your strategy is to do what they do, but I'm sure you've already strategized around all this.
- waihtis 2y ago
  > Tools to automate deployment, maintenance and alerting/integration (SIEMS,etc..) are much more useful Bingo - between this and not confining yourself into the restrictions of a single platform (what the platform feature vendors have to do - Microsoft deception offers solutions only specific to certain Microsoft infrastructure, etc. ), you can create some terrific outcomes in this domain.
  - notepad0x90 2y ago
    I said "don't get me started" earlier because unfortunately vendor lock in is now a prized feature. I could be wrong but it kind of boils down to CISO's and decision makers looking at how we do things today in security and saying "this too complex, me no get it, me want one thing instead of many, me get that!" (this is why I said don't get me started! lol). I totally support your approach, and I hope your startup succeeds. Although you should really name-drop it here.
    - waihtis 2y ago
      Thank you friend! -> defusedcyber.com Hit me up if you'll be at Vegas hacker summer camp next week and want to get a friendly coffee in, the founders email on the website lands into my mailbox.

notepad0x90 2y ago

the first rule of deception imho is that it needs to deceive the threat actor, and you should assume that the threat actor has done enough recon to know what makes sense and what stands out in an environment. If you have a canary in a file about a project that doesn't exist or use an external "canarytokens.com" domain the document, that might be a low quality decoy. Tools to automate deployment, maintenance and alerting/integration (SIEMS,etc..) are much more useful. If your company is making deception software, then you already know that Microsoft, Google and similar companies are your competition if your strategy is to do what they do, but I'm sure you've already strategized around all this.

waihtis 2y ago
> Tools to automate deployment, maintenance and alerting/integration (SIEMS,etc..) are much more useful Bingo - between this and not confining yourself into the restrictions of a single platform (what the platform feature vendors have to do - Microsoft deception offers solutions only specific to certain Microsoft infrastructure, etc. ), you can create some terrific outcomes in this domain.
- notepad0x90 2y ago
  I said "don't get me started" earlier because unfortunately vendor lock in is now a prized feature. I could be wrong but it kind of boils down to CISO's and decision makers looking at how we do things today in security and saying "this too complex, me no get it, me want one thing instead of many, me get that!" (this is why I said don't get me started! lol). I totally support your approach, and I hope your startup succeeds. Although you should really name-drop it here.
  - waihtis 2y ago
    Thank you friend! -> defusedcyber.com Hit me up if you'll be at Vegas hacker summer camp next week and want to get a friendly coffee in, the founders email on the website lands into my mailbox.