4 ms·
- What is alerted on (or "attack") is configurable and can range from code being executed (which is the true positive alert) to connecting to ports(which has mo
by ddiinn2 11y ago
- What is alerted on (or "attack") is configurable and can range from code being executed (which is the true positive alert) to connecting to ports(which has more noise)
- It needs to look like the machine an attacker will be after when he's looking around on the network and that's much simpler then a whole loaded up environment.
- Yes, the decoys look like an integral part of the network
- It could be within every segment of the network and not in it's own island. But it's true that every security solution depends on it's management interface not being compromised :)
- wglb 11y agoOne final question. Let's say that an attacking organization fully installs your sensor in their own lab. What is to prevent them from engineering an approach to fully defeat the sensor itself?
- ddiinn2 11y agoLike was said before, you have to attack the decoy to recognize it and that enables catching the attack traffic. Also the mere fact that they recount every single action 10 times over before acting is a huge value in and of itself. On another note I agree that they will try and we will be constantly remembering that fact :)