In this lesson,
we'll discuss four ways you
can begin to outsmart threat actors.
Attackers are everywhere
and they're always out to get you,
especially if you or your organization
have something of interest
like sensitive information, digital assets,
or simply resources that can be stolen.
If you find that you are always reacting
instead of focusing on a proactive defense,
you'll be missing out on a lot of valuable information
and always be operating in a reactionary mode.
Instead, to really increase your cyber resilience,
you must be more proactive
by understanding countering threat actors
through a continuous process.
One of the most effective ways to learn
from the different threat actors that are
attacking your network is to set up
and utilize deception and disruption technologies
like honeypots, honeynets, honeyfiles, and honeytokens
to log, monitor and track threat actors
so that we can learn
about their tactics, techniques, and procedures.
Now, the collection of tactics,
techniques and procedures used
by giving threat actor are usually referred
to as a type of adversary or a threat actor's TTPs.
Tactics, techniques, and procedures
or TTPs refer to the specific methods
and patterns of activities or behaviors associated
with a particular threat actor or group of threat actors.
These TTPs present how a given adversary operates
can be used by your cybersecurity professionals
to detect, mitigate and counter
the attacker's cyber threats.
But how can cybersecurity researchers
and professionals learn the different
tactics, techniques and procedures
used by each different type of threat actor?
That is where deception
and disruption technologies get implemented
within our enterprise networks.
Deception and disruption technologies
are designed to mislead, confuse
and divert attackers away from critical assets
while simultaneously detecting and neutralizing threats.
By creating a dynamic environment
or presenting false information.
these technologies can delay
and deter adversaries
giving organizations an upper hand
in identifying countering malicious activities.
The four commonly used deception and disruption
technologies are honeypots, honeynets,
honeyfiles, and honeytokens.
First, we have honeypots.
A honeypot is a decoy system or network set up
to attract potential hackers.
Honeypots are used to mimic a real system
with vulnerabilities that seem attractive to attackers.
The primary purpose of a honeypot is not to block
or prevent attacks, but is instead focused
on gathering information about the attacker's
methods, motives, and TTPs.
These honeypots can also be used against insider threats
to detect internal fraud, snooping, and malpractice
and they can be configured to work
as an actual network or simulated network
using an emulation application.
Our honeypots are designed to log all interactions
and transactions in order to provide valuable insights
into the threat landscape.
These honeypots are critical
to helping cybersecurity researchers identify the new types
of attacks, malware and other threats being seen
on the internet before they become a widespread problem
for our enterprise networks.
If you are going to install a honeypot
on your enterprise network,
you should locate it
within a screen subnet of the network or an isolated segment
of the network that can be easily accessed
over the internet by a potential attacker.
Second, we have honeynets.
A honeynet is essentially a network
of honeypots to create a more complex system
that is designed to mimic an entire network of systems
including servers, routers, and switches.
Honeynets are often used by a large organizations
and research institutions to study the behavior
of threat actors
in a more controlled environment like a honeypot.
A honeynet logs all activities to provide us
with a wealth of data about both the successful
and unsuccessful attacks being attempted against our network
so that we can reveal patterns in the attack
vectors to help our security teams develop a more
effective defense to counteract new TTPs
being observed in the honeynet.
When you think about honeypots and honeynets,
I want you to remember that while they can both be
used to help your organization improve
its security systems,
there is a risk that the attacker could use the honeynet
and its honeypots to learn how your production
systems are also configured,
which make this a double-edged sword when implemented
as a part of your security architecture.
Third, we have honeyfiles.
A honeyfile is a decoy file placed
within a system to lure in potential attackers.
A honeyfile should appear to contain valuable
or sensitive information that will entice a threat
actor to go after the data,
but in reality, it serves as a trap
and contains fake data
and hidden metadata or digital watermarks in the file
to attempt to enumerate the attacker's own network.
When an attacker accesses the honeyfile,
an alert is triggered that notifies the security team
of the intrusion,
and some honeyfiles have embedded code
that allows them to begin enumerating the attacker's network
once the file is open
on a computer connected to their attack network.
When it comes to honeyfiles,
these can be created using any type of file you want
including word processing documents, spreadsheets,
presentation files, images, database files,
or even executables.
These honeyfiles are typically embedded
with unique identifiers or watermarks
to help track the file
if it is stolen or copied,
and are usually placed
under loose or less strict defenses that files
that contain actual sensitive data might have.
Fourth and finally, we have honeytokens.
A honeytoken is a piece of data
or a resource that has no legitimate value or use,
but is monitored for access or use.
A honeytoken could be a fake user account,
a bogus URL, or a dummy database record.
If the honeytoken is accessed or used,
this is a clear indication
that a security breach is likely occurring.
Honeytokens are particularly useful
for detecting insider threats.
Since they have no legitimate use,
any interaction with them is suspicious.
For example, you may create a user account
called Admin or Route on a window system,
and if someone tries to log in with that account,
you know that they're attacking you
since no legitimate user would ever log into that account
since it was only created to be used as a honeytoken.
These honeytokens can also help with the identification
of any data leak pathways
and provide us
with an early warning of a potential data breach.
In addition to the deceptive technologies we covered
of honeypots honeynets, honeyfiles and honeytokens,
we also could use some disruption technologies
and strategies to help secure our enterprise networks
like using bogus DNS entries, creating decoy directories,
generating dynamic pages to slow down web crawlers,
using port triggering to hype services,
and spoofing fake telemetry data
during a detected network scan.
First, we have bogus DNS entries.
Bogus DNS entries are fake domain name system
entries introduced into your system DNS server.
By adding these deceptive entries,
administrators can mislead attackers
into accessing non-existent domains
or trap systems to waste the attacker's time
and resources while simultaneously alerting the defenders
about potential malicious activities.
Second, we can create decoy directories
to disrupt the attackers.
Decoy directories are fake folders
and files placed within a system storage.
When unauthorized user attempts to access or modify
these directories, the system can raise an alert
and the attacker is misled by false data
and made to think that they have successfully gained access
to your organization's genuine resources.
Third, we have dynamic page generation.
By generating dynamic pages,
websites can present ever-changing content
to web crawlers to confuse
and slow down the threat actor.
This tactic can be especially effective
against automated scrubbing tools or bots trying to index,
or steal content from your organization's website.
Fourth, we have the use of port triggering to hide services.
Port triggering is a security mechanism where
specific services or ports on a network device remain closed
until a specific outbound traffic pattern is detected.
Once the pattern is observed,
the service or port is opened temporarily.
This method ensures
that certain services remain invisible and inaccessible
to potential attackers scanning for open ports,
but become available for legitimate users when needed.
Fifth, we have spoofing fake telemetry data.
When a system detects a network scan is being attempted
by an attacker, it can be configured to respond
by sending out fake telemetry or network data.
This data can be used to confuse an attacker
and make it more challenging
for them to understand the network's real layout,
and prevent them
from being able to identify genuine vulnerabilities
in your systems.
For example, if my system detected
that you are running a network against it,
it might report
that I'm using Windows 11 instead of the macOS system
I'm really using.
This way, if you're trying to use a Windows 11 exploit
against my system, it would fail
because I'm not actually running Windows
by your scan was tricked into believing I was
since I sent back the fake telemetric data.
So remember, deceptive and disruptive technologies refer
to a set of tools
and strategies designed to mislead potential attackers,
and hinder their malicious activities
within a system or network
such as honeypots honeynets, honeyfiles, honeytokens.
A honeypot is a decoy system set
up to lure cyber attackers,
allowing defenders to study their actions
without any real world consequences.
Similarly, a honeynet is an entire network
of such deceptive systems that mimic a real world
environment to attract analyze attackers behaviors.
A honeyfile is a decoy file that appears
to be genuine data,
but it's really just a watermarked
file that can be used to detect unauthorized access.
Lastly, a honeytoken is a digital entity such
as the fake password
or user credential that when used triggers
an alarm signaling a potential security breach.
These technologies allow organizations to lure
and threat actors, learn their TTPs,
and then develop more effective countermeasures.
While these tools do not replace traditional
security measures, they add an extra layer
of defense by turning the tables
on attackers and allowing us to hunt them
and remove them from our networks.