Organizations struggle to detect adversaries who use legitimate credentials, native tools, and living off the land techniques to conduct discovery, move laterally, and access data.
To that end, cyber decoys are assets that appear to be legitimate systems, accounts, or data, but end up designed to distract adversaries, detect their presence, or facilitate collection of cyber threat intelligence (CTI), according to a guidance entitled “Using Cyber Decoys to Strengthen Detection and Response” from the Cybersecurity and Infrastructure Security Agency (CISA).
Zero Trust assumes no user, device, or network segment is inherently trustworthy and that assumes there is a compromise. Cyber decoys are consistent with this paradigm and provide an additional mechanism to: Validate Zero Trust assumptions by revealing unwanted internal activity; increase detection coverage for post-compromise and living off the land (LOTL) techniques and introduce controlled, high-signal indicators of malicious behavior.
Decoy techniques are incremental, cost-effective, and scalable, allowing organizations to introduce them without major architectural changes.
Because cyber decoy capabilities operate under the expectation that an adversary may gain some level of access to the environment, they can help defenders detect post-compromise behavior earlier, collect CTI, and reduce time to detection.
Cyber Decoy Advantages
When implemented effectively, cyber decoys enable defenders to:
- Detect adversaries operating within the environment
- Gather and analyze cyber threat information (CTI) derived from intrusions and attempted intrusions
- Allocate defensive resources more effectively based on observed adversary behaviors
- Reduce mean time to detection (MTTD) by generating high-fidelity alerts
Chart above is the MITRE Engage 10-Step adversary engagement process.
Source: CISA
This guidance introduces cyber decoy concepts and explains how organizations can use the MITRE Engage framework and MITRE ATT&CK knowledge base to plan decoy operations around adversary tactics, techniques, and procedures (TTPs), organizational risk, and existing security controls, regardless of their cybersecurity maturity level.
Organizations can use the guidance to:
- Understand how cyber decoys complement Zero Trust principles
- Start with lower-complexity techniques, such as tripwires and honeytokens
- Design decoys based on cyber threat information and likely adversary behavior
- Integrate decoy alerts with existing monitoring and incident response processes
- Test and refine decoy operations through threat emulation, red teaming, or purple teaming
Click here to read the full guidance.