{"id":10802,"date":"2021-04-08T12:40:47","date_gmt":"2021-04-08T07:10:47","guid":{"rendered":"https:\/\/www.varutra.com\/?p=10802"},"modified":"2022-12-02T13:02:14","modified_gmt":"2022-12-02T07:32:14","slug":"deception-technology-the-art-of-recording-cyber-attacks","status":"publish","type":"post","link":"https:\/\/www.varutra.com\/varutravrt3\/deception-technology-the-art-of-recording-cyber-attacks\/","title":{"rendered":"Deception Technology: The Art of Recording Cyber Attacks"},"content":{"rendered":"

<\/p>\n

Introduction To Deception technology:<\/strong>\u00a0<\/strong><\/h3>\n

Deception technology is a newest strategy to attract cyber criminals away from an enterprise’s true assets and divert them to a trap of decoys which imitate the real assets of the organization to safeguard the real endpoints from external attacks.<\/p>\n

Deception technology imitates genuine assets of the real network infrastructure and is an effective approach to detect the threats proactively with less false positives and minimal performance impact on the network operations.<\/p>\n

 <\/p>\n

Importance of Deception Technology:<\/strong><\/h3>\n

Honeypots were the first form of deception technology and were used in 1990s in order to deceive malicious actors into interacting with a false system. Later, honeypots would gather the attacker data and asses the malicious intent performed. It should be noted that honeypots are limited in scope and it is very easy for an attacker to identify them as the system which will either have no outbound traffic or the traffic will be fabricated and will not typically follow a normal usage pattern. Hence, experienced threat actors can figure out the honeypots very quickly and easily.<\/p>\n

Honeypots were originally intended to allow the security analyst to observe attacks in progress, capture and retain them for further learning. They still serve an important purpose in threat research and can be used effectively for cyber-forensic analysis, threat hunting and analysis, developing responses to malicious behavior. Honeypots may still prove useful, but not as effective as modern deception technology strategy focused on threat detection.<\/p>\n

\"A<\/p>\n

Image Source: <\/em>http:\/\/proceedings.informingscience.org\/InSITE2008\/InSITE08p069-076Hernan422.pdf<\/em><\/a><\/pre>\n
 <\/p>\n
Evolution of Deception Technology:<\/strong><\/h3>\n
Honeypots are labor-intensive and is a passive line of defense, relying on attackers to somehow identify them as high-value targets. They also need to be updated, maintained on a periodic basis which makes them a tiresome solution to maintain.<\/p>\n
Like other technologies, Honeypots also needed an evolutionary leap to cope up with the sophisticated attacks. Hence the latest Deception Technology is built on the idea of Decoys by redirecting hackers towards fake assets where the real endpoints stay protected.<\/p>\n
\"EvolutionImage Source: <\/em>https:\/\/www.wwt.com\/article\/deception-technology<\/em><\/a><\/pre>\n
 <\/p>\n
Benefits of Deception Technology:<\/strong><\/h3>\n
The primary aim of Deception technology is to prevent a cyber-criminal that has managed to infiltrate a network from performing any malicious act. It often uses a mix of lures to trick attackers, and then refreshes or updates themselves in attracting attackers.<\/p>\n
The technology works by generating decoys that imitate legitimate technology assets throughout the network infrastructure. The decoys can run in a virtual or real operating system environment. They are designed to trick the cyber-criminals into thinking that they have discovered an organization’s asset and has the access to escalate privileges and steal credentials.<\/p>\n
Once a trap is triggered, alerts are sent to a centralized deception server that records the affected decoy and the attack vectors that were used by the cyber-criminal which can be further used for the analysis.<\/p>\n
Decoys are often made to look authentic using artificial intelligence and it will have common network naming conventions and it also includes shared folders and drives to create false activity trails which mimics the actual behaviour of an endpoint.<\/p>\n
\"BenefitsImage Source : The rapid evolution of deception technologies, NTT Security<\/em><\/pre>\n
Deception technology provides numerous benefits when it comes to early detection of intruders, which is the key to minimize impact of future cyber-attacks. Adding decoys to an organization’s network can give the security team upper hand in terms of detection speed and grant access to valuable information needed for the analysis of the security incident.<\/p>\n
Several benefits of implementing Deception technology also include:<\/p>\n