The COVID-19 pandemic has caused several cyberattacks in new and unexpected ways and on a massive scale. Especially, the sudden change of many industries to remote work or work from home provided an instantaneous advantage and opportunity to cybercriminals. In ransomware attacks on workforce connected to corporate resources from unsecured home networks and devices. Throughout 2020, these malicious actors tried to identify and exploit employees and they will continue it in 2021. Social engineering has been the starting point of the majority of ransomware attacks. Social engineering strategies, such as phishing can fool users into disclosing sensitive information.
Deception technology helps companies to quickly create a fictitious IT network that deploys alluring decoys that prevent cybercriminals from identifying the traffic and resources used within the real network. This deceptive network is then effectively integrated into the current IT infrastructure in order to reveal itself to attackers. Deception technology takes into account the attacker’s view and strategy which is used to abuse and explore networks of information recognition and exfiltration.
Following points should be considered before buying Deception Technology-
- Vendors must understand client’s goals and objectives when it comes to deception
- Vendors should study and understand client’s current technological infrastructure
- Deception solution be built to understand attacker techniques, tactics and methods
- Deception solution should be designed by incorporating the identified goals, technology and attacker tactics
- Deception solution implemented should be reviewed and updated regularly to address new technology changes and objectives
Companies need to check that the deception solution covers all from endpoint to complex cloud environment for maximum protection. In addition, what kind of disappointment lures vendor provides. An ideal solution provides IT network, server, database, endpoint, applications, cloud and OT decoys, some vendors offer only a number of them. Companies need to check how these deceptions systems are used and whether they are manually or automatically updated. The level of customization also plays a crucial role.
The Level of Interaction to Deceive Attackers
The deception solution only works if it is able to mislead attackers. Real-time operating systems and networks can be custom-made. Consider asking solution providers whether their systems create or use emulated decoys for the actual operating system. The capacity to play and understand an attacker increases as the level of interaction of deception resources used increases. Greater interaction gives the cyber criminals more real experience and offers security teams a better and detailed approach to analyse attacker activity. It also increases their ability to develop enhanced deception environments. Various technical parameters like ensuring that active decoy directory entries are consistent with the real Active Directory should be checked. Cyber deception is a detection method. It is less to useful detect attacks without the ability to respond effectively. This makes it compulsory to create robust, documented incident response processes in deception solutions.
Cyber Criminal Use Cases
If an intrusion is identified, the attackers can be enclosed and observed successfully with minimum or no danger to the true system. However, Deception technology allows security experts to gain insights from the behaviour of an attacker and denies them the opportunity to apply crime data to strengthen security systems. Based on cyber criminals’ activities vendors have created cybercriminal use cases. These use cases are used to improve deception solution.
Scalability and Automation
The technology of deception adds decoys and controls so that the problems can be detected. Scalability is the design and implementation of an authentic set of decoys in an extensive infrastructure. Once these Deceptive resources are installed, companies can manage and update them regularly to maintain realisticness. The processes of generating, deploying, and running deceptive solutions have been significantly simplified by machine learning. Thus vendors with scalable and automated deception solutions should be considered.
If there is a ransomware attack deceptive resources are attacked thus saving real resources from attack. This is a huge advantage over other security solutions. Sectors such as education, health care and government need assistance in their fight against ransomware. Deception technology is useful in the detection of movement and minimizes damage.
