CISA promotes a fresh way to deter cyberattackers: Lie to them
The 22-page guide says decoys can help teams detect intruders and divert them from valuable systems, especially at under-resourced organizations.
- The Infrastructure Security Agency published guidance on Wednesday, "Using Cyber Decoys to Strengthen Detection and Response," advising organizations to deploy deceptive assets to detect and foil hackers inside networks.
- Chris Butera, acting executive director of the cybersecurity division, said the advisory arose from internal discussions about how decoys provide "a very low-cost but actually high-fidelity way to detect an adversary who's already gained access to networks."
- Examples of defensive assets include "Honeytokens," "tripwires," and "breadcrumbs"—fake records or services planted to distract, detect, and divert unauthorized users away from valuable databases.
- CISA urges critical infrastructure and small to medium-sized organizations to adopt these techniques, aiming to enable "any defensive team regardless of skill level" to implement decoy operations.
- Planting fake admin credentials or placing decoy folders on executive desktops signals compromise if accessed; placing a fake network-scanning tool on a nontechnical user's workstation indicates malicious execution.
8 Articles
8 Articles
CISA wants critical infrastructure orgs and smaller security teams to start using cyber decoys
Cyber deception has long been the domain of well-resourced security teams, but CISA’s latest guidance, titled “Using Cyber Decoys to Strengthen Detection and Response”, is an attempt to try and change that. Why decoys, and why now The core problem CISA is attempting to address is that many organizations are incapable of detecting adversaries who use legitimate credentials, built-in administrative utilities, and living-off-the-land (LOTL) techniq…
In addition to Zero Trust, CISA recommends targeted cyber-decoys: Deception systems are designed to distract, expose, and deliver valuable threat intelligence to network attackers. Addition to Zero Trust architectures The U.S. cybersecurity agency CISA has published a new guide to the implementation of cyber decoys, which is primarily aimed at critical infrastructure operators. While Zero Trust models continuously verify all accesses, deceptive …
securityweek.com
IT Security News - cybersecurity, infosecurity newsCISA Releases Guidance on Deploying Cyber Decoys
Complementing Zero Trust models, decoys enable organizations to detect, observe, and block malicious activity in their environments.
Coverage Details
Bias Distribution
- 50% of the sources lean Left, 50% of the sources are Center
Factuality
To view factuality data please Upgrade to Premium
