Tis the season to make predictions for 2024, so this is considered one of mine: Deception expertise will change into extra pervasive in 2024 and change into a security operations staple by the top of 2025.
Now, there are two frequent counterpoints I usually hear from deception expertise skeptics. First, many cybersecurity execs say they’ve heard this prediction earlier than, and it hasn’t panned out. Others declare that deception expertise is constrained to the elite of the elite organizations. Actually, many dismiss it as one thing reserved for risk analysts working at GCHQ, NSA, or risk intelligence specialists like CrowdStrike, Mandiant, and Recorded Future. The time period “science undertaking” usually comes up.
Deception expertise tendencies
Alas, these are professional factors, however I firmly imagine that a number of cybersecurity and normal IT tendencies are converging into an ideal storm certain to vastly simplify deception expertise, carry it to the mainstream. These tendencies embrace:
- Safety information lake deployment: Enterprises are implementing huge security information repositories from AWS, Google, IBM, and Snowflake. Deception applied sciences will repeatedly analyze this information to raised perceive regular and anomalous conduct. This information will function a baseline for deception fashions.
- Cloud computing: Deception fashions would require oodles of assets for on-demand processing and storage capability. It is seemingly that deception applied sciences can be provided as SaaS or a cloud-based providers that sits on prime of present security operations applied sciences. On this manner, deception expertise will come to the plenty.
- API connectivity: Apart from security information lakes, deception expertise will plug into IaaS, asset administration techniques (or what Gartner calls cyber asset assault floor administration), vulnerability administration techniques, assault floor administration techniques, cloud security posture administration (CSPM), and so on. This connectivity permits deception techniques to get a full image of a company’s hybrid IT functions and infrastructure.
- Generative AI: Based mostly on giant language fashions (LLMs), generative AI can “generate” genuine trying decoys (i.e., pretend property), lures (i.e., pretend providers), artificial community site visitors, and breadcrumbs (i.e., pretend assets positioned on actual property). These deception parts may be deployed strategically and routinely throughout a hybrid community in nice volumes.
How deception expertise would possibly work sooner or later
These tendencies present the technical basis for superior deception applied sciences. Here is a synopsis of how the system would possibly work:
- The deception system plugs into a number of IT scanning/posture administration instruments to “study” every part it will possibly in regards to the setting – property (together with OT and IoT property), IP ranges, community topologies, customers, entry controls, regular/anomalous conduct, and so on. Superior cyber-ranges can do a few of this already. Deception techniques construct upon this artificial setting.
- Based mostly on a company’s location and business, the deception system will analyze and synthesize cyber-threat intelligence on the lookout for particular adversary teams, risk campaigns, and adversary ways, strategies, and procedures (TTPs) that sometimes goal such corporations. Deception techniques can be anchored by numerous MITRE ATT&CK frameworks (cloud, enterprise, cell, ICS, and so on.) to acquire a granular perspective on adversary TTPs. The deception parts are supposed to confuse/idiot them at each step of a cyberattack.
- The deception system will then look at the group’s security defenses – firewall guidelines, endpoint security controls, IAM techniques, cloud security settings, detection guidelines, and so on. It will probably then use the MITRE ATT&CK navigator to find protection gaps. These gaps are excellent touchdown spots for deception parts.
- Generative AI fashions absorb all this information to create custom-made breadcrumbs, decoys, lures, and canary tokens. A company with 10,000 property underneath administration will immediately appear to be a telco, with a whole lot of 1000’s and even tens of millions of functions, information parts, gadgets, identities, and so forth – all meant to attract in and confuse adversaries.
It is value mentioning that every one scanning, information assortment, processing, and evaluation can be steady to maintain up with modifications to the hybrid IT setting, security defenses, and the risk panorama. When organizations implement a brand new SaaS service, deploy a manufacturing utility, or make modifications to their infrastructure, the deception engine notes these modifications and adjusts its deception strategies accordingly.
Not like conventional honeypots, burgeoning deception applied sciences will not require cutting-edge data or advanced setup. Whereas some superior organizations could customise their deception networks, many corporations will go for default settings. Usually, fundamental configurations will sufficiently confound adversaries. Keep in mind, too, that deception parts like decoys and lures stay invisible to professional customers. Subsequently, when somebody goes poking at a breadcrumb or canary token, you might be assured that they’re as much as no good. On this manner, deception expertise may also assist organizations enhance security operations round risk detection and response.
