This panel discussion, featuring experts from Mitre, Traced, and Lupovics, delves into the intricacies of successful deception planning in cybersecurity operations. The conversation begins by distinguishing between classical military deception and its modern cyber counterpart, emphasizing the shift from physical to virtual assets. Key themes include the necessity of understanding an organization's own strengths and weaknesses, aligning deception strategies with broader business objectives, and tailoring campaigns (small, medium, large) to organizational maturity and risk appetite. A significant portion of the discussion centers on the balance between human planning and automation in deception, concluding that while automation can handle scale, human critical thinking is indispensable for crafting high-fidelity and effective deception scenarios. The panelists also explore the psychological impact of deception on adversaries, noting its ability to induce doubt, increase operational costs, and ultimately shift the defensive burden onto the attacker. The session concludes with each expert offering a key takeaway and recommended resources for further learning.
Summarizing "Successful Deception Planning for Operations"
0:00 Panel Introduction: The panel, including Gabby Raymond and Dylan Hoffman from Mitre, Matt Hosper and Paul Bartra from Traced, and Xavier Pellicer from Lupovics, introduces themselves and the topic: successful deception planning in operations.
1:40 Classical vs. Cyber Deception: Matt Hosper defines classical military deception using the D-Day invasion as an example, where false physical assets and plans were used. He then contrasts this with cyber deception, which involves virtual assets like systems, networks, and online personas, including honeypots.
4:17 Starting Deception Planning: The conversation shifts to the starting point for deception planning. Gabby Raymond emphasizes the importance of understanding one's own organization (strengths, weaknesses) and the adversary. Dylan Hoffman elaborates on strategic goals, including using cyber deception for cyber threat intelligence (CTI) to inform defense, insider threat detection, and to degrade specific adversaries by wasting their time and resources.
7:10 Tailoring Deception to Maturity & Goals: Xavier Pellicer stresses that deception is not a one-size-fits-all solution; its application depends heavily on an organization's cybersecurity maturity journey and what they aim to achieve. Different levels of deception campaigns (small, medium, large) are necessary, aligning with organizational resources and goals.
10:20 Aligning with Business Objectives: The panelists discuss the critical need to align deception plans with overall business goals and risk appetite. This requires cybersecurity professionals to communicate effectively with business leaders, translating technical concepts into business terms and demonstrating the value of deception in protecting "crown jewels" and limiting liability/risk.
13:03 Actionable Intelligence & Alert Fidelity: Xavier distinguishes targeted deception from broader honeypot deployments, arguing that while honeypots gather vast amounts of data, well-planned deception campaigns yield more concise and actionable intelligence that can directly inform threat intelligence teams and CSOs.
30:54 The Automation vs. Human Planning Debate: A core discussion point emerges on the role of automation. While automation can streamline deployment of decoys (e.g., "one-click solution"), the consensus is that human critical thinking, planning, and storyboarding are essential for creating high-fidelity and effective deception environments, especially against sophisticated adversaries.
36:42 Psychological Impact on Adversaries: The panel agrees that deception, even at lower fidelity, can significantly impact adversaries. It introduces doubt, slows down their operations, and imposes costs, effectively shifting the psychological burden of defense onto the attacker. The "doubt and fear" can lead adversaries to spend time verifying assets rather than pursuing objectives.
49:50 Shifting the Defensive Burden: Matt and Paul highlight that deception "flips the tables" on adversaries, forcing them to be on the defense and potentially burn resources or reveal their methods. This is particularly effective against less skilled criminal actors compared to nation-state threats.
52:01 Measurable Metrics: Xavier suggests that deception can provide metrics on asset consumption by adversaries, offering valuable insights into their activities.
Gabby: Questions how automated tool marks might eventually be detectable by sophisticated adversaries; recommends Wikipedia's list of military deception and Barton Whaley's writings.
Dylan: Emphasizes technical people learning to communicate effectively with non-technical stakeholders; recommends MITRE Engage resources and "The Man Who Never Was" (Operation Mincemeat).
Matt: Stresses translating cybersecurity efforts into business language, especially in monetary terms; recommends "The Cuckoo's Egg."
Xavier: Highlights involving all business branches to define use cases for cyber deception; recommends "Intrusion Detection Honeypots" by Chris Sanders and "Cyber Denial Deception and Counter Deception."
Paul: Focuses on the psychological operations component of deception, making criminals more cautious; also recommends "The Cuckoo's Egg."