This discussion, featuring experts from Mitre Corporation, Traced, and Lupovics, delves into the intricacies of successful cyber deception planning. The panelists begin by differentiating classical military deception from its cyber counterpart, emphasizing the shift from physical assets to virtual ones like systems, networks, and personas. A core theme is the necessity of aligning cyber deception strategies with an organization's specific goals, risk appetite, and maturity level. They explore various strategic objectives, including gathering cyber threat intelligence (CTI), detecting insider threats, and degrading adversary resources by wasting their time and efforts.
A key debate revolves around the balance between automation and human planning in creating deceptive environments. While automation can facilitate widespread deployment of low-fidelity decoys, human intelligence is deemed crucial for high-fidelity, targeted campaigns that exploit adversary biases and yield actionable insights. The psychological impact of deception is highlighted, noting how even the presence of deception can slow down adversaries, impose costs, and instill doubt, effectively turning the tables on attackers by forcing them into a defensive posture. The discussion concludes with the consensus that effective deception requires a holistic, business-aligned approach that prioritizes actionable intelligence over mere data collection, involving various stakeholders to protect an organization's "crown jewels."
Summarizing Deception Planning for Operations
0:00 Introduction to Cyber Deception Planning: Gabby Raymond (Mitre Corporation), Dylan Hoffman (Mitre), Matt Hosper (Traced), Paul Bartra (Traced), and Xavier Pielkens (Lupovics) introduce the topic of successful deception planning for operations.
1:40 Classical vs. Cyber Deception: Matt Hosper explains classical deception using the D-Day invasion example (inflatable tanks, false plans) to illustrate how adversaries are made to act on misinformation. Cyber deception applies similar principles to online assets like systems, networks, and digital personas, including honeypots.
4:17 Starting the Deception Plan: The panel emphasizes knowing your own organization's strengths and weaknesses, as well as understanding your adversary, as the foundational steps for planning.
Insider Threat Detection: Identifying unauthorized access to specific "trap" assets.
Adversary Degradation: Wasting adversaries' time and resources to distract them from critical assets ("crown jewels").
7:10 Deception Maturity Levels: Xavier Pielkens adds that deception strategies depend on an organization's cybersecurity maturity journey, with different levels of complexity and use cases.
8:28 Planning & Organizational Assessment: Planning involves assessing organizational capabilities, identifying valuable assets, and understanding what information an adversary might seek to tailor deception.
9:50 Campaign Sizes & Resources: Deception campaigns can range from lightweight (e.g., canary tokens in files) to complex, high-fidelity environments, requiring varying levels of resources and team involvement (CTI, reverse engineers, blue teamers).
10:22 Business Alignment & Risk Appetite: Deception goals and strategies must align with overall business objectives and the organization's risk appetite. Small companies might focus on protecting new products, while larger enterprises consider extensive compliance frameworks.
14:02 The Shift from Silent IT: Matt notes that deception requires IT/cybersecurity teams to engage with business leaders, moving beyond a "silent" technical approach to understand and protect core business values.
16:38 Reconnaissance and Targeted Campaigns: Xavier highlights that just as adversaries conduct reconnaissance, defenders should gather internal data to plan targeted, actionable deception campaigns that align with observed threats and business "crown jewels."
18:03 Communicating Value to Decision-Makers: Dylan stresses the importance of planning how to communicate the value of deception to non-technical stakeholders (business leaders, lawyers), framing it in terms of risk mitigation and liability limitation rather than direct profit.
20:17 Actionable vs. Mass Data: Paul and Xavier distinguish between general honeypots (which gather vast, often unactionable data) and targeted deception (which provides concise, valuable, and actionable intelligence for business protection).
24:19 Storyboarding & Threat Modeling: The panel discusses using threat modeling and storyboarding to design deception campaigns based on known adversaries and past incidents (e.g., brand impersonation). The goal is to learn, inform defenses, and preserve brand integrity.
28:33 Storyboard Based on Known Threats: Xavier advises storyboarding based on what you know and have already faced, rather than solely on what others are seeing, as threats and crown jewels vary.
29:22 Developing Personas & Narratives: Internally at Mitre, developing adversary personas and deception narratives is crucial for CTI collection, focusing on measuring the fidelity and efficacy of artifacts.
31:07 Automation vs. Human Planning (The "Hot Take"):
Dylan Hoffman: While high-fidelity environments are ideal, practicality often requires trade-offs. Fidelity should match the expected threat. Automated threats or less sophisticated adversaries may not require perfect, human-crafted deception.
Matt Hosper: Humans excel at critical thinking, planning, and understanding adversary motivations, which are essential for effective deception. Automation can handle the large-scale deployment of decoys once the human-designed plan is in place.
Gabby Raymond (Hot Take): Argues that a "brain-dead" automated deception deployment can still be valuable by simply being present, as ambiguity and the need to detect deception impose costs and slow down adversaries, regardless of fidelity.
Xavier Pielkens: Supports "plug-and-play" deception for broader adoption, even if less tailored. The psychological impact of knowing deception might be present makes adversaries (and even pen testers) more cautious, forcing them to spend time verifying assets.
40:14 Adversary Return on Investment (ARO): Matt explains the ARO concept: adversaries weigh the time/resources spent against the likelihood of success and being caught. Deception increases their costs and likelihood of detection, making the organization a less attractive target.
51:01 Flipping the Tables: Deception shifts the burden of detection onto the adversary. Defenders gain an advantage because attackers are likely less skilled at defense within an unknown environment.
Gabby Raymond: Consider if automated tool marks will become detectable by sophisticated adversaries. Resource: Wikipedia article on military deception; Barton Whaley's writings on military deception.
Dylan Hoffman: Technical people must learn to communicate deception's value to non-technical decision-makers, speaking their language. Resource: MITRE EngAge website/blog series; "The Man Who Never Was" (Operation Mincemeat).
Matt Hosper: Translate adversary conversations into business language, focusing on the monetary or strategic costs of failure. Diplomacy is key for buy-in. Resource: "The Cuckoo's Egg" by Clifford Stoll.
Xavier Pielkens: Involve all business branches in understanding requirements to avoid "defending in a void." Consolidating disparate information creates valuable use cases. Resources: "Intrusion Detection Honeypots" by Chris Sanders; "Cyber Deception and Counter Deception" (Springer).
Paul Bartra: Effective deception moves beyond just deploying tools; it's about tying the intelligence gained to business value. Deception creates a psychological operation, making criminals more cautious due to increased risk of justice. Resource: Echoes "The Cuckoo's Egg."