This presentation, "The Devil Does Not Exist: The Role of Deception in Cyber and IT," by Mark Mateski and Matt DeVries, explores deception as a critical, yet often culturally biased, strategic tool in cybersecurity. Matt DeVries introduces the concept by highlighting the importance of applying lessons from other disciplines (military, intelligence, law enforcement) to cyber defense, emphasizing that attackers exploit human factors and that a Western aversion to "lying" can be a strategic disadvantage. Mark Mateski then introduces a core framework, or "Lexicon," for understanding deception: "Eye-to-eye" (everything as it appears), "Con" (one party holds a secret), and "Hypercon" (one party is aware of the con and exploits that awareness without the deceiver knowing). Through historical and contemporary examples, they illustrate how recognizing these "linguistic tags" can enable defenders to turn risk into opportunity, such as misdirecting attackers, polluting their data, or exploiting their overconfidence. The presentation concludes by urging security professionals to integrate these analytical patterns and questions into their toolkit to proactively leverage deception in both defensive and offensive cyber operations, acknowledging deep-seated cultural differences that affect its adoption and effectiveness.
Summarizing "The Devil Does Not Exist: The Role of Deception in Cyber and IT"
0:19 Applying Cross-Disciplinary Lessons: Matt DeVries emphasizes the value of drawing insights from military, intelligence, and law enforcement disciplines, like physical red teaming methodologies, to enhance cybersecurity strategies.
0:58 Human Element in Cyber Attacks: The speakers highlight that cyber attackers are human beings who effectively exploit human factors and inherent tendencies to "believe the lie," making deception a potent tool against them.
1:41 Cultural Bias Against Deception: A significant point is the Western historical and cultural aversion to "cunning" or "trickery," viewing it as less noble compared to direct confrontation, a stark contrast to Eastern philosophies like the 36 Chinese Stratagems.
2:22 Deception for Defenders: Matt DeVries outlines practical applications for defenders, including getting attackers to target the wrong assets, passive monitoring to influence behavior, falsely attributing attacks, polluting attacker data, and using honeypots.
3:23 Deception by Attackers: Attackers also use deception, such as feigning a false level of sophistication, misdirecting on their targets, and sophisticated egress deception.
4:52 Introducing the Deception Lexicon: Mark Mateski introduces a simple framework for understanding deception, comprising three "levels" or "games" and two "perceptual states."
5:38 The "36 Hours" Example (Con & Hypercon): Using the movie "36 Hours" (based on Roal Dahl's "Beware the Dog"), the concept of a "Con" (a hidden secret, e.g., a fake hospital) and a "Hypercon" (perceiving the con without the deceiver's awareness, creating significant opportunity) is explained.
Eye-to-eye: Everything is as it appears; both parties are aware of the known strategies.
Con: One party holds a secret, giving them an advantage over the unaware party.
Hypercon: The party being conned becomes aware of the deception but does not reveal this awareness, creating an opportunity to exploit the deceiver's false confidence.
Perceptual States: "Awareness" (getting it right) and "False Confidence" (getting it wrong).
19:15 Historical Examples: The framework is illustrated with historical military examples like the "feigned retreat" (Con) and exploiting a feigned retreat (Hypercon); the Allies reading German Enigma mail (Con) and the potential for a German hypercon; and MacArthur's Inchon landing (Con) and the missed opportunity for a North Korean hypercon.
22:26 Modern Examples: The concept is applied to modern scenarios such as discovering an adversary's tunnel (shutting it down is a "Con," but exploiting it without their knowledge is a "Hypercon"), and dealing with espionage or insider threats (immediate arrest is a "Con," but playing out the situation for deeper intelligence is a "Hypercon").
25:42 Deception as a Higher-Level Strategy: Deception is presented as an additional "dial" or "plane" of strategy, allowing those who master it to operate on a higher, almost "magical" dimension compared to those limited to two-dimensional analysis.
28:14 Key Questions for Analysis: Security professionals should constantly ask: "Is everything as it appears to be?", "Am I being conned?", "Can I turn that into a hypercon?", "Can my opponent turn the con into a hypercon?", and "What if my perception is wrong?"
30:34 Contextual Application: The speakers note that while deception is powerful in adversarial situations, "eye-to-eye" transparency is desired in cooperative contexts like client negotiations.
31:01 Lessons from British WWII Deception: Successful deception requires clear goals (aiming for specific actions, not just thoughts), and centralized coordination to avoid conflicting narratives.
35:55 Real-World Hypercon Example: A company suspected compromise without technical indicators; by initiating a feigned incident response, they provoked attackers to exfiltrate data and activate compromised machines, thereby revealing crucial Indicators of Compromise (IOCs).
40:44 Cultural Disadvantages in Cyber Warfare: Western entities face a natural disadvantage in cyber warfare due to a cultural aversion to cunning, differing perceptions of long-term strategy, and fundamental disagreements on concepts like intellectual property theft.
43:06 Innovation Parity and Future Cyber Conflict: The speakers predict that true change in cyber conflict will come not from arrests or diplomacy, but when innovation parity is reached, making it more advantageous for all sides to pursue genuine innovation rather than relying on theft.