Cyber Deception, the Ultimate Piece of a Defensive Strategy - Proof of Concept

Asymmetries between attacker and defender approaches are made more significant. Defenders are in a perpetual course to protect their assets, data and network complying with regulations and standards while attackers can win the battle by breaching one critical asset with few resources. What about inverting this dominance or at least making both players equally competent? Security by Deception is a proactive strategy that deliberately introduces misinformation or misleading functionalities into existing systems to trick and redirect adversaries to a fake environment in ways that render attacks ineffective and allow collecting intelligence. Today, organizations are still reluctant to implement cyber Deception as there is little consensus on what Deception actually is and how to deploy it to prevent adversaries from accessing organization's critical assets. We provide an overview of the cyber Deception technology and posit a methodology followed by a Proof of Concept showing how to successfully integrate a Deception strategy in an active production environment. We use two leading solutions of the Deception market, which have fundamentally different approaches. Tests are run by a Red team and analysis is done with respect to predefined criteria to assess the opportunity to deploy Deception as a defensive strategy on the defender's environment, with the platform that best suits its ecosystem. Recommendations and lessons learned are provided for future expansion.