The US Cybersecurity and Infrastructure Security Agency (CISA) has released new guidance on deploying decoy systems for robust cyber defenses within critical infrastructure organizations.
Cyber decoys, the agency says, complement Zero Trust models, which continuously verify all access, by assuming an adversary has gained some level of access to an enterprise environment.
“Cyber decoys are assets that appear to be legitimate systems, accounts, or data, but are designed to distract adversaries, detect their presence, or facilitate collection of cyber threat intelligence (CTI),” CISA notes.
They enable organizations to identify, observe, and block malicious activity early, gather and analyze CTI, and allocate resources more effectively.
“Decoy techniques are incremental, cost-effective, and scalable, allowing organizations to introduce them without major architectural changes,” CISA’s guidance (PDF) reads.
To expose adversary activity, organizations should place decoys where users rarely or never interact with them, and should configure them to produce high-fidelity alerts.
They should be designed to divert attackers to decoy data, to produce a misleading understanding of the environment during adversary reconnaissance, and lure threat actors into downloading large amounts of non-sensitive or meaningless data.