The Cybersecurity and Infrastructure Security Agency (CISA) on Sept. 16 issued new guidance to help federal agencies, critical infrastructure operators, and other organizations use cyber decoys to detect attackers operating inside their networks.
The guidance, “Using Cyber Decoys to Strengthen Detection and Response,” focuses on improving detection of adversaries who use legitimate credentials, native tools, and living-off-the-land (LOTL) techniques to conduct discovery, move laterally, and access sensitive data after gaining a foothold in a network.
CISA said cyber decoys can complement zero trust security models by supporting continuous monitoring and verification, generating high-fidelity alerts, reducing alert fatigue, and helping defenders detect post-compromise activity.
“Cyber decoys are assets that appear to be legitimate systems, accounts, or data, but are designed to distract adversaries, detect their presence, or facilitate collection of cyber threat intelligence,” the guidance states.
The guidance outlines several types of decoys, including tripwires, breadcrumbs, and honeytokens. Tripwires are designed to alert defenders when an attacker interacts with a monitored asset, while breadcrumbs provide clues intended to direct an intruder toward a decoy. Honeytokens can include fictitious files, accounts, credentials, email addresses, or URLs that legitimate users should not access.
The guidance uses the MITRE Engage framework and MITRE ATT&CK knowledge base to provide organizations of varying cybersecurity maturity with practical steps for planning, implementing, and refining decoy operations.
One example in the guidance illustrates how defenders can place realistic but fictitious files where legitimate users have no reason to interact with them. Any access to those files can generate an alert, giving security teams a high-confidence signal of potentially unauthorized activity.
The guidance also walks through how a medium-sized water and wastewater organization could use MITRE ATT&CK and MITRE Engage to develop a decoy strategy. The organization inventories its IT and operational technology assets, reviews its existing defenses and monitoring coverage, examines relevant cyber threat intelligence, and identifies gaps between adversary techniques and its ability to detect them.
That analysis identifies gaps involving phishing, LOTL activity using PowerShell, and attempts to exfiltrate cloud backups. The organization can then use those findings to establish objectives for its decoy operation and determine where decoys could improve detection.