1. Tangled Web: Using Deception in Defense1

2. Help | About 25+ years with a Fortune 50 (Opinions are my own...)
Developer - PL/1, C/C++, Smalltalk, Java, Python...
Security
secure coding, web app pentesting, consulting, architecture
IANAL – I didn’t tell you to do it! 2

3. “In wartime, truth is so precious that she should always be attended by a bodyguard of lies.” Winston Churchill --
Sun Tzu – 500 BC “All warfare is based upon deception”
Warfare:
Strategy and tactics refined by military history and translated to cyber...
Web sites can be globally targeted. Rule of Law not in force due to lack of legal authority & enforcement
In 2016, Gartner predicted, By 2018, Gartner predicts that 10 percent of enterprises will use deception tools and tactics, and actively participate in deception operations against attackers. 3

4. Deception Goals Adversaries Disguise Distract Disturb
Defensive – Provoke an Action
Detect
Prevent
Respond 4

5. Once upon a time Deception is story telling Know your adversary
Appear weak where strong
Appear strong where weak 5

6. To tell the truth Facts: Revelations Concealment Fictions
Advertise your deception? 6

7. Attacker identification
Browser fingerprinting
Tools, Techniques, Procedures (TTPs)
Request & Response times
Tracking interactions 7

8. Tailor responses (Human)
I see y’all! – Stop it!
Entangle
Slow down
Break down
Log out
Block 8

9. Tailor Responses (Botnet)
CAPTCHA
Entangle
Slow down
Break down
Disinform
Log out – NOT 9

10. Traps
Decoys
Tripwires
Mazes
Mantraps 10

11. Walk into my parlor robots.txt Admin = false Hidden field
encrypted=YWRtaW49ZmFsc2U=
URL variable
Cookies
ProductID = 345
Clown Spider 11

12. Triggered Admin app Hardened server One-way trip
Secure (except for...) 12

13. Tarpit Blind SQL injection – forged data Noisy Slow Slower
Maze – http tarpit
Other vulnerabilities that
Consume resources
Provides tracking 13

14. A good story Attracts attention to reveals
Deflects attention from conceals
Confirms Red's expectations
Keeps Red's interest
Feedback Loop: monitor Red Team actions 14

15. Questions 15