US Cyber Agency: To Foil Hackers, Don't Be Afraid To Use Decoys and Deception

Hackers have long used trickery to bait users into installing malware or giving up their passwords. But in a surprise, a US government cybersecurity agency is urging defenders to fight back with deceptive tactics too. For the first time, the Cybersecurity and Infrastructure Security Agency (CISA) has published an advisory , nudging US businesses and organizations to consider using “cyber decoys” to help them detect and foil hackers that manage to break into their networks. “Cyber decoys are defensive assets that appear to be legitimate systems, accounts, or data,” the agency’s 22-page document says. The advisory goes over the methods, including using “tripwires,” “breadcrumbs,” along with fake records and credentials, such as “honeytokens” and fake services such as “honeypots” to distract, detect and divert the hackers away from actual valuable databases. The overall technique involves placing the decoys “in locations where legitimate users should rarely or never interact with them,” but that could attract the attention of hackers unfamiliar with the organization’s operations. “Examples include: Planting fake admin-only credentials; any use signals compromise,” the document says. “Creating decoy folders on executive desktops; any access is suspicious. Placing a fake network-scanning tool on a nontechnical user's workstation; any execution indicates malicious activity.” The same decoys could trick a hacker into thinking they had found and exfiltrated a motherlode of sensitive information, without realizing they had actually looted “non-sensitive or meaningless data, consuming their time and resources.” The use of decoys inside a network to trap hackers isn’t new. However, CISA is trying to raise awareness the techniques so that “any defensive team regardless of skill level” can adopt them. The agency is calling on critical infrastructure organizations, which includes power generation suppliers, communication networks and healthcare providers, to start using the techniques. The advisory has been specifically written for “small to medium-sized organizations,” which can struggle to come up with staffing and funding to bolster their cybersecurity.

For the first time, the Cybersecurity and Infrastructure Security Agency (CISA) has published an advisory , nudging US businesses and organizations to consider using “cyber decoys” to help them detect and foil hackers that manage to break into their networks. “Cyber decoys are defensive assets that appear to be legitimate systems, accounts, or data,” the agency’s 22-page document says. The advisory goes over the methods, including using “tripwires,” “breadcrumbs,” along with fake records and credentials, such as “honeytokens” and fake services such as “honeypots” to distract, detect and divert the hackers away from actual valuable databases. The overall technique involves placing the decoys “in locations where legitimate users should rarely or never interact with them,” but that could attract the attention of hackers unfamiliar with the organization’s operations. “Examples include: Planting fake admin-only credentials; any use signals compromise,” the document says. “Creating decoy folders on executive desktops; any access is suspicious. Placing a fake network-scanning tool on a nontechnical user's workstation; any execution indicates malicious activity.” The same decoys could trick a hacker into thinking they had found and exfiltrated a motherlode of sensitive information, without realizing they had actually looted “non-sensitive or meaningless data, consuming their time and resources.” The use of decoys inside a network to trap hackers isn’t new. However, CISA is trying to raise awareness the techniques so that “any defensive team regardless of skill level” can adopt them. The agency is calling on critical infrastructure organizations, which includes power generation suppliers, communication networks and healthcare providers, to start using the techniques. The advisory has been specifically written for “small to medium-sized organizations,” which can struggle to come up with staffing and funding to bolster their cybersecurity.

“Cyber decoys are defensive assets that appear to be legitimate systems, accounts, or data,” the agency’s 22-page document says. The advisory goes over the methods, including using “tripwires,” “breadcrumbs,” along with fake records and credentials, such as “honeytokens” and fake services such as “honeypots” to distract, detect and divert the hackers away from actual valuable databases. The overall technique involves placing the decoys “in locations where legitimate users should rarely or never interact with them,” but that could attract the attention of hackers unfamiliar with the organization’s operations. “Examples include: Planting fake admin-only credentials; any use signals compromise,” the document says. “Creating decoy folders on executive desktops; any access is suspicious. Placing a fake network-scanning tool on a nontechnical user's workstation; any execution indicates malicious activity.” The same decoys could trick a hacker into thinking they had found and exfiltrated a motherlode of sensitive information, without realizing they had actually looted “non-sensitive or meaningless data, consuming their time and resources.” The use of decoys inside a network to trap hackers isn’t new. However, CISA is trying to raise awareness the techniques so that “any defensive team regardless of skill level” can adopt them. The agency is calling on critical infrastructure organizations, which includes power generation suppliers, communication networks and healthcare providers, to start using the techniques. The advisory has been specifically written for “small to medium-sized organizations,” which can struggle to come up with staffing and funding to bolster their cybersecurity.

The advisory goes over the methods, including using “tripwires,” “breadcrumbs,” along with fake records and credentials, such as “honeytokens” and fake services such as “honeypots” to distract, detect and divert the hackers away from actual valuable databases. The overall technique involves placing the decoys “in locations where legitimate users should rarely or never interact with them,” but that could attract the attention of hackers unfamiliar with the organization’s operations. “Examples include: Planting fake admin-only credentials; any use signals compromise,” the document says. “Creating decoy folders on executive desktops; any access is suspicious. Placing a fake network-scanning tool on a nontechnical user's workstation; any execution indicates malicious activity.” The same decoys could trick a hacker into thinking they had found and exfiltrated a motherlode of sensitive information, without realizing they had actually looted “non-sensitive or meaningless data, consuming their time and resources.” The use of decoys inside a network to trap hackers isn’t new. However, CISA is trying to raise awareness the techniques so that “any defensive team regardless of skill level” can adopt them. The agency is calling on critical infrastructure organizations, which includes power generation suppliers, communication networks and healthcare providers, to start using the techniques. The advisory has been specifically written for “small to medium-sized organizations,” which can struggle to come up with staffing and funding to bolster their cybersecurity.

The overall technique involves placing the decoys “in locations where legitimate users should rarely or never interact with them,” but that could attract the attention of hackers unfamiliar with the organization’s operations. “Examples include: Planting fake admin-only credentials; any use signals compromise,” the document says. “Creating decoy folders on executive desktops; any access is suspicious. Placing a fake network-scanning tool on a nontechnical user's workstation; any execution indicates malicious activity.” The same decoys could trick a hacker into thinking they had found and exfiltrated a motherlode of sensitive information, without realizing they had actually looted “non-sensitive or meaningless data, consuming their time and resources.” The use of decoys inside a network to trap hackers isn’t new. However, CISA is trying to raise awareness the techniques so that “any defensive team regardless of skill level” can adopt them. The agency is calling on critical infrastructure organizations, which includes power generation suppliers, communication networks and healthcare providers, to start using the techniques. The advisory has been specifically written for “small to medium-sized organizations,” which can struggle to come up with staffing and funding to bolster their cybersecurity.

The same decoys could trick a hacker into thinking they had found and exfiltrated a motherlode of sensitive information, without realizing they had actually looted “non-sensitive or meaningless data, consuming their time and resources.” The use of decoys inside a network to trap hackers isn’t new. However, CISA is trying to raise awareness the techniques so that “any defensive team regardless of skill level” can adopt them. The agency is calling on critical infrastructure organizations, which includes power generation suppliers, communication networks and healthcare providers, to start using the techniques. The advisory has been specifically written for “small to medium-sized organizations,” which can struggle to come up with staffing and funding to bolster their cybersecurity.

The use of decoys inside a network to trap hackers isn’t new. However, CISA is trying to raise awareness the techniques so that “any defensive team regardless of skill level” can adopt them. The agency is calling on critical infrastructure organizations, which includes power generation suppliers, communication networks and healthcare providers, to start using the techniques. The advisory has been specifically written for “small to medium-sized organizations,” which can struggle to come up with staffing and funding to bolster their cybersecurity.

The agency is calling on critical infrastructure organizations, which includes power generation suppliers, communication networks and healthcare providers, to start using the techniques. The advisory has been specifically written for “small to medium-sized organizations,” which can struggle to come up with staffing and funding to bolster their cybersecurity.