Deception decoy best practices
Deception effectiveness requires deployment across all network segments and locations.
This topic provides deception deployment best practices for the decoy layer, including deployment guidelines for each kind of network VLAN that can exist on an enterprise network.
Example of 5-8 decoys per data-center segment (VLAN)
OS
Deploy a matching decoy OS for each type of critical / sensitive IT system in this segment.
Services
Enable matching services for each type of critical / sensitive IT system in this segment and customize the services:
- Apply banner matching the network.
- Apply user access rule such as fake user and password.
- Upload fake data (SMB, FTP, HTTP).
If you do not have out-of-the-box matching services, you can use the custom TCP port listener.
Data
Upload fake data to the decoys to provide authentic engagement. If you do not have matching files, ask the customer to provide a public files package that you can upload and generate fake data using the same structure.
Application
Enable a false matching application for each type of critical / sensitive IT system on this segment If you do not have a matching application, enable high profile fake applications like ERP, POS, or PACS, and so on.
Hostname
Follow corporate standard server’s names for half the decoys and assign enticing names to the remaining half, such as JumpHost001, ERP-XXX, MNG-XXX, Net-Monitor, and so on. Remember that we need to configure these hostnames on the AD level as we use single deception VM across 16 IP address and we can have just one real hostname per OS. For the rest of the IP address, we should have it virtual on the DNS level.
Attackers also like to attack servers with a hostname that has names like “-test” or “-dev” as attackers assume that these servers are less protected.
Gold Image
Ensure you use at least two Windows servers as customer gold images that host critical applications and data. To increase authenticity, configure them to be part of the organization domain.
STATIC / DHCP IP Address
For datacenter segment hosting servers that always use static IP addresses, also use static IP configuration for the decoys.
Example of 2-4 decoys per endpoint segment (VLAN)
OS
Deploy a matching decoy OS and also an “old’ OS like Win7.
Services
Enable matching services for the endpoint on this segment.
If you do not have out-of-the-box matching services, you can use the custom TCP port listener.
Data
Upload fake data to the decoys to provide authentic engagement. If you do not have matching files, ask the customer to provide a public files package that you can upload and generate fake data using the same structure.
Hostname
Follow corporate standard server’s names for half the decoys and assign enticing names to the remaining half, such as IT Admin, HelpDesk, DBA, Finance, and so on. Remember that we need to configure these hostnames on the AD level as we use single deception VM across 16 IP address and we can have just one real hostname per OS. For the rest of the IP address, we should have it virtual on the DNS level.
Gold Image
Ensure you use at least 3–4 Windows servers as customer gold images. To increase authenticity, configure them to be part of the organization domain.
STATIC / DHCP IP Address
For endpoints segment hosting desktops that always use DHCP IP addresses, also use the DHCP IP configuration for the decoys. The DHCP configuration in FortiDeceptor 3.1 and 3.2 allows us to configure one IP per segment, so use the static configuration in this stage to have more decoys per segment.
Example of 7-10 decoys per OT segment (VLAN)
OS
Deploy a matching decoy SCADA OS.
Deploy a matching regular IT OS such as Win7, Win10, or Win2016.
Services
Enable matching services for the OT assets on this segment and customize the services.
- Apply banner matching the network.
- Apply access rule such as fake user and password.
- Upload fake data (SMB, FTP, HTTP).
If you do not have out-of-the-box matching services, you can use the custom TCP port listener.
Data
Upload fake data to the decoys to provide authentic engagement. If you do not have matching files, ask the customer to provide a public files package that you can upload and generate fake data using the same structure. You can also use a search engine like SHODAN.IO to find this data on the Internet and use it to customize the decoys.
Hostname
Follow the OS SCADA names for half the decoys and assign enticing names to the remaining half, such as IT Admin, SCADA-MNG, PLC_ADMIN, HMI_SERVER, NET-MONITOR, and so on.
Application
Check if the customer is willing to provide you access to his OT software. Otherwise, use open-source OT software or use the customize decoy option to generate this kind of decoy.
MAC ADDRESS
Ensure the OT decoy uses the appropriate MAC ADDRESS per vendor.
STATIC / DHCP IP Address
OT networks are mainly a static environment that does not has a DHCP server, so use static IP configuration as well for the decoys.
Example of 8-10 decoys per cloud segment (VPC, VNET)
OS
Deploy a matching decoy OS for each type of critical / sensitive IT system in this segment.
Services
Enable matching services for each type of critical / sensitive IT system in this segment and customize the services:
- Apply banner matching the network.
- Apply user access rule such as fake user and password.
- Upload fake data (SMB, FTP, HTTP).
If you do not have out-of-the-box matching services, you can use the custom TCP port listener.
Data
Upload fake data to the decoys to provide authentic engagement. If you do not have matching files, ask the customer to provide a public files package that you can upload and generate fake data using the same structure.
Application
Enable a false matching application for each type of critical / sensitive IT system on this segment. If you do not have a matching application, enable high profile fake applications like ERP, POS, or PACS, and so on.
Hostname
Follow corporate standard server’s names for half the decoys and assign enticing names to the remaining half, such as JumpHost001, WEB-XXX, DB-XXX, Sec-Monitor, and so on. Remember that we need to configure these hostnames on the AD level as we use single deception VM across 16 IP address and we can have just one real hostname per OS. For the rest of the IP address, we should have it virtual on the DNS level.
Attackers also like to attack servers with a hostname that has names like “-test” or “-dev” as attackers assume that these servers are less protected.
Gold Image
Ensure you use at least two Windows servers as customer gold images that host critical applications and data. To increase authenticity, configure them to be part of the organization domain.
STATIC / DHCP IP Address
Cloud environments mainly host servers that always use static IP addresses, so use static IPs configuration as well for the decoys.