FortiDeceptor Token Package
The FortiDeceptor Token package adds breadcrumbs on real endpoints and servers, and redirects an attacker to engage with a decoy instead of a real asset. Deception tokens are typically distributed within real endpoints and servers on the network to expand the deception surface.
Effective deception lure technology should support the following:
- Deploy deception lure data and configurations where attackers collect information.
- Deception lure location must be invisible to end users, and doesn’t affect endpoint functionality.
- Deception lure is accessible with user level permissions so that attackers can access it early on and get detected. This saves the privileged escalation attack time.
The current FortiDeceptor token packages are:
| Windows | |
| Linux | |
| MAC |
|
| SAP |
|
|
|
|
Azure Key |
|
When the FortiDeceptor token package is installed on a real Windows, Linux, or MAC endpoint, it increases the deception surface and redirects an attacker to engage with a decoy instead of a real asset.