FortiDeceptor Token Package
The FortiDeceptor Token package adds breadcrumbs on real endpoints and servers, and redirects an attacker to engage with a decoy instead of a real asset. Deception tokens are typically distributed within real endpoints and servers on the network to expand the deception surface.
Effective deception lure technology should support the following:
- Deploy deception lure data and configurations where attackers collect information.
-
Deception lure location must be invisible to end users and should not affect endpoint functionality.
- Deception lure should be accessible with user-level permissions so that attackers can access it early on and be detected. This saves the privileged escalation attack time.
The current FortiDeceptor token packages are:
| Windows |
|
| Linux |
|
| MAC |
|
| SAP |
|
|
AWS Key |
|
|
Azure Key |
|
When the FortiDeceptor token package is installed on a real Windows, Linux, or MAC endpoint, it increases the deception surface and redirects an attacker to engage with a decoy instead of a real asset.