A presentation from the Jisc security conference 2018 by Nick Palmer, technical director, Attivo

1. Parallel session:
Deception technology
for advanced detection
Nick Palmer
technical director, Attivo

2. 2
Nick Palmer | Technical Director, Europe
Deception Technology
Luxury Item or Lifeline?

3. 3
Hindu Cosmology and Security?

4. 4
0
50
100
150
200
250
2010 2011 2012 2013 2014 2015 2016 2017
Lines that just shouldn’t track together…
Breaches
Spending
Source: Statistica

5. 5
Dwell Time – Why Does it Matter?

6. 6
What An Attacker Sees…

7. 8
”..cyber attacks against national infrastructure and
reputation across Europe, information operations
that attempt to pervert political process and
frustrate the rule of law, and attempted
assassinations ..deception and counter-
deception" operations would be "critical" in
dealing with such threats.
Air Marshal Phil Osborn
Chief of Defence Intelligence
Deception. A Legitimate Extension to Strategy

8. 9
Honeypots - Not the Same as Deception Platforms
Outside the Network
Low Authenticity
Low Interaction
Inside the Network
Network, Credential
High Authenticity
AD Integration
Low Ownership Cost
Automation
BOTs and Brute Force Attacker Designed for
Research
the Human Attacker
Global Scale

9. 10
Why Deception? Why Now?
Attackers are circumventing
traditional security measures
(Firewalls, IDS/IPS, AV, DLP)
Alert volume is over-whelming
SOC personnel
Protect legacy to expanding
attack surface
A proactive defense counters
the attacker’s advantage

10. 11
Obscuring the Attack Surface and Disrupting Threats
What Deception Does
Target
Exploit
Target
Target
Deception Forces the Attacker to Have to Be Right 100% of the Time.

11. 12
Efficient, Scalable, In-network Threat Detection that changes the Asymmetry of an Attack
Deception, the Preferred Method for Detection
Primary Use Cases
Compliance, Breach Investigation, M&A Visibility
Incident Response
Credential Theft Attacks
Lateral Movement Threat Detection
Ransomware
Evolving Attack Surface
Prevention Detection