DEFE CON 33 - Deploying Deception in Depth for ICS - Brent Muir

Based on the feedback and the detailed transcript, I've revised the summary to address the gaps and align more closely with the presentation's key messages. Here's the optimized version:

Optimized Summary:

Deception techniques for Industrial Control Systems (ICS) address critical security challenges: overwhelmed security operations centers (SOCs), alert fatigue, and sophisticated threat actors like APT44 that bypass traditional defenses [0:15]. By operationalizing the MITRE Engage framework, organizations can deploy high-fidelity, low-noise detection using existing security controls and open-source tools, avoiding additional technology investments [2:12].

Key Framework Elements:

• MITRE Engage's 9-Stage Approach: Plan, Collect, Detect, Prevent, Direct, Disrupt, Reassure, Motivate, and Analyze [4:11]. This framework structures adversarial engagement by:
  • Collecting threat intelligence (TTPs, malware, tools) targeting your environment [4:11].
  • Designing & Deploying deception mapped to adversary attack paths [5:55].
  • Fine-tuning deployments to eliminate false positives and avoid generating noise [7:28].
  • Analyzing results to refine tactics and intelligence [22:08].

Core Deception Tactics for ICS:

• Lures: Decoys like fake documents, API keys, or SSH credentials planted strategically to detect reconnaissance [8:53].
• Personas: Fictional accounts (e.g., AD accounts, LinkedIn profiles) designed to appear legitimate; interactions trigger alerts [8:53].
• Artifacts: Fake system elements (browser history, recent files) to make honeypots indistinguishable from real systems [8:53]. Techniques include:
  • Credential Seeding: Injecting fake AD credentials into system memory (e.g., via scripts) accessible only via credential dumping tools [15:13].
  • Artifact Diversity: Replicating protocols, applications, and vulnerabilities from the actual environment to maintain authent