Learn Cyber Deception!

This video features Adrien Sanabria discussing the philosophy and practical application of cyber deception as a high-fidelity early detection mechanism, emphasizing that defenders can flip the script on attackers who must be right every time once inside a network 19:0021:17.

Key Takeaways:
• Cyber deception should be viewed as an early detection mechanism similar to a burglar alarm, allowing defenders to catch intruders with simple traps rather than complex, resource-intensive environments 19:0025:03.
• The narrative that "attackers only need to be right once" flips once an attacker is inside a network; the attacker must then avoid traps every single time, while the defender only needs to catch them once 21:1730:32.
• Attackers operate in a "fog of war," forcing them to scan for specific enticing targets like passwords.xlsx, which defenders can exploit using fake credentials and documents 22:0022:44.
• Tools like Canarytokens.org offer free, accessible ways to create web bug or DNS tokens that alert defenders when accessed, potentially slowing down attackers even if the trap is identified 31:3633:34.

Sanabria demonstrates creating a web bug token to show how easily defenders can monitor for unauthorized access to sensitive-looking files 35:33.

Sources:

• 19:00 Deception as an early detection mechanism
• 21:17 Flipping the "attacker needs to be right once" narrative
• 22:44 Exploiting attacker "fog of war"
• 31:36 Intro to Canarytokens and web bugs
• 35:33 Demo of triggering a token