{"id":2031,"date":"2017-04-06T19:22:09","date_gmt":"2017-04-07T02:22:09","guid":{"rendered":"https:\/\/new.acalvio.com\/?p=2031"},"modified":"2017-04-06T19:22:09","modified_gmt":"2017-04-07T02:22:09","slug":"hiding-in-plain-sight-how-to-operationalize-deception-for-security-teams","status":"publish","type":"post","link":"https:\/\/acalvio.p2staging.us\/index.php\/2017\/04\/06\/hiding-in-plain-sight-how-to-operationalize-deception-for-security-teams\/","title":{"rendered":"Hiding in Plain Sight: How to Operationalize Deception for Security Teams"},"content":{"rendered":"

Honeypots.<\/strong>
\nJust those three syllables are enough to cause instant nausea with a cyber security professional. Why? Honeypots are hard to operationalize into an effective, easy to use and consistent defense. But times are changing with the proliferation of deception technologies (Gartner tracked 16 vendors in a September 2016B report<\/a>). Can deception be easily rolled into a cyber security defense?
\nThe problem so far has been properly operationalizing deception. Implementing is a lot of work. Todayb\u0000\u0019s deception approaches, like camouflage in the physical world, rely on consistent surroundings for concealment. When soldiers wear camouflage for snow, the desert or a forest and surroundings remain constant, youb\u0000\u0019re fine. But ascend from the forest to a snowy mountaintop and, unless you can rapidly change, youb\u0000\u0019re exposed. Every IT environment constantly changes. If deception canb\u0000\u0019t adapt like a chameleon, itb\u0000\u0019s useless. Thatb\u0000\u0019s Deception 1.0.
\nEnterprises need something that morphs. Modern deception must update dynamically with the environment being protected. For example, can your deception technology detect and recognize that you just updated a Linux installation? Thatb\u0000\u0019s Deception 2.0.
\nThatb\u0000\u0019s the defense philosophy behind Deception 2.0. But the question is: how do security teams make deception deployable and effective? It has to be easy. And we mean dirt effing simple. A no brainer, easy as pie or any of other appropriateB idiom<\/a>. A recentB report<\/a>found that enterprises average 17,000 malware alerts per week so itb\u0000\u0019s a safe bet that alert number 17,001 wonb\u0000\u0019t be investigated. In such an environment, deception must be operationalized quickly, easily and with tremendous impact. How would that look? It should meet several key business, technical and usability criteria.
\nTechnically, one should learn from the mistakes of many of todayb\u0000\u0019s security vendors who have built products with long deployments and complex configurations. Deception tools must able to:<\/p>\n