Deception by Design: CISA's Guide to Tricking Cybercriminals

The Cybersecurity and Infrastructure Security Agency (CISA) is going old-school to help organizations with limited resources set traps for hackers. While lurking within an organization’s environment, a threat actor discovers a file labeled passwords.XLS and thinks, "jackpot!" What the actor doesn't realize is that opening the file alerts the security team. It was a trap.

Deceptive techniques relying on decoys, honeypots, tripwires, and breadcrumbs to lure malicious actors into thinking they have found something valuable or are on the right track to compromising sensitive systems, when they are actually being monitored, have existed for decades. Using decoys for threat detection has slipped out of the mainstream spotlight over the past few years, but new guidance published last week by the US Cybersecurity and Infrastructure Security Agency (CISA) signals a shift back to this practice.

As cyberattacks grow more sophisticated and harder to detect, CISA said in its guidance that deception technology will strengthen detection and response. In its "introductory resource" on using cyber decoys, the agency outlined how organizations can design and implement plans to reduce detection time and help defenders understand how their adversaries operate.

CISA’s renewed focus on cyber deception could boost adoption among organizations that lack well-resourced or dedicated security operations, such as small-to-medium-sized businesses. The agency said deception supports zero trust, a defensive structure that assumes bad actors will eventually gain access to systems, and addresses the rise in attackers’ use of living-off-the-land (LOTL) techniques, which are highly challenging to detect.

“The CISA Approach is Fantastic”

CISA’s guidance responds to an increasingly sophisticated threat landscape where traditional detection methods struggle to keep pace. The strategy: plant fake files, datasets, or honey users that lure attackers into revealing themselves, preventing breaches or at least buying defenders critical time. Deception works to thwart attackers, especially when it comes to AI, says Black Hills Information Security’s John Strand.

AI-powered attacks can be slowed by deploying decoys that trap automated systems into wasting time analyzing fake assets. This gives defenders early alerts and more time to respond, he explains.

Strand acknowledges his bias — he teaches deception classes at the Black Hat conference and has written books on the subject — but notes that it's possible CISA published the guidance now because the agency saw how well deceptive techniques are working against AI-based attacks.

“I just think the CISA approach is fantastic,” Strand tells Dark Reading. “Actually, it’s almost like one of the only good things CISA has done in the past year or so.”

The guidance is useful, agrees Joshua Prager, a managing consultant at SpecterOps. Prager notes that most detection technology stacks are still built to detect malware and known bad indicators, but have almost nothing to say when the attacker relies on stolen credentials or employs living-off-the-land techniques. The Verizon Data Breach Investigations Report has noted for the past few years that real intrusions nowadays rely more on stolen credentials rather than hacking.

Organizations struggle to isolate attack behaviors amid vast volumes of telemetry data across thousands of endpoints, Prager tells Dark Reading.

“CISA is naming those gaps directly and telling teams to close the gaps with decoys audited by endpoint detection and response, and identity access management tooling they already own,” he says. “Decoys are only as good as the discipline behind them, though.”

What Works and What Doesn’t With Deception

Prager and Strand both say implementation could pose practical challenges. Strand’s main concern is that the guidance reads like a government document, where the implementation advice can seem incredibly daunting. Deception doesn’t have to be complicated, Strand says.

Effective deception can be as simple as creating a single honey user account — a decoy account created in Active Directory to catch password spraying attempts — or planting a fake passwords.XLS file somewhere on the server for attackers’ automated tools to find. Defenders can monitor attempts to use the honey account, open the fake file, or even use the credentials stored in the file. These steps, while simple, make deception accessible even to organizations without resources to deploy more elaborate schemes, he adds.

Deception can get expensive, but that ultimately depends on how much organizations “want to drink the AI-flavor aid” and spend on various tools or set up more extensive systems, says Strand. If they want multiple fake systems that rotate their activities, for example, the cost to the organization will increase.

Added complexity for IT teams who must track fake versus real accounts is one challenge Prager worries about as it’s the part that’s most likely to get skipped. That’s because a decoy account that isn’t clearly tagged and managed properly will eventually get swept into normal account lifecycle work. It could be deprovisioned as part of an account cleanup process, rotated by a password policy, or flagged during an access review by someone who has no idea of the account’s true purpose.

“Any of those either kills the decoy or creates confusion right where it matters,” Prager warns. He recommends organizations bake decoys into the identity inventory they already maintain with clear ownership and documentation restricted to people who need to know.

Psych The Attackers Out

Organizations that choose to implement deception technology can start with the cheapest, highest-signal moves, recommends Prager. That means identifying disabled services and user accounts that can be easily recycled as decoys.

The decoy should be configured with a 60-character random password and blocked from authenticating locally or remotely. However, he advises organizations to hold off on the more elaborate engagement environments CISA described until a foundation is proven.

“Effective decoys start at the identity layer,” he says. “That’s where attackers pivot, and where most organizations have the least visibility today.”

Many deceptive strategies can have low false-positive rates, especially the honey user account, so security teams don’t have to battle extra noise. Strand describes it as “low interaction but high value” activity for organizations. Deception works against threat actors at varying levels—from script kiddies to nation-states.

Whether it’s an AI or a human attacker, once that trap is sprung, security is alerted to suspicious activity. But the positive outcomes don’t end there. The second, “really cool,” thing that happens, says Strand, is that falling for that trap evokes a psychological shift.

The mind games usually cause the attacker to slow down or, more often, move on to the next target that did not set traps, says Strand. Attackers prefer to take advantage of lower-cost, lower-risk opportunities.

Attackers can be overly confident and assume that organizations deploy very few detective controls.