CISA urges critical infrastructure to use cyber decoys

The Cybersecurity and Infrastructure Security Agency (CISA) has advised critical infrastructure organizations to deploy fake files, accounts, and credentials within their networks to detect attackers who have already bypassed perimeter defenses. This guidance on cyber decoys, published September 16, represents the agency's initial detailed exploration of the process, operating under the assumption that intruders will eventually gain some level of access, with further coverage provided by Infosecurity Magazine.

CISA's guidance emphasizes the use of honeytokens—data items with no legitimate business purpose, such as fake records or credentials—planted among real assets. Any interaction with these honeytokens strongly indicates unauthorized activity. This approach is framed as a supplement to Zero Trust principles, not a replacement, and the guidance includes no mandatory measures. The agency recommends deploying high-fidelity tripwires in high-value areas, mapping adversary tactics using MITRE ATT&CK and Engage frameworks, and continuously refining these measures through threat emulation. The focus is on reducing the mean time to detection (MTTD) by creating alerts with less noise than conventional tools.

While human attackers might recognize and bypass decoys, AI-driven operators are more likely to interact with them, presenting a notable advantage for defenders against machine-driven threats. However, the effectiveness of decoys depends on matching them to the specific adversary, and they are considered a detection tool rather than a containment measure.

Source: Infosecurity Magazine