This month, SC Labs
takes another look at deception network tools. With the rapid developments and
improvements seen in this space, it felt like we were looking at some of these
products for the very first time.Deception network
tools implement machine learning technology that studies an environment and
accompanying assets to create decoy assets, environments and in some cases, a full-blown
OS to blend seamlessly and attract attackers. There is no reason for end users
to interact with decoy assets in a production environment.. So, if they do, organizations
can be certain they have malicious intentions.Dynamic deceptions
that change with an environment and keep pace with attackers, force adversaries
to spend more time in networks and maintain their interest through enticing
decoys and breadcrumbs. By keeping attackers engaged in the network longer,
organizations have more time to observe their behavior, contain threats and
remediate gaps in security plans to prevent further intrusions.Vendors in this space
each take different approaches on deception. From hardware- and software-based
solutions to the types of deceptions deployed, all of the technologies deliver
enough hassle to throw off even the most seasoned red teamer. Although they
share the same goal, these products differ from each other with unique features
that reflect their own signature touch on approaching deception.Despite the relative newness of the space, innovations and developments have evolved exponentially, and effective detection and response already are woven into these products. IoT deceptions are also beginning to trickle into this space, and, appropriately so, as they continue to play a larger role in enterprise environments. With decoys indistinguishable from reality, detection and response capabilities, threat hunting support, and rapid growth in this space, these deception network tools merit watching. At SC Labs, we are interested to monitor the continued growth of this area. Deception Network Tools Although
still considered a newer space, the exponential improvements and innovations we
have seen in deception network tools, even just in the last year, are
impressive. The tools are sophisticated and carefully constructed and bring tremendous value to an organization’s security
posture, which should land them at the top of the list of tools for any company
serious about the security of its environment.Honeypots
are not new concepts and have been around for some time. Previously, they were
intended to gather information on attacks that could be analyzed for a better
and more thorough understanding of their approaches, behaviors and capabilities.
Over time, their mission has changed from purely information gathering and
analytics tools, to those that can be used to turn that knowledge into
actionable information to form protection and prevention security measures. That
evolution resulted in the birth of decoy systems to emulate a variety of
connected technologies.Fast
forward to 2019, deception network tools have reached a staggering level of
sophistication and efficiency. The premise of the historical honeypot and first
decoy systems remain visible in the products tested here; however, their
capabilities and realism have made them, in some cases, completely
indistinguishable from real assets and environments. Analytical information used
to back decoys and deception models so they’re dynamic and capable of keeping
pace with attackers. We found standout features unique to individual products
and observed the innovation of Deception as a Service (DaaS) with MSSP support
capabilities.Decoys
almost exclusively are now created by leveraging machine learning technology
that studies an environment and its real assets to emulate them with decoys
indistinguishable from production assets. Even more impressive is the dynamic
nature of the decoys that allows them to adapt and change as an environment
changes, so that realism is maintained consistently and throughout. Decoys even
can be full-blown operating systems. A variety of breadcrumbs and lures are
used to entice attackers and those, too, are done with the same machine
learning technology and level of realism found in decoys. Organizations have
the ability to customize and create their own. In addition, the realism found
in decoy automation removes a lot of manual overhead without compromising
effectiveness.These
products offer other useful tools to help organizations understand what an
attacker did while inside the network, the lateral movements made and, in some
cases, even their GPS coordinates. Each product we tested has an organized,
easily readable dashboard that provides quick insights and a high-level
overview of events in an environment. Given the innovations and improvements seen in deception tools during such a short timeframe, we can only guess (with excited uncertainty) what their ceilingmight look like. They keep growing in sophistication and offerings, providing both endpoint and network deception so that attackers and Red Teams alike cannot defeat them. The intelligently crafted realism and dynamic ability to keep pace with attackers and maintain that level of interest to trap and collect useful information on adversarial behavior make for efficient tools that standout in the realm of cybersecurity.Pick of the Litter CounterCraft impressed us with the tremendous innovation and development put into overhauling its product over the last year. The company offers an unparalleled level of consideration to the feedback it receives, and the pride for and integrity of the product are seen throughout. Quality assurance and a focus on functionality coupled with sophisticated deception methods and intelligence gathering, make CounterCraft Cyber Deception Platform an SC Labs Best Buy. Illusive Networks Deception Management System sets the standard for deception realism and dynamic attacker pacing. Th tool’s maneuverability with a deception environment to constantly trap and deceive attackers accounts for the offering’s undefeated record against Red Teams. This level of deception sophistication with ease of use makes this the SC Labs Recommended product for this month’s round of reviews. To see all of this month's reviews click the headlines below.Acalvio Technologies ShadowPlex 3.3
Attivo Networks ThreatDefend Deception and Response Platform version 5.0
CounterCraft Cyber Deception Platform 2.3.0
Fidelis Cybersecurity Deception 9.2.1
Illusive Networks Deception Management System V3.1.105
PacketViper Deception360 version 5.0
Smokescreen Technologies IllusionBLACK 3.7
TrapX Security DeceptionGrid 6.3
Attivo Networks ThreatDefend Deception and Response Platform version 5.0
CounterCraft Cyber Deception Platform 2.3.0
Fidelis Cybersecurity Deception 9.2.1
Illusive Networks Deception Management System V3.1.105
PacketViper Deception360 version 5.0
Smokescreen Technologies IllusionBLACK 3.7
TrapX Security DeceptionGrid 6.3
