Send attackers on a wild goose chase with deception technologies

Bastien Hajduk

Midsized companies with revenues from $100 million to $1 billion spent an average of $3 million on information security as of 2014 per “The Global State of Information Security Survey 2015” from PwC.

“I promise you, bad guys are not spending $3 million to break into your organization,” says Allen Harper, chief hacker, Tangible Security. Still information burglars are getting through.

And since 92 percent of IT and security professionals surveyed globally use signature-based antivirus software on their servers, despite AV’s inability to stop advanced threats and targeted attacks, according to Bit9’s 2013 Server Security Survey, exploits such as zero-days, which have no signatures give attackers the upper hand.

To turn the tide, security experts are pressing enterprises to turn to behavior-based approaches where an illicit behavior can identify a probable exploit, whether security software has an example of its ‘fingerprint” or not. Security researchers are updating a behavior-based approach that has been around for decades.

That approach is Deception. Deception identifies an attacker when they exhibit the behavior of simply falling for the Deception, such as by trying to interact with a fake web server that no one with a legitimate business purpose is using. CSO explores the purposes and strengths of Deception together with examples of its technologies and approaches.

Purposes and strengths

To continue reading this article register now

Shop Tech Products at Amazon