Outsmarting Threat Actors Flashcards
What is one of the most effective ways to learn from different threat actors attacking your network?
Set up and utilize deception and disruption technologies
Deception technologies help to mislead attackers while disruption technologies neutralize threats.
What does TTPs stand for in the context of threat actors?
Tactics, Techniques, and Procedures
TTPs refer to specific methods and patterns of activities associated with particular threat actors.
What are deceptive and disruption technologies designed to do?
Mislead, confuse, and divert attackers while detecting and neutralizing threats
These technologies protect critical assets from attacks.
What is a honeypot?
A decoy system or network set up to attract potential hackers
Honeypots are used to gather information about attackers’ methods.
What is a honeynet?
A network of honeypots designed to mimic an entire network of systems
Honeynets create a more complex environment for attackers.
What are honeyfiles?
Decoy files placed within a system to lure in potential attackers
Honeyfiles help in identifying intrusions by monitoring access.
What are honeytokens?
A piece of data or resource that has no legitimate value but is monitored for access or use
Honeytokens help in detecting unauthorized access.
What are bogus DNS entries?
Fake Domain Name System entries introduced into your system’s DNS server
These entries can mislead attackers and protect real DNS data.
What is the purpose of creating decoy directories?
To place fake folders and files within a system’s storage
Decoy directories can distract and confuse attackers.
What is dynamic page generation effective against?
Automated scraping tools or bots trying to index or steal content
This technique helps protect web content from being misused.
What is port triggering?
A security mechanism where specific services remain closed until a specific outbound traffic pattern is detected
Port triggering helps to hide services from unauthorized access.
What does spoofing fake telemetry data involve?
Sending out fake telemetry or network data when a network scan is detected
This can mislead attackers about the network’s actual status.
