Section 3.27 Outsmarting Threat Actors

Question 1

Outsmarting Threat Actors

DDt’s

Answer 1

One of the most effective ways to learn from the different threat actors that are attacking your network is to set up and utilise…

Deception and Disruption technologies

Question 2

TTPs

Answer 2

Tactics, Techniques, and Procedures (TTPs)

Specific methods and patterns of activities or behaviors associated with a particular threat actor or group of threat actors

Idea is to learn the threat actors TTPs

Question 3

Deceptive and Disruption Technologies

MCD DN

Answer 3

Technologies designed to mislead, confuse, and divert attackers from critical assets while simultaneously detecting and neutralising threats

Question 4

4 common deceptive and disruption technology examples

1 Honeypots

D S/N

Answer 4

Decoy system or network set up to attract potential hackers to allow defenders to study their actions without any consequences

Question 5

4 common deceptive and disruption technology examples

2 Honeynet

Answer 5

Network of honeypots to create a more complex system that is designed to mimic an entire network of systems to study threat actor behaviors

Servers
Routers
Switches

Question 6

3 Honeyfiles

Answer 6

Decoy file placed within a system to lure in potential attackers - these watermarked files can help detect unauthorised access

Question 7

4 Honeytokens

Answer 7

Piece of data or a resource that has no legitimate value or use but is monitored for access or use

Bogus URL
Fake passwords

signals an alarm for a potential security breach when used

Question 8

5 examples BDDPS

Disruption Technologies and Strategies to help secure enterprise networks

Answer 8

1. Bogus DNS entries: Fake Domain Name System entries introduced into your system’s DNS
   server
2. Creating decoy directories: Fake folders and files placed within a system’s storage
3. Dynamic page generation: Effective against automated scraping tools or bots trying to index or steal content from your organization’s website
4. Use of port triggering to hide services: Security mechanism where specific services or ports on a network device remain closed until a specific outbound traffic pattern is detected
5. Spoofing fake telemetry data: When a system detects a network scan is being attempted by an attacker, it can be configured to respond by sending out fake telemetry or network data