Level: Intermediate (some prior knowledge necessary)
Length: Standard (50 minutes)

Description:
Intrusion detection works best when you can discover the attacker while they are still in the system. Finding out after the fact does little to protect your systems and your data. Ideally, you would want to set an alarm that an attacker would trigger while limiting the damage to your environment. We know from many recent breaches that attackers commonly try to expand their foothold in a system by finding and exploiting hardcoded credentials in environments they have accessed. We can use these behavioral patterns to our advantage by engaging in defensive cyber deception. You might already be familiar with the concept of honeypots, false systems, or networks meant to lure and ensnare hackers. There is a subclass of honeypots that require almost none of the overhead, are simple to deploy, are used by many industries, and lure attackers to trigger alerts while they are trying to gain further access. The industry has arrived at the term honeytoken for this branch of cybersecurity tooling. Takeaways: - Analysis of recent breaches for common attack behaviors - A history of cyber deception and the evolution of honeypots in defensive strategies. - Understanding how honeytokens work - Maximizing the impact of honeytokens