Latest / Cybersecurity Business with Fexingo: Security Companies, Breaches, and Enterprise Defense / How Security Teams Are Using Cyber Deception to Trap Ransomware
Transcript
- Lucas: If these conversations are useful for what you're building or running, here's a quick thing. Lucas: This show stays ad-free because of listener support — people who find it valuable chip in so we don't have to sell you mattress ads or VPN promos. Luna: Yeah, and honestly, that support is what lets us keep the episodes tight and specific. No filler. Lucas: Exactly. So if today's episode earns a coffee, you can find us at buy me a coffee dot com slash fexingo. That's all lowercase. And now back to it. Lucas: Let's start with a number I found yesterday: over the last eighteen months, the average dwell time for ransomware — the time between initial compromise and encryption — has dropped to under twenty-four hours. In some cases, it's under four. Luna: That's terrifying. So by the time you even know you're infected, the damage is done. Lucas: Right. And that compression puts enormous pressure on detection. Traditional signature-based tools can't keep up when the attack is over in hours. So security teams are flipping the script — they're not just waiting to detect an intrusion, they're actively baiting attackers into revealing themselves. Luna: You're talking about cyber deception. Laying out decoys — fake servers, fake credentials, fake data — that look real enough that an attacker interacts with them. Lucas: Exactly. And it's not a new idea — honeypots have been around for decades. But what's changed is the scale and the orchestration. Modern deception platforms let you deploy hundreds of decoys across your network, cloud, and endpoints, and they integrate directly into your SIEM and SOAR workflows. Luna: So the decoys aren't just sitting there collecting dust. They're actively feeding alerts into the same pipeline as your real detection tools. Lucas: That's the key. And the decoys are getting smarter. Instead of a single fake Linux server sitting on an unused subnet, you now have decoys that mimic domain controllers, file shares, databases — even fake user accounts with realistic login patterns. Luna: I've seen a demo where a decoy had fake browser history and cookies. It was creepy how real it looked. Lucas: That level of realism is exactly what you need. Attackers, especially ransomware operators, often use automated scanners that look for low-hanging fruit — exposed RDP, weak passwords, unpatched systems. But they also do manual reconnaissance after initial access. If they find a server that looks like it holds sensitive data, they'll pivot to it. Luna: And if that server is a decoy, you get an alert the moment they touch it. Lucas: Yes. And not just any alert — a high-fidelity alert. The signal to noise ratio on deception alerts is incredibly good because the only thing that should ever interact with a decoy is an attacker or a misconfigured admin tool. So you can prioritize it immediately. Luna: But isn't there a risk of false positives? What if a legitimate admin scans that subnet or a monitoring tool accidentally hits the decoy? Lucas: It happens, but it's manageable. Most platforms let you whitelist known scanning tools and admin IPs. And you can design the decoys to only respond to certain protocols — like SMB or RDP — so casual network noise doesn't trigger them. The real challenge is keeping the decoys updated so they don't look stale. Luna: Right. If the decoy is running Windows Server 2012 but everything else in your environment is on Server 2022, an attacker might recognize the anomaly. Lucas: That's exactly the kind of detail that matters. A good deception program is a living thing. You have to patch the decoys, rotate credentials, update the fake data. It's not set-and-forget. But the payoff can be huge. I talked to a CISO at a regional healthcare system — about a dozen hospitals — who deployed deception after a near-miss with Ryuk in 2024. Luna: What happened? Lucas: They had a phishing campaign that dropped Cobalt Strike. The attackers spent about six hours doing reconnaissance. They found what looked like a file server with patient records — it was a decoy. The moment they tried to copy files, the SOC got an alert, isolated the segment, and kicked them out before any encryption happened. Luna: And the decoy convinced them because it had realistic patient data — fake names, diagnoses, billing codes. Lucas: Exactly. The CISO told me the decoys were seeded with data generated by a medical records synthesis tool. It passed the 'sniff test' — an attacker browsing the directory would see what looked like thousands of patient folders with plausible file names. Luna: So the deception didn't just detect the intrusion — it bought time. The attackers spent effort exfiltrating fake data while the defenders prepared their response. Lucas: That's a huge advantage. And it's one reason why I think deception is underrated. A lot of CISOs still see it as a 'nice to have' rather than a core detection layer. But when you look at the math — ransomware payouts average over eight hundred thousand dollars now, and a deception deployment might cost fifty to a hundred thousand annually — the ROI is compelling. Luna: But there's also a strategic argument. If attackers know you're using deception, it forces them to be more cautious. They have to spend extra time verifying every system before they act. That slowdown itself is a win for defenders. Lucas: Absolutely. It changes the attacker's calculus. They can't trust what they see. And for automated ransomware that just scans and encrypts, decoys can be a tripwire that catches them before they ever reach production data. Luna: One concern I've heard is that sophisticated attackers can spot decoys by looking for telltale signs — like a server that doesn't have any actual user connections, or that responds to pings but has no active services. Lucas: That's a real threat. But modern platforms are getting better at simulating user activity. Some can generate fake NetFlow logs, simulate LDAP queries, even fake keyboard input. The goal is to make the decoy indistinguishable from a real system from the attacker's perspective. Luna: So it's an arms race. But the defenders have an advantage because they control the environment. They can update decoys faster than attackers can learn to detect them. Lucas: And they can use deception data to feed threat intelligence. Every time an attacker interacts with a decoy, you capture their tools, commands, and techniques. That information can be used to update detection rules across the entire environment. Luna: So it's not just a detection tool — it's a intelligence collection platform. Lucas: Exactly. And that intelligence loop is what separates a mature deception program from a simple honeypot. You're not just catching attackers — you're learning from them in real time. Luna: What about the operational overhead? Who manages the decoys day to day? Lucas: Typically it falls to the detection engineering team or a dedicated threat hunter. Many platforms have a console that lets you deploy decoys across different environments — on-prem, cloud, even SaaS — and they'll automatically update the decoy configurations based on changes in the real environment. So it's not as heavy as you might think. Luna: But you still need someone to review the alerts and respond. A decoy alert that fires at 3 AM still requires a human to decide whether it's real. Lucas: True. But because the fidelity is so high, many organizations automate the initial response — isolate the decoy's subnet, block the source IP, and alert the on-call analyst. The analyst can then investigate during business hours. Luna: That's smart. Automate the containment, investigate the incident. Lucas: Right. And over time, the data from those investigations helps you refine your decoy placement. You learn which parts of your network are most attractive to attackers and double down on deception in those zones. Luna: It's almost like building a psychological profile of your adversary and using it against them. Lucas: That's exactly what it is. And that's the part I find most fascinating. We spend so much time on prevention and detection from the defender's perspective — patching, monitoring, segmenting. Deception forces you to think like the attacker. What would they find valuable? Where would they go next? And then you build a trap around that expectation. Luna: It's proactive in a way that most security tools aren't. Most tools sit and wait. Deception goes hunting. Lucas: And it's only going to become more common. Gartner has predicted that by 2028, thirty percent of large enterprises will adopt deception as a core detection layer. That's up from maybe ten percent today. Luna: So we're still early. If you're a security leader and you haven't looked at deception yet, now might be the time. Lucas: I think so. Start small — maybe a handful of decoys in your most sensitive VLANs. See how your SOC responds to the alerts. Build from there.