Overview

With the introduction of Camouflage, Attivo has moved its ThreatMatrix Deception and Response Platform into a new class of deception for threat detection and continuous threat management. Camouflage introduces machine self-learning into its algorithms for behavioral deception and deployment of its deception credentials and lures. Earlier versions of deception were based on using low to high interaction “honeypot” decoys to attract attackers. Attivo goes significantly further, by not only making the entire network a high interaction trap for attackers, but by also strategically deploying deception bait on end-points that is customized to match the production system and will dynamically self-learn the endpoint’s environment for the highest levels of authenticity. Do not be fooled that all deception is alike. Do you really think a ICS-SCADA environment looks the same as a medical network or a business network? No, of course not. Each environment runs different versions of operating systems, protocols, and services and mac addresses are very specific for the environment in which they are in. An attacker will study their attack surface and quickly identify and stay away from things that don’t look quite right.

Authenticity is core to the success of a deception solution. Low interaction or simple emulated environments can be detected by an attacker, whereas dynamic behavioral deception makes the bait and decoys indistinguishable to the attacker. Microsoft Active Directory support is also used for validation and additional deception. Additionally, the solution goes beyond just keeping a fresh façade and factors in fingerprinting after attacker engagement. The Camouflage solution will automatically respin the decoys and deception lures after attack to ensure the attacker cannot id and avoid the traps and detection in the future.

The solution is so stealthy, it’s now in high demand by blue penetration testing teams to trick the red teams and prove network resiliency.