Data Honeytokens for the Cloud Era

Many organisations rely on perimeter and identity controls, which can miss an insider or attacker who already holds a valid session and quietly exports data from analytics platforms. The talk proposes placing decoy data assets alongside real ones, so that any access to them becomes a high-confidence signal. It opens with an illustrative story of an employee who takes a planted spreadsheet and gets caught, and frames the threat around insiders, compromised sessions and automated tools that have gone beyond their purpose.

The speaker explains how to make decoys believable: realistic naming, valid headers, matching timestamps, an embedded identifier, and placement next to genuine project data so that access is inherited from parent folders. Decoys are deployed with infrastructure as code into Azure storage and Fabric or Synapse, registered with Microsoft Purview for classification and lineage, and monitored with Sentinel rules covering blob reads, copies and SQL queries. A recorded demo shows alerts firing when two decoys are downloaded. The tuning section covers common sources of noise, such as engineers, backup agents and scanners.

The closing guidance covers keeping decoys out of ETL pipelines and making sure they hold no sensitive data. The speaker argues that this approach can cut detection time from months to minutes. The advice is to validate the threat model first, then start with one decoy in a non-production container and one alert, and to report the results to management.