Who Goes There? Actively Detecting Intruders w/Cyber Deception Tools

The talk opens with a run of recent breaches, including a CI platform compromise, a ride-sharing company intrusion, a car maker's exposed key and a pharmaceutical firm's leaked test credentials. The speaker argues that most attackers are financially motivated, through ransomware and cryptomining, and that stolen credentials are the common thread. Since perimeter defenses will eventually fail, the focus shifts to catching intruders quickly once they are inside.

The speaker traces deception tools from early honeypots through to honey tokens, which are decoy credentials with no real access that trigger an alert and reveal an IP address when used. One approach on AWS creates an unused user, sends its activity from CloudTrail into S3, and uses a Lambda function to match events against the decoy list and send notifications. Open-source and commercial options were mentioned, including Canarytoken, GG Canary and Space Siren. Practical tips included keeping tokens in private locations, making them look realistic, placing one token across many repositories, and blocking the source IPs or user agents seen during an alert.

The closing section stresses fast detection and response, and warns against using attack tools on systems you do not own. It recommends managed secret stores such as HashiCorp Vault, Doppler or Keyless over plain-text files or environment files, ideally with a security team handling automatic rotation.