CISA wants critical infrastructure orgs and smaller security teams to start using cyber decoys
Cyber deception has long been the domain of well-resourced security teams, but CISA’s latest guidance, titled “Using Cyber Decoys to Strengthen Detection and Response”, is an attempt to try and change that.
Why decoys, and why now
The core problem CISA is attempting to address is that many organizations are incapable of detecting adversaries who use legitimate credentials, built-in administrative utilities, and living-off-the-land (LOTL) techniques.
CISA’s new guidance argues that once you accept intruders will eventually get a foothold, the smartest move is to booby-trap the environment with tripwires, honeytokens and fake credentials that no legitimate user would ever touch, so that any interaction sounds an alarm.
Setting up fake systems, services, accounts, files, or credentials may allow organizations to detect adversaries operating within their environment and gather and analyze information about the intrusions, but also “impose cost on adversaries, disrupt their operations, and reduce the value of their actions.”
Low cost, no re-architecting required
The most relevant message for resource-constrained teams is that decoys don’t require major architectural changes or new spending.
CISA explicitly instructs organizations to repurpose tools they already own – EDR platforms, identity and access management systems, and data loss prevention tooling – to deploy and monitor decoys without buying anything new.
Open-source solutions for token generation, deployment, and alerting are also a good option for organizations with limited budgets, the agency says. Organizations with money to spend and expert developers and security engineers can also leverage commercial solutions and custom, in-house-developed honeytokens tailored to their environment.
Where to start
The guidance document explains the various decoys that can be used: honeytokens (files, records, secrets, credentials) and honeypots (systems, services) are the decoys, breadcrumbs (a saved connection, a reference in a config file, a mention in a document) steer attackers toward them, and tripwire describes any of these once it’s rigged to sound the alarm on contact / interaction.
CISA organizes tactics around MITRE Engage’s three goals: Expose (detect adversaries), Affect (impose cost and disrupt them), and Elicit (safely observe them to collect intelligence).
For teams getting started, the guidance offers concrete examples: planting fake admin-only credentials that no one should ever use, placing decoy folders on executive desktops, deploying honeytokens like a bogus “Project_Metrics.xlsx” on a monitored share, or alerting on PowerShell execution on workstations where ordinary users have no need for it.
The “Elicit” goal, which involves drawing adversaries into controlled environments, demands isolated infrastructure, mature logging, and skilled personnel able to manage the operational and legal risks, is positioned as a later step.
Getting the details right
Effective tripwires, CISA notes, should be threat-informed, distinct from normal behavior, technically detectable by existing monitoring, and tied to clear response procedures.
The document also leans on MITRE ATT&CK to help teams map their vulnerabilities, existing detections, and likely adversary techniques, then place decoys where coverage gaps are widest.
A worked scenario walks through a medium-sized water and wastewater organization using ATT&CK and Engage together to prioritize assets and design its decoy operation, then test and refine it through threat emulation, red teaming, or purple teaming.
Finally, CISA stresses that decoys must be carefully designed so attackers can’t exploit them to reach real systems or privileges. Also, the documentation spelling out decoy locations should be placed outside the production environment, in case the network is compromised.
“CISA encourages critical infrastructure organizations to review this guide and implement a cyber decoy strategy,” said the agency’s Acting Executive Assistant Director for Cybersecurity Chris Butera.
Subscribe to our breaking news e-mail alert to never miss out on the latest breaches, vulnerabilities and cybersecurity threats. Subscribe here!
