Design Thinking for Cyber Deception

Abstract

Cyber deception tools are increasingly sophisticated but rely on a limited set of deception techniques. In current deployments of cyber deception, the network infrastructure between the defender and attacker comprises the defence/attack surface. For cyber deception tools and techniques to evolve further they must address the wider attack surface; from the network through to the physical and cognitive space. One way of achieving this is by fusing deception techniques from the physical and cognitive space with the technology development process. In this paper we trial design thinking as a way of delivering this fused approach. We detail the results from a design thinking workshop conducted using deception experts from different fields. The workshop outputs include a critical analysis of design provocations for cyber deception and a journey map detailing considerations for operationalising cyber deception scenarios that fuse deception techniques from other contexts. We conclude with recommendations for future research.

Deception for Cyber Defence: Challenges and Opportunities

“…It seems likely that awareness of the possibility that any interaction with a system or artefact could reveal them causes greater caution and evaluation of the risk of each interaction. The behaviour and psychology of the adversary in the presence of cyber deception is increasingly a subject of study [85]- [87]. Even at this early stage, however, it is fair to say that, from the defender's perspective, anything that makes intrusion and theft more costly for the perpetrator should be encouraged.…”

The relevance, effectiveness, and future prospects of cyber deception implementation within organizations

“…A honeypot serves to lead malicious actors to a deceptive cyber treasure; it is defined as a security mechanism designed to detect, deflect, or, in some manner, counteract attempts at unauthorized use of information systems [7]. It can come in the form of a fake file, account, or even network, which seamlessly imitates an asset valuable or vulnerable to potential hackers while reporting their activity in the process [14]. The first honeypot, The Cuckoo's Egg, details the work of a lab researcher, Stoll, who used fake strategic defense initiatives to entice a German hacker into exposing information about himself [15].…”

“…This approach allows for scalable and sophisticated honeypot networks by leveraging network data to mimic real-world network behaviors [19]. Because of the ease in implementing these algorithms, multiple honeypots can be on one system in what is called a honey network [14].…”

Understanding decision making in security operations centres: building the case for cyber deception technology

“…Alternatively, the low false positive rate promised by cyber deception vendors may dramatically improve the ability of SOC analysts to make decisions with confidence. Ashenden et al (2021) point out that to date most cyber deception research tends to build from a computer science perspective where the scope is often truncated to misdirecting an attacker on a network rather than impacting decision making and behaviour ( Cranford et al, 2020 ; Shi et al, 2020 ; Sajid et al, 2021 ). The only other significant research that has linked cyber deception and decision making is the Tularosa study by Ferguson-Walter et al (2018) .…”

“…This study leveraged deception techniques to examine both the attacker and defender’s (e.g., SOC analysts’) cognitive processes. Ashenden et al (2021) build on this research and explicitly use a definition of deception that links deception, decision making and behaviour [ Ashenden et al (2021) ] using this as a foundation from which to explore the potential of cyber deception using design thinking as a method.…”