�ݺ�ߣ

Most enterprises focus on preventing cyber attacks by relying on commercial and close-source security products only. Traditionally, they use the Defence-In-Depth approach to prevent adversaries from accessing critical security controls or assets. In this approach, any time the adversary can bypass any security control or ex-filtrate a piece of data from the network and move laterally, they will win the game!!. While the Defence-In-Depth approach is effective against some types of threats, it fails in advanced threat operations, and defenders need time to adapt these approaches, which will increase cost and disperse technical resources. What if change the game between defenders and adversaries?!. Defenders focus on deceptive controls and data in continuous engagements to improve Defence-In-Depth approaches. It will raise many questions by adversaries; Is the piece of data real? Is the asset critical? Can I move laterally by using this asset? With more rising questions, it will increase the cost of adversary’s operation, also increase adversary’s dispersion and lead to an unsuccessful operation. The adversary engagement is an iterative process to understand adversary behaviors, adapt defensive controls and get more indicators to improve intelligence abilities. Also, improving security teams’ critical and active thinking approaches. Security teams use deception technologies only as “plug and play” decoys to deceive adversaries, but adversaries detect decoys and cut off their management links!!!.. In this talk, I will focus on how to integrate adversary engagement processes and tools to improve defensive approaches practically.