EP281: Deceiving Adversaries at Scale with Kevin Conley

Key takeaways

Deception technology, while historically underused, is increasingly vital for modern cybersecurity, especially in cloud environments.
Effective deception requires realistic expectations: it will generate false positives, and perfect coverage is unrealistic; the goal is incremental improvement.
Prioritize fundamentals like asset management and understanding your environment before deploying deception tools to ensure meaningful coverage.
Measuring success involves tracking coverage percentage, signal-to-noise ratio, and benign positives, with iterative testing to improve deployment.

Summary

Introduction and Context of Deception in Security

The episode opens with hosts Tim Peacock and Anton Chivakin discussing the theme of deception in cybersecurity, highlighting a common paradox: everyone agrees that deception could be useful but few actually implement it. They share personal experiences and historical context, noting deception practices like honey pots date back to the 90s but remain underutilized. The discussion introduces Kevin Conley from Riot Games, who specializes in deception technology, setting the stage for a deep dive into modern deception strategies.

Deception Technologies and Cloud Environment Suitability

Kevin Conley explains that deception isn't a new concept but has evolved significantly. Today, it is primarily about creating faster detection and broader coverage, especially in cloud environments. He discusses how simple tactics, like deploying fake resources or text, can effectively cover complex environments without extensive resource investment. The conversation emphasizes the creative potential of deception and its applicability across both traditional and modern cloud infrastructures, with a slight preference for cloud due to higher success rates.

Practical Deployment and Challenges of Deception

Kevin shares insights on starting deception programs, advocating for realistic expectations, emphasizing that no deception tool is perfect—false positives are inevitable. The importance of understanding environment assets and deploying decoys thoughtfully is stressed. He also covers the challenge of achieving comprehensive coverage, especially with legacy systems, and recommends deploying deception incrementally in manageable areas. The discussion underscores that fundamentals like asset management should precede or accompany deception to maximize its effectiveness.

Measuring Success and Program Maturity in Deception

Kevin discusses key metrics for evaluating deception programs, including coverage percentage, signal-to-noise ratio, and benign positives—alerts that are not malicious but noteworthy. He advocates for continuous testing, including red team exercises, to gauge the effectiveness of deception deployments. The importance of iterative improvements and tracking metrics over time is highlighted, alongside the notion that deception is a journey of learning and adaptation.

Final Advice and Reading Recommendations

Kevin concludes with practical tips and resource suggestions. He recommends 'The Kook’s Egg' by Cliff Stole for understanding a professional’s approach to security and 'Freakonomics' by Steven Levitt and Stephen Dubner for asking better questions. These readings inspire curiosity, creativity, and critical thinking—key traits for cybersecurity professionals.