Threat Defense: Cyber Deception Approach and Education for Resilience in Hybrid Threats Model
This paper aims to explore the cyber-deception-based approach and to design a novel conceptual model of hybrid threats that includes deception methods. Security programs primarily focus on prevention-based strategies aimed at stopping attackers from getting into the network. These programs attempt t...
| Main Authors: | , , |
|---|---|
| Format: | Article |
| Language: | English |
| Published: |
MDPI AG
2021-04-01
|
| Series: | Symmetry |
| Subjects: | |
| Online Access: | https://www.mdpi.com/2073-8994/13/4/597 |
| _version_ | 1797538907304230912 |
|---|---|
| author | William Steingartner Darko Galinec Andrija Kozina |
| author_facet | William Steingartner Darko Galinec Andrija Kozina |
| author_sort | William Steingartner |
| collection | DOAJ |
| description | This paper aims to explore the cyber-deception-based approach and to design a novel conceptual model of hybrid threats that includes deception methods. Security programs primarily focus on prevention-based strategies aimed at stopping attackers from getting into the network. These programs attempt to use hardened perimeters and endpoint defenses by recognizing and blocking malicious activities to detect and stop attackers before they can get in. Most organizations implement such a strategy by fortifying their networks with defense-in-depth through layered prevention controls. Detection controls are usually placed to augment prevention at the perimeter, and not as consistently deployed for in-network threat detection. This architecture leaves detection gaps that are difficult to fill with existing security controls not specifically designed for that role. Rather than using prevention alone, a strategy that attackers have consistently succeeded against, defenders are adopting a more balanced strategy that includes detection and response. Most organizations deploy an intrusion detection system (IDS) or next-generation firewall that picks up known attacks or attempts to pattern match for identification. Other detection tools use monitoring, traffic, or behavioral analysis. These reactive defenses are designed to detect once they are attacked yet often fail. They also have some limitations because they are not designed to catch credential harvesting or attacks based on what appears as authorized access. They are also often seen as complex and prone to false positives, adding to analyst alert fatigue. The security industry has focused recent innovation on finding more accurate ways to recognize malicious activity with technologies such as user and entity behavioral analytics (UEBA), big data, artificial intelligence (AI), and deception. |
| first_indexed | 2024-03-10T12:37:51Z |
| format | Article |
| id | doaj.art-9ae3698aa67c4b178e7d14e8c70acb69 |
| institution | Directory Open Access Journal |
| issn | 2073-8994 |
| language | English |
| last_indexed | 2024-03-10T12:37:51Z |
| publishDate | 2021-04-01 |
| publisher | MDPI AG |
| record_format | Article |
| series | Symmetry |
| spelling | doaj.art-9ae3698aa67c4b178e7d14e8c70acb692023-11-21T14:07:15ZengMDPI AGSymmetry2073-89942021-04-0113459710.3390/sym13040597Threat Defense: Cyber Deception Approach and Education for Resilience in Hybrid Threats ModelWilliam Steingartner0Darko Galinec1Andrija Kozina2Faculty of Electrical Engineering and Informatics, Technical University of Košice, Letná 9, 042 00 Košice, SlovakiaDepartment of Informatics and Computing, Zagreb University of Applied Sciences, Vrbik 8, 10000 Zagreb, CroatiaDr. Franjo Tuđman Croatian Defence Academy, 256b Ilica Street, 10000 Zagreb, CroatiaThis paper aims to explore the cyber-deception-based approach and to design a novel conceptual model of hybrid threats that includes deception methods. Security programs primarily focus on prevention-based strategies aimed at stopping attackers from getting into the network. These programs attempt to use hardened perimeters and endpoint defenses by recognizing and blocking malicious activities to detect and stop attackers before they can get in. Most organizations implement such a strategy by fortifying their networks with defense-in-depth through layered prevention controls. Detection controls are usually placed to augment prevention at the perimeter, and not as consistently deployed for in-network threat detection. This architecture leaves detection gaps that are difficult to fill with existing security controls not specifically designed for that role. Rather than using prevention alone, a strategy that attackers have consistently succeeded against, defenders are adopting a more balanced strategy that includes detection and response. Most organizations deploy an intrusion detection system (IDS) or next-generation firewall that picks up known attacks or attempts to pattern match for identification. Other detection tools use monitoring, traffic, or behavioral analysis. These reactive defenses are designed to detect once they are attacked yet often fail. They also have some limitations because they are not designed to catch credential harvesting or attacks based on what appears as authorized access. They are also often seen as complex and prone to false positives, adding to analyst alert fatigue. The security industry has focused recent innovation on finding more accurate ways to recognize malicious activity with technologies such as user and entity behavioral analytics (UEBA), big data, artificial intelligence (AI), and deception.https://www.mdpi.com/2073-8994/13/4/597cyber attackcyber deceptioncyber threatshybrid threats modelresilience |
| spellingShingle | William Steingartner Darko Galinec Andrija Kozina Threat Defense: Cyber Deception Approach and Education for Resilience in Hybrid Threats Model Symmetry cyber attack cyber deception cyber threats hybrid threats model resilience |
| title | Threat Defense: Cyber Deception Approach and Education for Resilience in Hybrid Threats Model |
| title_full | Threat Defense: Cyber Deception Approach and Education for Resilience in Hybrid Threats Model |
| title_fullStr | Threat Defense: Cyber Deception Approach and Education for Resilience in Hybrid Threats Model |
| title_full_unstemmed | Threat Defense: Cyber Deception Approach and Education for Resilience in Hybrid Threats Model |
| title_short | Threat Defense: Cyber Deception Approach and Education for Resilience in Hybrid Threats Model |
| title_sort | threat defense cyber deception approach and education for resilience in hybrid threats model |
| topic | cyber attack cyber deception cyber threats hybrid threats model resilience |
| url | https://www.mdpi.com/2073-8994/13/4/597 |
| work_keys_str_mv | AT williamsteingartner threatdefensecyberdeceptionapproachandeducationforresilienceinhybridthreatsmodel AT darkogalinec threatdefensecyberdeceptionapproachandeducationforresilienceinhybridthreatsmodel AT andrijakozina threatdefensecyberdeceptionapproachandeducationforresilienceinhybridthreatsmodel |