The Fine Art of Frustrating the Adversary
Cisco Talos researchers share defender techniques—deception, honeypots, behavioral detections, and AI agent boundaries—to slow and expose adversaries.
For Cybersecurity Awareness Month, eight Cisco Talos researchers offer practical recommendations for frustrating adversaries at different stages of an operation. Suggestions include honeypot email accounts built from expired domains, fictional employee profiles, tarpits, false servers and shares, behavioral detections targeting credential-access behaviors rather than specific tools, restricting admin logons to critical servers, and tighter boundaries around legitimate remote-management tools and AI agents.
- Deception via honeypot accounts, tarpits, and false infrastructure enables early detection
- Behavioral detections should target underlying behaviors, not individual tools like Mimikatz
- Restrict admin access to critical servers and alert on privilege changes
- Breaking dependencies between attack stages blocks adversary objectives
- Organizations
- Cisco Talos
From the original article
11 min read at blog.talosintelligence.com
What really frustrates an adversary? Eight Cisco Talos researchers share practical ways to make their next move slower and riskier. From deception and behavioral detection to breaking attack dependencies and resisting manufactured urgency.
By Hazel Burton · blog.talosintelligence.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.