CISA Urges Critical Infrastructure to Plant Decoys Inside Networks
CISA's first decoy guidance tells critical infrastructure to deploy honeytokens and tripwires inside networks, mapped via MITRE ATT&CK and Engage, to speed detection.
CISA published its first detailed cyber decoy guidance on September 16, urging critical infrastructure organizations to plant honeytokens such as fake credentials, records, and files with no legitimate business use inside their networks. The guide recommends deploying high-fidelity tripwires in high-value areas, mapping decoy coverage with MITRE ATT&CK and MITRE Engage, and continuous refinement through threat emulation. It is positioned as a complement to Zero Trust, contains no mandatory measures, and targets small and medium-sized organizations and defenders new to deception operations.
- CISA's first detailed cyber decoy guidance published September 16
- Focuses on honeytokens over internet-facing honeypots
- Recommends MITRE ATT&CK and Engage to map decoy coverage
- Aimed at small-to-medium organizations and deception newcomers
- Positions decoys as a complement to Zero Trust
Full article478 words · extracted from infosecurity-magazine.com · click to collapse
CISA has urged critical infrastructure organizations to plant fake files, accounts and credentials inside their networks to catch attackers who are already past the perimeter.
The guidance on cyber decoys, published September 16, is the agency's first detailed treatment of the process. It assumes intruders will eventually gain some level of access.
The approach matters most where adversaries use legitimate credentials and native tools to move around, which conventional monitoring struggles to separate from normal activity.
CISA framed decoys as an addition to Zero Trust rather than a replacement. The new guidance does not contain any mandatory measures.
Focus on Honeytokens Over Honeypots
The guide deliberately narrows its scope around the use of decoys. It covers decoys placed inside an organization's own networks and systems rather than the internet-facing honeypots the term usually evokes.
That pushes honeytokens to the front. CISA defines them as data items with no legitimate business use, such as fake records, credentials or files planted among real assets, where any interaction strongly suggests unauthorized activity.
Its own comparison rates honeytokens low in complexity against medium to high for honeypots, which operate at system level and carry deliberate vulnerabilities. The worked example in the guide is a honeytoken tripwire on a project share.
Tripwires are the mechanism. Because staff have no reason to touch a decoy, an alert from one arrives with far less noise than conventional tooling generates, which is how CISA expects organizations to cut mean time to detection (MTTD).
Read more on cyber deception: NCSC Plugs Gap in Cyber Deception Guidance
Three Actions and a Testing Loop
CISA sets out three key actions for organizations to take: deploy high-fidelity tripwires in high-value areas, use MITRE ATT&CK and MITRE Engage to map adversary tactics against decoy coverage, and refine the whole thing continuously through threat emulation.
Engage is MITRE's framework for planning adversary engagement. It sorts defensive objectives into Expose, which detects intruders, Affect, which disrupts or delays them, and Elicit, which studies their techniques in controlled environments.
CISA's practical material covers Expose. The agency describes the guide as an introductory resource for small to medium-sized organizations and for defenders new to decoy operations or to Engage itself.
Sysdig senior cybersecurity strategist Crystal Morin pointed to research her team had already run. Investigating exploitation of a marimo flaw, they planted a prompt injection in a vulnerable container, telling any large language model that read the file to echo a hidden marker.
"Every AI-driven operator we tracked did exactly that," she said. "AI can't help but follow instructions. That's a notable advantage for defenders against machine-driven attackers."
A human attacker in the same research opened the file twice, recognized the bait and stepped over it. Morin said the right decoy in the right place cuts time to detect, but the decoy has to match the adversary, and a distraction is not containment.
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.infosecurity-magazine.com/news/cisa-critical-infrastructure-cyber/