Retrospectively Using Multilayer Deception in Depth Against Advanced Persistent Threats

Abstract

Defensive cyber deception is useful in both the information and cognitive domains of warfare. Such deception works better when it is multilayer as a defense-in-depth strategy. We developed a tool to analyze the offensive tactics in the MITRE ATT&CK Enterprise framework that were popular with sixteen Advanced Persistent Threat (APT) groups, and identified deceptive defense methods that can counter each technique. With this knowledge defenders can make more informed decisions while planning the deception to use in different layers. We use as examples three recent high-profile APT events, and review how well the deception methods could interfere with them.