CISA releases decoy strategy guidance

The US Cybersecurity and Infrastructure Security Agency published new guidance urging organizations to deploy honeypots, lures, and honeytokens to detect cyber intrusions and distract attackers with fake materials.

The problem LOTL attackers pose

Many organizations struggle to detect adversaries using legitimate credentials, native tools, and living off the land techniques to discover systems, move laterally, and steal data without triggering alarms.

“Many organizations struggle to detect adversaries who use legitimate credentials, native tools, and living off the land (LOTL) techniques to conduct discovery, move laterally, and access data.”

What cyber decoys actually do

Cyber decoys are fake systems, accounts, or data designed to distract attackers, detect their presence, and gather threat intelligence. They appear legitimate but are purely defensive traps.

“Cyber decoys are assets that appear to be legitimate systems, accounts, or data, but are designed to distract adversaries, detect their presence, or facilitate collection of cyber threat intelligence.”

Decoys fit Zero Trust security

Cyber decoys complement Zero Trust models by supporting continuous monitoring, creating high-fidelity alerts, reducing false alarms, and detecting post-compromise activity like living off the land attacks.

Decoys are cost-effective and scalable

These strategies are incremental, affordable, and can be added to existing security systems without major architectural changes, making them accessible to organizations of all sizes and maturity levels.

Implementation uses MITRE frameworks

CISA's guidance introduces tripwires, breadcrumbs, and honeytokens, using MITRE Engage and MITRE ATT&CK frameworks to provide steps for planning, implementing, and refining decoy operations.