Use Real Computers as Decoys

The best deception decoys are the ones that most closely mimic real production assets, says Roger Grimes, data driven defense evangelist at KnowBe4. Attackers can spot a deception device if it is very different from other systems, so the key is to make it appear like another production system. "An attacker cannot tell the difference between a production asset used in production and a production asset that exists solely as a deception honeypot," Grimes says.

Your decoy could be a system you are planning to deprovision because it is old, or it could be a new server or device like others in the environment. Make sure to use the same names -- and put them in the same places -- with all the same services and defenses as your real production systems, Grimes advises.

The key is to blend in, Acalvio's Moy says. Avoid telltale signs such as generic MAC addresses, common operating system patch levels, and system names that don't fit with the prevailing conventions on that network.

Image Source: RLW Photography via Shutterstock