Honeypot Boo Boo: Better Breach Detection with Deception Inception

No ratings

Presented at BSides Munich 2023 by

Justin Varner

Breaches continue happening at unprecedented levels with huge financial impact to the global economy year after year. Our traditional approach to breach detection that is focused on triaging alerts generated by massive amounts of data from disparate sources is not working. Adversaries know this fact and regularly benefit from it. The average breach goes unnoticed for 212 days. That’s an ample amount of time for anyone to surreptitiously run off with the crown jewels and inflict significant damage with ramifications that include consumer privacy violations, loss of trust, steep financial penalties, and irreversible reputational damage. We need a new approach if we’re ever going to stop the madness. Hackers also deserve a better opponent. This talk discusses a different way of thinking about breach detection that is intended to reduce the number of false positives, improve alert fidelity, reduce time-to-detection, and prevent the massive level of burnout affecting our industry. We will cover the history of breach detection, the current state of affairs, the paradigm shift to new ways of thinking about the problem, and many practical examples of how to deploy effective breach detection technology.