A new guide for defensive deception
CISA released guidance September 16 on using cyber decoys to improve detection and response in critical infrastructure environments. The agency describes deliberately placed systems and information that can help defenders observe malicious activity, including intruders using legitimate tools and credentials. Its approach draws on MITRE ATT&CK and Engage. The guide is a defensive planning resource; it does not establish that deploying a decoy by itself will prevent compromise.
Start with the decision an alert should trigger
The appeal of a decoy is that interaction with something ordinary users should not need may provide useful investigative context. Our analysis is that the design should begin with the response team, not the appearance of the lure. Who receives the event? What context will they need? Which authorized processes might also touch the resource? Without those answers, a new detection can create another queue rather than a faster path to understanding an intrusion.
Keep the operational environment in view
For an energy operator, any proposed deployment should be reviewed by the personnel responsible for the affected network and physical process. A transportation organization should similarly account for service continuity and the systems supporting dispatch or operations. These are suggested planning considerations, not recommendations to place untested devices directly into operational networks. A controlled initial deployment should have an owner, a defined boundary and a removal plan if it interferes with normal work.
Test the full response, not just the sensor
We recommend an authorized exercise that generates a known test event and follows it through triage, investigation and closure. Measure whether the responder can distinguish the test from ordinary activity and explain what would happen next in a real incident. Record dependencies such as after-hours staffing and access to supporting logs. A successful pilot should show that the organization can use the signal safely and consistently. The purchasing question then becomes more concrete: does this capability improve a decision the team can actually make?
Sources & further reading
Our practical suggestions are editorial guidance. Verify applicability against current source and vendor instructions.
