Tanmoy S

According to the 2024 Gartner® Reference Architecture Brief: Network Security report, “Network security underpins connectivity across the extended enterprise, encompassing public cloud, private cloud and on-premises. This brief provides guidance for security and risk management technical professionals on implementing networks securely.”1 Figure 1: Reference Architecture for Network Security The reference architecture shown in Figure 1 above as part of the Gartner® “Reference Architecture Brief: Network Security” consists of eight core components linked by typical logical network flows: enterprise network security, Enterprise edge security, Secure access service edge (SASE), Security service edge (SSE), DDoS mitigation, Transmission security, Cloud network security, and Network security processes.

According to the 2024 Gartner® “Reference Architecture Brief: Endpoint Security report “Endpoint security is the first line of defense for the largest attack surface within any organization. This brief provides guidance for security and risk management technical professionals on what components make up the endpoint security stack and what kind of protection each component provides.”1 Figure 1: Endpoint Security Architecture Diagram Deception technology for “peri-execution” attack detection. The endpoint security architecture (shown in Figure 1 above) describes the technologies that make up an endpoint protection platform. It highlights deception technology as part of peri-execution techniques that are meant to block unwanted actions upon execution. The Gartner report indicates, “ Deception deploys highly credible deceptive artifacts, such as credentials, files, or applications. The first step in the process is to deploy breadcrumbs onto the endpoint. Deceptive artifacts (created in an automated manner) are deployed into the network to deceive attackers and trap them during the early stages of the cyber kill chain”1

The ever-shifting landscape of cyber threats demands constant adaptation and expertise from security professionals. This is where Large Language Models (LLMs) are making a transformative impact. By enabling the development of specialized AI assistants, LLMs empower professionals to work smarter and faster. Here at Acalvio Technologies, we have harnessed the power of LLMs to create an AI Assistant that transforms the way security professionals leverage standardized cybersecurity frameworks. Imagine an assistant that sifts through data to identify threats, and even helps develop effective response strategies – all powered by the vast knowledge and contextual understanding of LLMs. Of course, challenges remain. The computational power required and the need for specialized training present hurdles. However, the potential benefits are undeniable. Leveraging the wealth of cybersecurity defensive knowledge sources, the Acalvio AI Assistant provides comprehensive, real-time, up-to-date answers, thereby enhancing user efficiency and effectiveness. This blog post delves into the process of building a LLM based AI assistant. We’ll discuss the key components involved, including LLMs, datasets, RAG technology, vector databases, and how we evaluate the final product.

One hundred and forty pages strong, the Health Industry Cybersecurity Practices (HICP) Technical Volume 2: Cybersecurity Practices for Medium and Large Healthcare Organizations document is a technical volume that provides an overview of cybersecurity practices that have been outlined by the U.S. Department of Health & Human Services (HHS) as highly effective at mitigating risks in the healthcare industry. There are many great insights in the document, and one that we were super excited to see was the inclusion of deception technology as a critical component of a comprehensive security posture. Cyber deception is a technique that many organizations have used to create decoys, traps, and other mechanisms that mislead attackers and divert their attention away from actual targets. The document suggests that deception technology is useful for detecting and responding effectively to attacks, and for gaining insights into an attacker’s tactics, techniques, and procedures (TTPs). We applauded their recognition of the compelling reasons to add deception to an organization’s security posture. Some of these highlights include: Reduction of dwell time, which is achieved with early detection and by diverting an attacker’s attention, so they reveal their presence. Therefore, reducing the time they have to spend time in the network. Improvement in threat intelligence that is gained through insights into the TTPs of attackers. Increased situational awareness can be achieved by using decoys and other mechanisms, while providing early warnings of potential attacks. The report (Section 8.l.F) includes how Healthcare Delivery Organizations (HDOs) can implement cyber deception techniques, such as deploying honeypots, honeytokens, and other decoys, to create a layered defense and make it more difficult for attackers to gain access to sensitive data. Benefits such as disrupting attacks, early warning of intrusions, and reduction to the impact of a successful attack were also noted. The document goes on to suggest that using cyber deception as an additional layer of defense will improve an organization’s ability to detect and respond, gather threat intelligence, and reduce the impact of a cyber incursion. The cyber deception landscape has undergone many changes since inception, ranging from technology enhancements to integration into other vendor technologies through partnership and acquisition. The Acalvio Defense platform is designed for AI- driven autonomous deception and carries the most patents, 25 in total, that protect complex environments across all industries, both on-premises, and in the cloud. Acalvio also has Federal Risk and Authorization Management Program (FedRamp) certification, further validating Acalvio cloud service offerings (CSOs) on their efficacy related to security assessment, authorization, and continuous monitoring. The use cases for deception in healthcare organizations can be quite extensive. However, Acalvio has found Advanced Persistent Threat (APT) attacks, ransomware, insider threats, and identity threats to be amongst the most popular and consistently deployed. APT attacks are particularly concerning to healthcare organizations because they are sophisticated, stealthy, and can go undetected for long periods of time. APTs are designed to infiltrate a network and remain undetected for extended periods, stealing sensitive data or causing damage. Acalvio deception detects APTs by creating false environments that appears to be legitimate but are actually lures and traps designed to detect and analyze malicious activity. Insider threats occur when someone with employee, contractor, or third-party access to a network or system misuses that access to cause harm or the theft of data. Acalvio deception efficiently identifies insider threats by embedding deceptions into the data, deploying deceptive identities and creating false environments that are designed to accurately detect unauthorized access. Because deception does not have a production role, any attempt to use the deceptions creates a high-level alert that carries detailed evidence substantiation that can dramatically reduce investigation time. Ransomware attacks have continually attacked healthcare organizations due to their complex environments, fluid workforce, and a range of challenges that can prevent the best cybersecurity operating environments. Ransomware groups generate new variants through Ransomware-as-a-Service (RaaS) affiliates, evading traditional security. Acalvio deception creates a variety of snares for attackers that will detect credential misuse, privilege escalation, deletion of backups and propagation attempts. Ransomware can move very quickly and since deception does not rely on baselines or trends, it is proven to be an imperative alerting mechanism for early ransomware detection, including evolving variants. Identity Threat Detection and Response (ITDR) is another key deception use case. The misuse of credentials is not new, and as most know, is a staple in almost every attack. Gartner, Inc. coined the term ITDR in 2022 based on the need to educate organizations on Zero Trust architectures and why network-based security is not sufficient for detecting and deterring attacks using credentials and privilege escalation. Endpoint Detection and Response (EDR) vendors have taken note with SentinelOne acquiring Attivo Networks and CrowdStrike partnering with Acalvio. You can read more about the CrowdStrike and Acalvio partnership at our web page. The highlight of this partnership is that it enables deceptions to be deployed at scale without requiring an additional agent. Now, CrowdStrike customers can deploy Acalvio deception and identity solutions across the organization and manage the detections in CrowdStrike’s incident response dashboard. Acalvio uses AI to refresh the deception environment for authenticity and scale. Another recent document of worth noting is the technical report called the HHS Cybersecurity Program: Cybersecurity Framework Profile for Healthcare Delivery Organizations. This also discusses the importance of cyber deception as a key strategy for protecting healthcare organizations from a variety of cyber threats. In this report they included additional use cases for deception, which included social engineering and attacks against network connected medical devices. Medical devices based on IoT can be challenging to protect against threats due to their inability to upgrade, inability to deploy EDR agents and limited downtime windows. Acalvio deception plays an important role in IoT because it can use decoy elements such as false credentials, simulated data, and decoys to detect malicious network activities without having to load software on the devices. It is another use case for deception for creating layers of defense in specialized networks. Many healthcare organizations have successfully deployed cyber deception and have realized its benefits towards patient safety and well-being. It is exciting to see deception receive an important recommendation in this new journal. Deception technology serves to efficiently address a wide range of cyber threats, including APTs, insider threats, ransomware, identity, IoT, and social engineering attacks. By creating false environments that appear legitimate, cyber deception non-disruptively lures, detects, and diverts attacks making it faster and easier for security teams to eradicate the threat before it can cause harm. Click here to request a consultation or for insights into what’s new in cyber deception in 2024.

In the world of digital defenses and ever-changing threat landscapes, October holds a special significance – it is Cybersecurity Awareness Month! While we observe this Awareness Month with great enthusiasm, at Acalvio we believe cybersecurity is about more than a single month; it should be a year-round commitment to strengthening our digital defenses. Cybersecurity Awareness Month, initially known as National Cyber Security Awareness Month (NCSAM), was established in 2004 by the National Cyber Security Alliance (NCSA) and the U.S. Department of Homeland Security. This month was created with the goal to elevate cybersecurity education and awareness across the United States. Fast forward to today, where it has become a vibrant, widely observed global initiative. With this rich history in mind, let’s look at a history of our own: how Cyber Deception and Active Defense have evolved over the years, and how they help organizations and defenders stay ahead of emerging and evolving threat landscapes as well as the increasingly vital role deception is playing in our defense strategies. Cyber deception differs markedly from traditional cybersecurity methods, offering a proactive strategy that confuses and diverts attackers away from critical assets. This approach not only detects and distracts adversaries, but also provides security teams with time to analyze their tactics and respond effectively. Deception’s adaptability and continuous evolution make it a powerful capability in the battle to secure key assets, identities, applications, and data across multiple environments – on-premises, cloud, ICS/OT, and IIoT networks. Though deception was once a niche concept in cybersecurity, it has evolved dramatically over the years, transforming into an advanced and indispensable early threat detection and response system. In its nascent stages, deception primarily relied on honey pots, which were decoy systems designed to lure attackers away from assets. While effective in some cases, these techniques were relatively simplistic, often struggling to keep pace with the increasing complexity of enterprise networks, expanding access boundaries, and the rapidly evolving sophistication employed by threat actors. As adversaries became more adept at evading traditional security measures, deception underwent a profound transformation. Modern deception systems leverage artificial intelligence, machine learning, and advanced predictive analytics to create highly realistic and attractive deceptions and traps within an organization’s network. The assortment of the deception palette has also grown remarkably to suit the purpose and different use cases for deception deployment. Deception types are no longer just decoy systems and honeypots. At Acalvio, we design precision-engineered endpoint deceptions, tripwires, lures, and honeytokens that all enable early and high-fidelity threat detection. Deception technologies not only mislead and divert attackers from key assets; they also actively detect and analyze their activities. Active Cyber Defense effectively changes a defense team’s position from postmortem analysis of what the attacker did to predicting what an attacker might do, enabling them to take appropriate measures to strengthen their defenses before the threat strikes. Cyber deception has become a cornerstone of modern proactive cybersecurity and Active Defense, offering organizations a dynamic and agile approach to high-fidelity threat detection and response. With Acalvio’s world-class deception platform, organizations have the ability to turn the tables on the attackers: by empowering the defenders with the attacker’s view of the network, predicting attack trajectories, detecting the threats early, and impacting the attacker’s speed, attack paths, and cost – all with precision and speed. The evolution of Cyber Deception reflects the industry’s recognition of the need for sophisticated, and adaptive measures to counter an ever-evolving cyber threat landscape. With deception systems continually innovating to outsmart attackers, deception plays a vital role in bolstering the resilience of modern digital infrastructures. Deception technology is irrefutably a new layer on the existing security solutions to provide compelling defense-in-depth capability to enterprises. We wish you a safe and vigilant Cyber Security Awareness month! Are you looking to learn more about Deception Technology or considering adopting the solution? Reach out to us at info@acalvio.com!

The previous post in the Identity Security blog series covered identity-based attacks and why there has been an increase in the number and types of such attacks. This blog describes the identity security ecosystem. The blog covers the components of an identity security ecosystem, what each component does in an enterprise, and describes some limitations. In any enterprise, there is an existing ecosystem for identities and their management. Starting with the identity repositories, authentication, and access policies, and covering the trust relationship definitions at macro and micro levels. Organizations have multiple solutions in place for managing this ecosystem.

Generative AI has taken the world by storm. It has become an exciting and rapidly developing field that involves the creation of images, videos, music, text, and other data using generative AI models. According to a Gartner article, AI-powered chatbots are just the beginning; enterprise uses for generative AI are far more sophisticated. The Gartner article summarizes several applications of generative AI in healthcare, marketing, and other industries. Here, we discuss how Generative AI can be leveraged for cybersecurity, specifically for identity protection. Most data breaches involve attacks on identities. The SolarWinds/APT 29 attack, Twitter breach, and ransomware attacks by LockBit and REvil are examples of high-profile attacks that involved identity compromises. Attackers can launch identity attacks by using openly available tools such as Mimikatz and LaZagne to access cached credentials on endpoints. Attackers might also use brute force techniques like password spraying and credential stuffing to attack identity artifacts such as NTLM hashes, Kerberos tickets, and SAML tokens. They can exploit user/service account misconfigurations that provide credential access through identity-specific offensive techniques, such as Kerberoasting and AS-REP Roasting. They are attacking identity stores such as Active Directory (AD), AzureAD, Azure AD Connect, Active Directory Federation Services (ADFS), and Active Directory Certification Services (ADCS). By using DCSync/DCShadow attacks against AD, attackers can gain access to the credentials of any account and disable MFA policies. Identity threats are a serious problem, and enterprises need to prioritize and make identity defense an integral part of the overall cybersecurity strategy. Acalvio’s Active Directory Protection solution discovers identities from various enterprise identity stores such as AD, ADCS, AzureAD & M365, and identifies attack surfaces that an attacker can exploit. The solution also identifies key assets that are at high risk of being attacked. Typically, attackers target key assets and privileged user/service accounts associated with them. For example, network shares may have cached credentials of domain admins/privileged accounts. An attacker would attempt lateral movement to a network share to gain access to these credentials. Similarly, an enterprise may have several Kerberoastable service accounts and their credentials may be cached on various endpoints. The Acalvio solution discovers all such attack surface elements that can be exploited by an attacker.   Figure 1: Combining Generative AI with Systems Engineering Creates Disparate Deceptions In recent years, the use of Generative AI has shown great potential for enhancing cybersecurity. The Acalvio solution employs Generative AI to recommend decoy identities to be added to AD and decoy tokens to be placed on real endpoints. The deception types and their placements are determined by AI algorithms so that the deceptions can lure, deceive, and divert advanced threats lurking inside the enterprise network. These AI algorithms can recommend thousands of decoy identities and decoy tokens that can be added to identity stores like AD and endpoints, respectively. As shown in the above figure, by combining systems engineering with Generative AI, the Acalvio solution creates deceptions for all types of assets, such as decoy identities for Active Directory, decoy tokens for endpoints, decoy computers for networks, decoy IOT devices, and so on. The Al algorithm computes the number of deceptions (or deception density), deception types, and deception placements, and also makes the deceptions attractive so that attackers interact with them. By combining Generative AI with other AI algorithms, the Acalvio solution can ensure that the deceptions blend well with enterprise identities and network assets. Deceptions deployed by the Acalvio solution raise alerts when an attacker interacts with them. These alerts are high-fidelity alerts because enterprise users would not interact with the deceptions. AI algorithms in Acalvio’s solution can also identify thousands of attack paths to key assets and the attack surface that an attacker can exploit to take over key assets. These attack paths are identified by combining data from multiple data sources (AD, Azure AD, endpoints, applications). Information about these attack paths is leveraged to determine the best placement locations for deceptions. The Acalvio approach is free of false positive challenges associated with traditional, anomaly-based detection mechanisms. Also, deception-based identity threat defense does not leverage signatures or rules and so it does not need to be updated for new identity threats. Acalvio’s Identity Theft and Detection Response provides a solution to protect identities using a novel set of AI algorithms, Generative AI, and systems engineering.

In a previous blog, we provided an overview of AD Attack Surface and AD Attack Paths. In Part 3 of this series, we’ll explore Acalvio’s Active Directory (AD) security solution that is designed to protect AD against advanced persistent threats (APT). Cybersecurity defense is a moving target. New and sophisticated attack variants are continuously appearing, APTs are constantly revising their strategy and seeking weaknesses in business security implementations, making it imperative for enterprises to continuously refine their security stack. Organizations often use either siloed security tools or a combination of multiple cybersecurity products that collect huge volumes of data, independently. This results in disparate and disconnected systems. While standard security solutions offer capabilities for detecting and preventing a range of Active Directory attacks, they provide a limited solution for advanced threat defense against Active Directory. Cybersecurity requires an integrated strategy that augments standard security tools with an Advanced Deception Platform to effectively protect enterprises from Active Directory exploits. Acalvio ShadowPlex offers a differentiated, best-in-class AI-based deception solution for Active Directory security. The combination of deceptions with AI-powered analytics serves as a powerful mechanism to protect the enterprise from known and new variants of Active Directory exploits, such as AS-REP Roasting, DCSync, Kerberoasting, Unconstrained Delegation, Pass-the-Hash among others. This approach is built on Acalvio’s unique and powerful Active Directory Protection Kill Chain.

In a previous blog, we provided an overview of the (unfortunately quite complex) Active Directory Attack Surface. In Part 2 of this series, we’ll explore how attackers and malicious users plan their movement and traverse Active Directory attack paths once they have discovered AD vulnerabilities, misconfigurations, and other weaknesses that they can exploit.

An Active Directory (AD) compromise has been at the core of several cyberattacks, such as the SolarWinds hack and the Ransomware attack on Colonial Pipeline. Potential vulnerabilities, such as nOAuth on Microsoft Azure Active Directory, have been identified by security researchers. When the first version of Microsoft Active Directory was released two decades ago, it was built on the philosophy of inherent trust models within the boundaries of a network. Given these legacy architectural principles, Active Directory security is a challenge. As an enterprise grows, new users, computers, applications, and cloud services are added to the enterprise network. Each addition is a new object that is managed in the AD. Administrators must set up new accounts, grant required permissions to these accounts, and enable these accounts to communicate with devices and applications. These factors make Microsoft Active Directory security very complex. In this 3-part series, we look at protecting Microsoft Active Directory, which is central to most enterprise architecture. This series covers: Understanding the AD Attack Surface. A look at Attack Paths How Advanced Deception can be used to protect the AD. This first blog discusses the AD Attack Surface and Microsoft Active Directory vulnerabilities that attackers can exploit to perform lateral movement, escalate privileges, and to maintain persistence in the enterprise network.