A security architecture team is designing an active defense strategy to detect threat actors performing lateral movement within a cloud-hybrid network. The team specifically wants to plant decoy authentication credentials into workstation memory and local caches so that any credential dumping attempt immediately generates high-fidelity alerts without exposing production directory services. Which of the following deception technologies best fulfills this operational requirement?
- Placing honeytokens within endpoint credential caches to act as decoy authentication material that alerts security operations upon accessAnswer
- BReconfiguring the endpoint intrusion prevention system (IPS) to operate as an inline decoy that redirects unauthorized LSASS reads to a honeynet
- CProvisioning a high-interaction honeypot service directly on the production domain controller to capture hash-harvesting attempts
- DDeploying host-based microsegmentation firewalls to block unauthenticated process execution across endpoint subnets
Answer
Placing honeytokens within endpoint credential caches to act as decoy authentication material that alerts security operations upon access
Honeytokens (and breadcrumbs) are fake credentials, tokens, or data planted in places like LSASS memory, configuration files, or credential managers. When an attacker attempts to harvest and use these decoy credentials, security systems generate high-confidence alerts, detecting lateral movement early without placing actual production directory services at risk.
Step-by-Step Solution
Key Concept
Deception Technologies (Honeytokens and Breadcrumbs)