CISA Publishes Its First Guide to Cyber Decoys
Tripwires, breadcrumbs and honeytokens, mapped to MITRE ATT&CK and Engage, built from tools operators already own. The target is the intruder who uses valid credentials and triggers no alert.
On 16 September CISA published Using Cyber Decoys to Strengthen Detection and Response, which the agency describes as its first detailed explanation of the defensive cyber decoy process. It is aimed at federal government, industry, small and medium businesses, and state, local, tribal and territorial government.
The problem it addresses is living-off-the-land activity: an intruder who logs in with valid credentials and works with the administrative utilities already present on the system. Nothing malicious is downloaded, so nothing triggers. Chris Butera, CISA's acting executive assistant director for cybersecurity, framed the response as making networks unfriendly places for adversaries and improving resilience to compromise.
Three concepts run through the guide. Tripwires and breadcrumbs are placed to be stumbled over and followed. Honeytokens are data items with no legitimate business use — fake usernames and passwords, API keys, documents, database records, cloud access tokens — so that any interaction with them strongly suggests unauthorised activity. All three are mapped against the MITRE ATT&CK matrix and the MITRE Engage framework, and positioned as complementary to a zero trust architecture rather than a substitute.
The procurement advice is unusually direct. CISA tells organisations to repurpose tools they already own — EDR platforms, identity and access management, data loss prevention — rather than buying a deception product, and points budget-constrained teams at open-source options for token generation, deployment and alerting. Claimed benefits are earlier detection, intelligence on adversary behaviour, better resource allocation and a lower mean time to detection.
OT networks happen to suit this approach well. Traffic is predictable, and nobody has a legitimate reason to authenticate to a fake engineering workstation or use a planted PLC credential, so the false positive rate approaches zero. For a plant with no security operations centre, a handful of honeytokens costs less than a monitoring contract and may be the first signal anyone gets that someone is walking the network.