John Strand
Presents john Strand and evaluates key implications for security practitioners.
Summary
Why deception belongs early
John Strand argues cyber deception is essential now, not something to defer until perfect defenses exist. Homogeneous endpoint and firewall stacks make attacker bypass predictable; deception adds randomness and risk for adversaries.
Easy starting points
He highlights Thinkst Canary Tokens for simple callback artifacts (documents, PDFs, S3 buckets) and the DARPA-funded ADHD VM bundling deception tools from Black Hills Information Security and Secure Ideas.
Catching cloned login pages
Embedded JavaScript on authentication pages detects when a cloned site loads outside the real domain and phones home, exposing attacker IPs before phishing emails send. Black Hills uses a private Canary server and has caught active clone attempts.
Beyond login traps
Strand contrasts stale IOC feeds with real-time, organization-specific intelligence from deception, and describes bait documents on shares with keywords like passwords or SCADA to trap post-exploitation search tools.
Related talks
PancakesCon 3·51 min
Examines elle Armageddon and evaluates key implications for security practitioners.
PancakesCon 3·42 min
Structuring Intelligence Assessments · Gin Cocktails
Presents robert M. Lee and evaluates key implications for security practitioners.
PancakesCon 3·40 min
Security Champions · Urban Gardening
Evaluates tanya Janca and evaluates key implications for security practitioners.