Description
Apply lessons learned from deception intelligence to harden production infrastructure. Address the vulnerabilities, misconfigurations, and access patterns that adversaries attempted to exploit in the deception environment, because they will attempt the same in production.
Rationale
Deception environments reveal what adversaries try to do once they gain access. If adversaries consistently target a particular service type, credential storage pattern, or network path in the deception environment, it is reasonable to assume they will attempt the same against production. Hardening these specific areas directly reduces organizational risk.
Supporting Basis
Author-derived extensionThe sources motivate applying deception observations to defensive improvement but do not directly validate this lifecycle record.
- Almeshekah, M.H.; Spafford, E.H. Planning and Integrating Deception into Computer Security Defenses. NSPW 2014.Peer reviewed
- The MITRE Corporation. A Practical Guide to Adversary Engagement, version 1.0. 2022.Technical guide
These sources establish design lineage and scope. They do not validate this record's operational effectiveness, planning estimates, environment labels, or ATT&CK relationships.
Implementation Steps
Identify targeted attack surfaces
Review deception intelligence to identify which services, configurations, and access patterns adversaries targeted most aggressively.
Assess production exposure
Determine if the same attack surfaces exist in production infrastructure. Assess the risk if adversaries apply the same techniques to real systems.
Develop hardening plan
Create a prioritized hardening plan that addresses the most frequently targeted and highest-risk attack surfaces first.
Implement and validate
Apply hardening measures to production infrastructure and validate that the changes reduce the targeted attack surface without impacting operations.
Technical Implementation Examples(1)
Hardening Recommendations from Deception Intelligence
Ansible playbook to apply infrastructure hardening based on attack patterns observed in the deception environment
# playbooks/harden-from-deception-intel.yml
# Apply hardening based on adversary behavior observed in deception.
# Derived from engagement SHD-2026-0042 findings.
---
- name: Harden Production Based on Deception Intelligence
hosts: production_servers
become: true
tasks:
# FINDING: Adversary harvested credentials from config files
# ACTION: Restrict file permissions on all config directories
- name: Restrict config file permissions
ansible.builtin.file:
path: "{{ item }}"
mode: "0600"
owner: root
group: root
loop:
- /opt/application/config/database.yml
- /opt/application/.env
- /etc/application/secrets.yml
when: ansible_hostname in groups['app_servers']
# FINDING: Adversary used cat to read sensitive files
# ACTION: Enable auditd monitoring on config directories
- name: Add audit rules for config file access
ansible.builtin.lineinfile:
path: /etc/audit/rules.d/config-access.rules
line: "{{ item }}"
create: true
loop:
- "-w /opt/application/config/ -p r -k config_read"
- "-w /etc/application/ -p r -k config_read"
- "-w /home/ -p r -k home_dir_read"
notify: restart_auditd
# FINDING: Adversary moved laterally via SSH
# ACTION: Restrict SSH access to bastion hosts only
- name: Restrict SSH source addresses
ansible.builtin.blockinfile:
path: /etc/ssh/sshd_config
marker: "# {mark} ShadowMatrix CDF hardening"
block: |
# Restrict SSH to bastion hosts only
AllowUsers *@10.0.1.10 *@10.0.1.11
MaxAuthTries 3
LoginGraceTime 30
notify: restart_sshd
handlers:
- name: restart_auditd
ansible.builtin.service:
name: auditd
state: restarted
- name: restart_sshd
ansible.builtin.service:
name: sshd
state: restartedConsiderations
- Prioritize hardening based on what adversaries actually targeted, not on generic best-practice lists. Deception intelligence tells you what matters to your specific adversaries.
- Validate hardening changes in staging before production deployment. Security improvements that break operations are counterproductive.
- Some targeted attack surfaces may be fundamental to the architecture and cannot be easily hardened. In these cases, increase monitoring as a compensating control.
Supported Environments
Tools & Resources
- Configuration management tools
- Vulnerability scanners
- CIS Benchmarks
- Hardening guides
Related Techniques
Quick Stats
- Phase
- Respond
- Difficulty
- intermediate
- Detection Value
- medium
- Cost
- moderate
- Time
- 1-4 weeks
- ATT&CK Mappings
- 0