Evaluating Deception Theories for Applicability to Cyber Operations

Abstract

Deception is essential to and inherent in cyber operations of all kinds. In defensive cyber operations, deception is the third line of defence after authentication and access control. Deception can be supported by intrusion detection systems monitoring for suspicious activity. Honeypots are the most obvious technique for misleading intruders, but delaying execution of commands, giving false excuses, and lying about the results may be more effective in some circumstances. Proactive defences also depend on deception. In offensive cyber operations, the attacker may manipulate someone to gain information. He/she may masquerade as an authorised user to access the target system or escalate privileges, install a rootkit to conceal his/her actions, bypass access control by installing a back door, or exfiltrate collected data within normal traffic. There is a wealth of theories of deception, overwhelmingly based on the physical world. Some theories are generic, others are specific to military operations, but few are specific to cyber deception. Some focus on the entities involved, while others focus on the deception process, which itself may be organisational or psychological. Several authors warn that analogies drawn from the physical environment may be counterintuitive in cyberspace. As Miller, Brickey and Conti (2012) memorably express it: “weapons can be reproduced instantly, ‘bullets’ travel at near the speed of light, destroyed targets can be brought back from the dead, and a seventeen year old can command an army”. This warning also applies to deception theory. The purpose of this paper is to evaluate key theories of deception for applicability to cyber operations in a multi-domain environment. There are five chapters. After the Introduction, Chapter 2 summarises relevant theory and doctrine. Chapter 3 summarises seven key theories of deception. Chapter 4 evaluates them, and outlines an ideal theory. Finally, Chapter 5 draws conclusions and recommends further work.