Endpoint Sensor Module for Deception Data Interception
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Once an endpoint system is compromised, attackers can move laterally in the network, harvesting data to gain unauthorized access to application data, which existing methods fail to effectively prevent.
Innovation Solution
Implementing a sensor module on endpoint systems that intercepts file system commands, evaluates their source, and modifies or suppresses unauthorized access by redirecting it to deception data, thereby preventing access to production application data while engaging attackers with a BOTSINK to monitor malicious activity.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional access control methods are used to prevent unauthorized access, then system security is maintained, but attackers can still move laterally and harvest data when the system is compromised
Solution Approach 1:
A sensor module is introduced as an intermediary component that sits between the file system and the application data. This sensor module intercepts file system commands, evaluates their sources, and determines whether to allow or modify the commands. This intermediary layer prevents direct access to production data while maintaining legitimate file system operations, thereby stopping data harvesting by attackers even when the system is compromised.
Solution Approach 2:
The harmful function of file system commands from unauthorized sources is extracted and separated from the legitimate file system operations. The sensor module identifies and isolates commands from unauthorized sources, evaluating them separately from trusted commands. This extraction allows the system to handle potentially malicious commands differently, preventing data harvesting while maintaining normal operations.
2Reliability
If deception data is used to mislead attackers, then access to production data is prevented, but the system complexity increases due to command interception and evaluation mechanisms
Solution Approach 1:
The file system access control mechanism is segmented into distinct functional components: a sensor module for intercepting commands, an evaluation component for assessing command sources, and a decision-making component for determining command disposition. This segmentation allows each component to perform its specific function efficiently, managing the complexity through modular design while maintaining effective protection of production data.
Data Source
AI summary
Endpoints in a network execute a sensor module that intercepts commands. The sensor module compares a source of commands to a sanctioned list of applications received from a management server. If the source does not match a sanctioned application and the command is a write or delete command, the command is ignored and a simulated acknowledgment is sent. If the command is a read command, deception data is returned instead. In some embodiments, certain data is protected such that commands will be ignored or modified to refer to deception data where the source is not a sanctioned application. The source may be verified to be a sanctioned application by evaluating a certificate, hash, or path of the source.