Cymmetria (YC S15) Uses Virtual Machines to Decoy and Detect Hackers

Re:Cymmetria (YC S15) Uses Virtual Machines to Decoy and Det... by ddiinn2 on Saturday June 27, 2015 @08:19PM (#9791944)

- What is alerted on (or "attack") is configurable and can range from code being executed (which is the true positive alert) to connecting to ports(which has more noise)

- It needs to look like the machine an attacker will be after when he's looking around on the network and that's much simpler then a whole loaded up environment.

- Yes, the decoys look like an integral part of the network

- It could be within every segment of the network and not in it's own island. But it's true that every security solution depends on it's management interface not being compromised :)

[ Parent | on HN ]

Re:Cymmetria (YC S15) Uses Virtual Machines to Decoy and Det... by wglb on Sunday June 28, 2015 @09:42AM (#9793425)

One final question.

Let's say that an attacking organization fully installs your sensor in their own lab. What is to prevent them from engineering an approach to fully defeat the sensor itself?

[ Parent | on HN ]

Re:Cymmetria (YC S15) Uses Virtual Machines to Decoy and Det... by ddiinn2 on Sunday June 28, 2015 @09:26PM (#9795959)

Like was said before, you have to attack the decoy to recognize it and that enables catching the attack traffic. Also the mere fact that they recount every single action 10 times over before acting is a huge value in and of itself.

On another note I agree that they will try and we will be constantly remembering that fact :)

[ Parent | on HN ]