Definition

A Decoy Environment comprises hosts and networks for the purposes of deceiving an attacker.

Technique Overview

Systems in a decoy environment are typically configured so that some detectable means of communication does not have any legitimate business purpose. Any communication via these means should be logged and analyzed to find potential indicators of compromise for a possible past or future attack against other systems.

Artifact Relationships

This defensive technique relates to specific digital artifacts.