Security System Deception Tactics

Implementing a Data Loss Prevention strategy can improve the actual security of a system, but not the perceived security.

Data Loss Prevention is only concerned with securing data at rest.

Raising the perceived risk of a potential intruder being caught is a tactic in Data Loss Prevention.

DLP controls are based on a specific type of threat detection.

The primary goal of Data Loss Prevention is to reduce the apparent value of the system's worth.

There has been a shift in attention and investment from securing the network to securing systems within the network and to securing the data itself.

Intrusion deflection is a type of SIEM system that helps coordinate security activity on a network.

Analyzing database transaction logs involves examining what SQL statements are executed on the target system.

Intrusion deterrence is a type of NIDS deployment strategy that involves placing sensors in a network.

SIEM systems are used to detect and respond to threats in real-time.

Header signature analysis involves analyzing database transaction logs.

NIDS sensors are typically placed in a network to detect and respond to threats.

A network-based IDS can monitor network traffic on multiple segments and traffic on other means of communication, such as phone lines, simultaneously.

A string signature for a UNIX system might look for a text string that indicates a possible attack, such as "cat " + " >/.rhosts".

A port signature involves looking for a text string that indicates a possible attack.

A NIDS can capture all network traffic that crosses its network segment by placing the network interface card in normal mode.

A header condition signature is used to detect anomalies in network traffic patterns.

A compound string signature is used to refine a port signature to reduce the number of false positives.