Description
Conduct a structured evaluation of the threat landscape to understand which adversaries are most likely to target the organization, what their known capabilities are, and how those capabilities map to the organization's attack surface. This assessment drives every subsequent decision in the deception operation.
Rationale
Deception environments built without understanding the adversary risk being generic or poorly aligned with relevant threats. Profiling threats by industry, geography, and observed behavior can improve the relevance of deception assets and the likelihood of meaningful interaction.
Supporting Basis
Direct antecedentDeception planning begins with threat understanding; MITRE Engage specifies assessment of cyber-threat intelligence and the organizational threat landscape.
- Almeshekah, M.H.; Spafford, E.H. Planning and Integrating Deception into Computer Security Defenses. NSPW 2014.Peer reviewed
- The MITRE Corporation. A Practical Guide to Adversary Engagement, version 1.0. 2022.Technical guide
- Strom, B.E. et al. MITRE ATT&CK: Design and Philosophy. The MITRE Corporation, revised 2020.Technical report
These sources establish design lineage and scope. They do not validate this record's operational effectiveness, planning estimates, environment labels, or ATT&CK relationships.
Implementation Steps
Inventory existing threat intelligence
Gather all available threat intelligence reports, industry alerts, and incident history relevant to your organization. Include both commercial threat feeds and open-source intelligence.
Identify relevant threat actors
Based on your industry vertical, geographic presence, and asset profile, identify the threat actors most likely to target your organization. Prioritize based on capability and intent.
Map adversary TTPs
For each prioritized threat actor, document their known techniques, tactics, and procedures using the MITRE ATT&CK framework as a common reference.
Assess attack surface overlap
Compare mapped adversary TTPs against your organization's actual attack surface to identify which techniques are most likely to be employed against your specific infrastructure.
Produce threat profile dossiers
Create structured dossiers for each priority threat actor that will guide deception asset design in subsequent phases.
Technical Implementation Examples(2)
Threat Actor TTP Mapping Script
Script to pull ATT&CK technique data for a given threat group and generate a coverage heat map for deception planning
"""
Threat landscape assessment: map known threat actor TTPs
to inform deception asset design decisions.
"""
import json
import urllib.request
from collections import defaultdict
ATTACK_URL = "https://raw.githubusercontent.com/mitre/cti/master/enterprise-attack/enterprise-attack.json"
def fetch_attack_data():
"""Fetch the ATT&CK STIX bundle."""
with urllib.request.urlopen(ATTACK_URL) as resp:
return json.loads(resp.read())
def get_group_techniques(bundle, group_name):
"""Extract techniques used by a specific threat group."""
objects = bundle["objects"]
# Find the group object
group = next(
(o for o in objects
if o["type"] == "intrusion-set"
and group_name.lower() in o.get("name", "").lower()),
None
)
if not group:
return []
# Find relationships from group to techniques
relationships = [
o for o in objects
if o["type"] == "relationship"
and o.get("relationship_type") == "uses"
and o.get("source_ref") == group["id"]
]
# Resolve technique details
technique_ids = {r["target_ref"] for r in relationships}
techniques = [
o for o in objects
if o["id"] in technique_ids and o["type"] == "attack-pattern"
]
return techniques
def generate_deception_coverage_report(techniques):
"""Map adversary techniques to deception opportunities."""
tactic_coverage = defaultdict(list)
for tech in techniques:
for phase in tech.get("kill_chain_phases", []):
tactic = phase.get("phase_name", "unknown")
tactic_coverage[tactic].append({
"technique": tech["name"],
"id": tech.get("external_references", [{}])[0].get(
"external_id", "N/A"
),
})
print("=" * 60)
print("DECEPTION COVERAGE ASSESSMENT")
print("=" * 60)
for tactic, techs in sorted(tactic_coverage.items()):
print(f"\n[{tactic.upper()}] ({len(techs)} techniques)")
for t in techs:
print(f" {t['id']}: {t['technique']}")
return tactic_coverage
if __name__ == "__main__":
bundle = fetch_attack_data()
# Example: assess APT29 techniques for deception planning
techniques = get_group_techniques(bundle, "APT29")
if techniques:
generate_deception_coverage_report(techniques)
else:
print("Group not found in ATT&CK dataset.")Attack Surface Mapping Configuration
Structured YAML template for documenting the organizational attack surface and mapping deception coverage priorities
# attack-surface-assessment.yaml
# Template for mapping deception coverage against organizational assets
organization:
industry: "financial-services"
cisa_sector: "financial"
geographic_presence:
- "united-states"
- "europe"
priority_threat_actors:
- name: "FIN7"
motivation: "financial-gain"
known_targets:
- "point-of-sale"
- "financial-applications"
primary_ttps:
- id: "T1566.001"
name: "Spearphishing Attachment"
deception_opportunity: "trap-document-seeding"
- id: "T1059.007"
name: "JavaScript"
deception_opportunity: "decoy-service-activation"
- name: "APT28"
motivation: "espionage"
known_targets:
- "email-servers"
- "vpn-infrastructure"
primary_ttps:
- id: "T1078"
name: "Valid Accounts"
deception_opportunity: "credential-trap-planting"
crown_jewels:
- asset: "core-banking-database"
criticality: "critical"
access_paths:
- "vpn > jump-host > db-subnet"
- "web-app > api-server > db-subnet"
deception_coverage:
- type: "honeypot"
placement: "db-subnet"
priority: "high"
- type: "canary-token"
placement: "db-config-files"
priority: "critical"
- asset: "active-directory"
criticality: "critical"
access_paths:
- "any-workstation > dc"
deception_coverage:
- type: "credential-trap"
placement: "workstation-cached-creds"
priority: "critical"
- type: "honeytoken-account"
placement: "active-directory"
priority: "high"MITRE ATT&CK Mappings
| Technique | Tactic | Relationship |
|---|---|---|
| T1595Active Scanning | Reconnaissance | counters |
| T1592Gather Victim Host Information | Reconnaissance | counters |
Considerations
- Threat landscapes shift continuously. Schedule quarterly reassessments to keep adversary profiles current.
- Avoid anchoring on a single threat actor. Deception environments that only account for one adversary profile will miss others.
- Consider insider threats alongside external adversaries. Deception assets can be equally effective at detecting malicious insiders.
Supported Environments
Tools & Resources
- MITRE ATT&CK Navigator
- Commercial threat intelligence platforms (Recorded Future, Mandiant, CrowdStrike)
- Open-source threat feeds (AlienVault OTX, Abuse.ch)
- Industry ISACs (FS-ISAC, E-ISAC, etc.)
- Internal incident response records
Quick Stats
- Phase
- Plan
- Difficulty
- intermediate
- Detection Value
- medium
- Cost
- minimal
- Time
- 1-2 weeks
- ATT&CK Mappings
- 2