Deception server deployment
A system accesses information regarding a topology of an arrangement of resources, where one of the resources is a multi-tiered resource having a plurality of layers. Based on the information regarding the topology of the arrangement of resources, the system selects one or more layers of the multi-tiered resource for deployment of a deception server that has a reduced security mechanism to act as a decoy to attract attackers of the system. The system deploys the deception server at the selected one or more layers of the multi-tiered resource.
1. A non-transitory machine-readable storage medium storing instructions that upon execution cause a processor of a system to:
access a configuration management database (CMDB) to obtain information regarding a topology of an arrangement of resources in a network, wherein one of the resources comprises a multi-tiered resource including a web layer and an application layer, and the obtained information includes information of the web layer and the application layer of the multi-tiered resource;
based on the obtained information regarding the topology of the arrangement of the resources, select one layer of the web layer and the application layer of the multi-tiered resource for deployment of a deception server, wherein the deception server is a server having a reduced security mechanism to attract potential attackers of the network;
deploy the deception server in the selected layer of the multi-tiered resource;
monitor information relating to interactions between the deception server and external entities;
based on the monitored information, identify an attacker of the multi-tiered resource; and
in response to identifying the attacker, implement a remedial action including disabling the attacker from accessing the multi-tiered resource.
2. The non-transitory machine-readable storage medium of claim 1 , wherein the instructions upon execution cause the processor to:
select the web layer and the application layer of the multi-tiered resource for deployment of plural deception servers; and
deploy the plural deception servers in the web layer and the application layer of the multi-tiered resource.
3. The non-transitory machine-readable storage medium of claim 1 , wherein the multi-tiered resource comprises a multi-tiered application.
4. The non-transitory machine-readable storage medium of claim 3 , wherein the multi-tiered application comprises a multi-tiered web application.
5. The non-transitory machine-readable storage medium of claim 1 , wherein the instructions that cause the processor to deploy the deception server include instructions that cause the processor to deploy a virtual machine at the selected layer of the multi-tiered resource.
6. The non-transitory machine-readable storage medium of claim 5 , wherein the virtual machine is deployed from a server image.
7. The non-transitory machine-readable storage medium of claim 5 , wherein the instructions upon execution cause the processor to:
store information gathered by the virtual machine relating to an interaction by an external entity with the deception server; and
detect an attack based on the information relating to the interaction.
8. The non-transitory machine-readable storage medium of claim 7 , wherein the instructions upon execution cause the processor to:
store the monitored information in a security server.
9. The non-transitory machine-readable storage medium of claim 1 , wherein the multi-tiered resource is to communicate with an external entity over an external network, and traffic from the external entity is processed by the multi-tiered resource.
10. A system comprising:
a processor; and
a non-transitory storage medium storing instructions executable on the processor to:
access a configuration management database (CMDB) to obtain information regarding a topology of an arrangement of resources in a network, wherein one of the resources comprises a multi-tiered resource including a web layer and an application layer, and the obtained information comprises information of the web layer and the application layer of the multi-tiered resource;
based on the obtained information regarding the topology of the arrangement of the resources, select one layer of the web layer and the application layer of the multi-tiered resource for deployment of a deception server, wherein the deception server is a server having a reduced security mechanism to attract potential attackers of the network;
deploy the deception server in the selected layer of the multi-tiered resource;
monitor information relating to interactions between the deception server and external entities;
based on the monitored information, identify an attacker of the multi-tiered resource; and
in response to identifying the attacker, implement a remedial action including disabling the attacker from accessing the multi-tiered resource.
11. The system of claim 10 , wherein the instructions are executable on the processor to:
select the web layer and the application layer of the multi-tiered resource for deployment of plural deception servers; and
deploy the plural deception servers in the web layer and the application layer of the multi-tiered resource.
12. The system of claim 11 , wherein the plural deception servers deployed in the web layer and the application layer of the multi-tiered resource are to collect data relating to attacks of the multi-tiered resource.
13. The system of claim 10 , wherein the obtained information regarding the topology of the arrangement of the resources comprises information of configuration items corresponding to the resources, and information of relationships among the configuration items.
14. The system of claim 10 , wherein the deception server is deployed in a virtual machine in the selected layer of the multi-tiered resource.
15. The system of claim 14 , wherein the virtual machine is created based on a predefined template.
16. The system of claim 10 , wherein the instructions are executable on the processor to;
store the monitored information in a security database.
17. A method performed by a system comprising a hardware processor, comprising:
accessing a configuration management database to obtain information regarding a topology of an arrangement of resources in a network, wherein one of the resources comprises a multi-tiered resource including a web layer and an application layer, and the obtained information includes information of the web layer and the application layer of the multi-tiered resource;
based on the obtained information regarding the topology of the arrangement of the resources, select one layer of the web layer and the application layer of the multi-tiered resource for deployment of a deception server, wherein the deception server is a server having a reduced security mechanism to attract potential attackers of the network;
deploying the deception server in the selected layer of the multi-tiered resource: application
monitoring information relating to interactions between the deception server and external entities;
based on the monitored information, identify an attacker of the multi-tiered resource and
in response to identifying the attacker, implement a remedial action including disabling the attacker from accessing the multi-tiered resource.
18. The method of claim 17 , wherein deploying the deception server comprises deploying a virtual machine comprising the deception server, the virtual machine created from a predefined template.
19. The method of claim 17 , further comprising:
storing the monitored information in a security database.
20. The method of claim 17 , further comprising:
selecting the web layer and the application layer of the multi-tiered resource for deployment of plural deception servers: and
deploying the plural deception servers in the web layer and the application layer of the multi-tiered resource.