Home / Academia & Research / Using Deception to Enhance Security

Using Deception to Enhance Security

In everyday security, deception plays a prominent role in our lives. We leave lights on to deter thieves and deceive them by pretending that someone is inside. We might even have a timer that switch light on and off. Over history, deception has evolved to find its natural place in our societies and eventually our technical systems. Deception and decoy-based mechanisms have been used in security for more than two decades in techniques such as honeypots and honeytokens.

During my PhD, we created a research group, the LiarsClub, as part of the CERIAS center at Purdue to investigate how deception can be used to improve the security of Computer Defenses. This can be accessed from here.

Discussing the Use of Deception

Systemizing, Modeling and Integrating Deception

Using Deception in Authentication and Access Control

Deception Tools and Software

ErsatzPassword

We modified how Linux-based operating systems store user’s passwords and incorporated a machine dependent machine function in the process. When an attacked steal the hashed passwords file (e.g., etc/shadow) and tries to crack the password, ersatz “fake” passwords are returned instead. The design of this tool can be found in the paper and the code, which was mainly developed by Chris Gutierrez, can be found here.

People Working on the Use of Deception in Computing

(alphabetical order and non-inclusive)

  • Matt Bishop
  • Ari Jules
  • Ron Rivest
  • Neil Rowe
  • Eugene Spafford