Certified: The Security+ Prepcast

In this episode, we are going to explore deception and disruption technologies. These are creative and proactive tools that security professionals use not just to defend, but to confuse, mislead, and observe attackers. While traditional controls are about blocking and detecting threats, deception adds another layer—inviting the attacker in, but only into a controlled, fake environment where their behavior can be safely monitored and studied.
The role of deception in cybersecurity is growing, especially as attackers become more skilled and evasive. Instead of only reacting to threats, deception allows defenders to proactively lure malicious actors away from valuable systems. By setting traps, organizations gain insight into attacker techniques, reduce the risk of real damage, and increase the time they have to respond.
Deception strategies help detect threats early in the attack cycle. Many attackers begin by scanning systems or probing for weaknesses. If those early steps interact with a decoy system or a fake file, an alert can be triggered immediately—before the attacker even reaches a real asset. This improves detection speed and reduces the attacker’s ability to remain hidden.
Another benefit of deception is attacker diversion. By occupying the attacker’s time with fake systems, the real systems stay untouched. This creates an opportunity for defenders to analyze the attack, identify the tools being used, and improve defenses without putting actual data at risk. It also creates confusion for the attacker, making it harder for them to know which systems are real and which are fake.
Let’s look at the different types of deception technologies, starting with honeypots. A honeypot is a fake system designed to look like a legitimate target. It might resemble a web server, a database, or an employee workstation. The system is configured to appear vulnerable so that attackers are tempted to interact with it. Every action the attacker takes is recorded and analyzed, giving security teams valuable intelligence about their tactics and goals.
Honeypots are usually isolated from the rest of the network to prevent attackers from moving laterally. They are often designed to mimic outdated or misconfigured systems—exactly the kind of targets attackers expect to find. If someone accesses a honeypot, it is almost always a sign of malicious intent, because no authorized user should ever need to interact with it.
Next are honeynets. A honeynet is a collection of honeypots connected together to simulate an entire network. This makes the deception more convincing and gives attackers more space to explore. A honeynet might include fake file servers, login portals, and internal communication systems. This allows defenders to observe how an attacker moves across a network, what tools they use, and what types of data they try to extract.
Honeynets are especially useful for studying advanced persistent threats. These are long-term attacks where the intruder tries to remain hidden while gathering intelligence or preparing a larger operation. By watching how these attackers operate in a honeynet, defenders can better prepare for similar tactics in real environments.
Honeyfiles are another form of deception. These are fake files that appear to be sensitive or valuable—such as payroll spreadsheets, password lists, or project plans. They are often placed in shared folders or on desktops where they can be discovered during a breach. If someone opens or downloads a honeyfile, that action triggers an alert. In some cases, the file may contain a unique string or tag that identifies the system or account accessing it.
Honeyfiles are useful because they do not require the attacker to compromise a full system. Even a curious insider poking around for information can be caught by a honeyfile. This makes them especially valuable in detecting internal threats or early stages of an attack.
Finally, let’s talk about honeytokens. A honeytoken is not a file or a system, but a small piece of deceptive data planted within a system or database. This might be a fake username, a bogus database record, or a made-up credit card number. If that data is ever used—such as being submitted in a form or seen in external traffic—it proves that someone accessed it without authorization.
Honeytokens are powerful because they can be placed almost anywhere. For example, a company might include a fake email address in its customer database. If an attacker steals the data and sends a phishing message to that address, the company knows exactly when the data was accessed and how it was used. Honeytokens provide silent but effective surveillance over data access and misuse.
Deception technologies like honeypots, honeynets, honeyfiles, and honeytokens are not replacements for traditional defenses. Instead, they are complementary tools that help detect, distract, and investigate threats. When combined with logging, alerting, and monitoring systems, they greatly improve an organization’s ability to identify attacks early and respond effectively.
For the Security Plus exam, make sure you can identify each type of deception technology and understand its purpose. Honeypots are decoy systems, honeynets are decoy networks, honeyfiles are fake documents, and honeytokens are fake pieces of information. Pay attention to which ones are used for detection, which ones are used for diversion, and how each supports threat analysis. The exam may present scenarios where you are asked to recommend a control for identifying or misleading attackers—deception is the answer in those cases.