Canarytokens: Honeypot for critical credentials, get notified when they are used (2015)

You can lock down access to vault with whatever degree of 2FA/IdP you wish. So - your workflow is authenticate to Vault, which uses your identity (and possibly group membership from an IdP like Okta) - to identify the groups/policies you have, which in turn then grant you the authority to request (short lived < 24 hours typically) tokens that are generated in real-time (and likewise terminated when they age out).

The added benefit here is that if your service token is exposed - (A) The window of vulnerability is very short lived, and, (B) it's isolated to a single service.

I haven't worked with Boundary - but it sounds like your solution has some closer comparison to Hashicorp Boundary, right?

Bingo - between this and not confining yourself into the restrictions of a single platform (what the platform feature vendors have to do - Microsoft deception offers solutions only specific to certain Microsoft infrastructure, etc. ), you can create some terrific outcomes in this domain.

There’s even an argument that all you’ve done is tipped your hand to the adversary that deception is at play in this scenario and allow them to adjust their approach accordingly.

Not even suggesting that would be a horrible thing to happen, even in that scenario you most likely can at least slow them down but if you never know you’re being targeted in the first place it doesn’t matter too much when that clock starts.

The ideal scenario I think you should actually be aiming for here is to craft a situation where you know about them but they don’t know that you know. That’s a window of time where you very clearly have an upper hand.

That isn’t actually that hard to create. For example one technique I have at that really early stage is to return a 403 auth error on a web service and set a cookie that looks very natural to its environment but is also very obvious as to how you could change it in order to no longer get a 403 response.

The moment I get a request with that new cookie value I instantly know I have something I should be paying attention to and I know it’s a real person not a bot. The adversary however has no idea yet what’s going on, they just think they hit a gold mine.

As a defender, you only get to fail once for it to be costly. As an attacker, you can often fail hundreds or thousands of times depending on what they have for observability. Adding offensive elements helps level the playing field.

I have story after story after story of people who should have known better who got done for really silly shit.

I’m only making the argument here that that specific technique has some real limitations and known work arounds to the point that people actively know to look for it and that as a result I would personally look for other techniques that don’t have the same set of trade offs.