AUTOMATION OF THE USE OF FALSE COMPONENTS IN THE INFORMATION SYSTEM

Cite as: S.A. Smirnov, N. Yu. Parotkin, V.V. Zolotarev. Automation of the use of false components in the information system // Izvestiya SFedU. Engineering Sciences – 2024. – N. 6. - P. 209-218. doi: 10.18522/2311-3103-2024-6-209-218

Abstract

The article considers the applicability of deceptive information systems and their components in
building an automated system for deploying and managing the applied implementation of deceptive component
technology to improve the attack prevention system. The main advantages and the role of technology
in the information security strategy setting the specifics and the area of technology means and tools
practical appliance are suggested. The article considers the fundamentals of the architecture and features
of the technology application, as well as its limitations. The purpose and the objective of using the present
technology is pointed in terms of key principles of implementation disclosure. In addition, regulatory publications
and other recommendations constituting the best practices in the field of its use were analyzed.
The concept and architecture of the final automated solution for integration into information systems and
security systems are considered, and the functional content of the final solution is described. A distinctive
feature of the proposed solution is the use of controlled containerization mechanisms, that provide ample
opportunities for scaling the solution and isolating compromised system components as a result of an
intruder's actions. A formulated process of the automation system practical implementation in perspective
of solution subsystems is schematically described in relation to dependent components (such as suggested
document pieces and outer tools and systems) and included operations processing conditions. A model of
deployment and operation of a distributed automation system is also provided in the following sequence:
setting up a deployment server (including provisioning), deploying a network of false decoy components
based on containerization, deploying external baits, integrating with systems and instances of the information
security stack external to the composition of the solution. The solution is implemented by means of
the principle: fake assets and resources of the fictive environment are deployed in an information technology
infrastructure using controls and are intended to be affected by the adversary. The deployed set of
subsystem tools was tested using a third-party node with the appropriate tools and scanning scenarios.
Recommendations are given for further improvement of the automation system for deployment and management
of tools and measures for deceptive component technology.