The FBI believes it has a method for firms to restrict the damage from data hacks: lure thieves into taking the incorrect info. The media has learned of an FBI project, Illicit Data Loss Exploitation (IDLE), which has firms plant “fake data” to confuse attackers seeking to pinch valuable data. Look at it as a honeypot for possible corporate spies and fraudsters.
Even though the FBI is not sharing the finer info of how IDLE operates, an executive claimed to the media that it mixes info within current info structures to make it seem real. An attacker couldn’t just grab info in bulk and hope for it all to be helpful and just downloading the fake data might alert IT staff that something wrong is happening. The FBI assists make the fake data with the help of real data, but an executive claimed that the bureau does not retain data and gets it solely via permission.
There is no assurance this will be effectual. A smart attacker may parse the info, and it is only as effectual as the firm’s fundamental security system. If it has sub-par protections, bait data will not assist much. For the FBI, although, this is not as much about offering airtight defense as it is about taking a practical approach that assists firms “get their defenses ready” rather than just reacting to violations when they take place. In that regard, it might be a useful piece of a bigger security puzzle.
On a related note, earlier the FBI claimed that it needs to collect more data from social media. It launched a call for agreements for a new social media surveillance tool. As per a RFP (request-for-proposals), it is seeking for an “early warning tool” that would assist it survey terrorist groups, criminal activity, domestic threats, and the like.
