Defense and Deception

Stop Defending the Perimeter. Start Controlling the Blast Radius.For decades, cybersecurity has pursued an impossible objective: prevent every attack. Organizations continue to invest in higher walls, more sophisticated tools, and increasingly complex defenses-yet breaches continue.What if the problem isn’t simply the technology?What if the problem is how we think about defense?In Defense and Deception, cybersecurity veteran Kevin Cardwell challenges the traditional perimeter-focused approach to network security and presents a different philosophy: assume an adversary may eventually penetrate your defenses, then design the environment so that compromise does not mean defeat.Drawing on decades of experience in cybersecurity, penetration testing, network defense, military operations, and security architecture, Cardwell applies lessons from naval damage control to the modern network.A warship is not designed on the assumption that it will never be hit. It is engineered with compartmentalization and watertight integrity so that when damage occurs, it can be isolated, contained, and prevented from threatening the entire ship. Most importantly, the ship can continue its mission.Networks should be designed with the same objective.Mission assurance is more important than perimeter purity.This book introduces the concept of the Network Mine-strategically deployed active deception designed to make adversaries reveal themselves through their own actions. Rather than allowing an attacker to move freely after penetrating the perimeter, defenders can shape the environment, create uncertainty, detect unauthorized movement, and force the adversary to expend time and resources while exposing their presence.Defense and Deception explores how defenders can use concepts including:Active deception and Network MinesNetwork segmentation and containmentTarpits and deceptive servicesAdversary confusion and frictionDetection of lateral movementCompartmentalized network architectureMission-focused defensive strategiesDesigning networks to continue operating after compromiseThe objective is not to build a network that can never be penetrated.The objective is to build one that can take the hit, isolate the damage, and continue the mission.Originally published in 2020, Defense and Deception represents the foundation of Cardwell’s evolving approach to resilient cyber defense and mission assurance.The technology will continue to change. Attackers will continue to adapt. Artificial intelligence will accelerate both offensive and defensive capabilities.But the fundamental problem remains.How do you design an environment in which the attacker no longer controls what happens after the initial compromise?If you read this book, you’ll never look at network defense the same way again.