Deception-based responses to security attacks

A system comprising:

• one or more processors;
• and
• memory communicatively coupled to the one or more processors, the memory storing instructions executable by the one or more processors that, when executed by the one or more processors, cause the system to perform operations including:
• receiving data associated with an attack on a computing device;
• transitioning the data associated with the attack to a monitored computing device that is configured to pose to an adversary as the computing device impacted by the attack;
• enabling an entity associated with the computing device impacted by the attack to load deceptive information to the monitored computing device;
• enabling the adversary to obtain the deceptive information from the monitored computing device;
• monitoring subsequent activities on the monitored computing device;
• determining, based on the subsequent activities, a geographic location of the adversary;
• updating, based at least in part on the geographic location of the adversary, the deceptive information to generate updated deceptive information;
• enabling the adversary to obtain the updated deceptive information from the monitored computing device;
• monitoring additional activities on a second monitored computing device configured to pose to the adversary as the computing device impacted by the attack;
• correlating information obtained from the subsequent activities on the monitored computing device and the additional activities on the second monitored computing device to obtain correlated information;
• and
• updating a configuration associated with a security agent of the computing device impacted by the attack based at least in part on the correlated information.

A non-transitory computer-readable storage medium storing computer-readable instructions executable by one or more processors, that when executed by the one or more processors, cause the one or more processors to perform operations comprising:

• receiving data associated with an attack on a computing device;
• transitioning the data associated with the attack to a monitored computing device that is configured to pose to an adversary as the computing device impacted by the attack;
• enabling an entity associated with the computing device impacted by the attack to load deceptive information to the monitored computing device;
• enabling the adversary to obtain the deceptive information from the monitored computing device;
• monitoring subsequent activities on the monitored computing device;
• determining, based on the subsequent activities, a geographic location of the adversary;
• updating, based at least in part on the geographic location of the adversary, the deceptive information to generate updated deceptive information;
• enabling the adversary to obtain the updated deceptive information from the monitored computing device;
• monitoring additional activities on a second monitored computing device configured to pose to the adversary as the computing device impacted by the attack;
• correlating information obtained from the subsequent activities on the monitored computing device and the additional activities on the second monitored computing device to obtain correlated information;
• and
• updating a configuration associated with a security agent of the computing device impacted by the attack based at least in part on the correlated information.