Docs

Appearance

Deception Layer ​

Classification: RESTRICTED — Security Operations Only
Owner: Rory Garshol (IT/Security)
Last updated: 2026-04-13
DECP project: DECP-001 through DECP-010

Purpose ​

The Cirius Group deception layer deploys canary tokens and honeyfiles across production infrastructure. These are decoy resources that look legitimate but serve no operational function. Any access to a canary resource indicates attacker presence — triggering an immediate CRITICAL incident in SecOps with no suppression.

Core principle: any canary trigger = confirmed attacker activity. No exceptions.

The deception layer provides:

  • Early attacker detection — canaries trip before attackers reach real data
  • Attacker behavior intelligence — token type reveals attack stage (credential testing, document access, DNS enumeration, repository cloning)
  • Zero false positive rate — no legitimate process should ever access these resources
  • Real-time alerts — webhook integration creates CRITICAL incidents within seconds of trigger

Architecture ​

┌─────────────────────────────────────────────────────────────────┐
│                    DECEPTION LAYER COMPONENTS                   │
├──────────────────────┬──────────────────────────────────────────┤
│  Component           │  Coverage                                │
├──────────────────────┼──────────────────────────────────────────┤
│  AWS Key Token       │  Credential harvesting from S3           │
│  DNS Token           │  DNS enumeration / config file testing   │
│  URL Tokens          │  Infra repo cloning + URL testing        │
│  SharePoint Doc      │  Unauthorized document access (pending)  │
│  Azure PROD blob     │  PHI storage account access              │
│  Azure DDE blob      │  DDE storage account access              │
│  AWS S3 honeyfile    │  Prod S3 bucket access                   │
│  Entra decoy acct    │  Account enumeration / sign-in attempts  │
└──────────────────────┴──────────────────────────────────────────┘

Alert Path ​

All canary tokens are configured with a webhook to soc.bedrockcybersecurity.org/webhooks/canary. The webhook endpoint (app/routers/webhooks.py) validates the shared secret and immediately creates a CRITICAL incident via the SecOps incidents API.

Attacker accesses canary resource
         │
         ▼
canarytokens.org detects trigger
         │
         ▼
POST https://soc.bedrockcybersecurity.org/webhooks/canary?secret=<CANARY_WEBHOOK_SECRET>
         │
         ▼
webhooks.py validates secret → creates CRITICAL incident
  severity=CRITICAL
  source_agents=["canary_agent"]
  incident_type="Deception Layer Trigger"
  recommended_actions=[block IP, check sign-ins, check CloudTrail, activate IR runbook]
         │
         ▼
SecurityAgent pages Rory via Telegram immediately

Health Monitoring ​

canary_agent.py (registered in orchestrator.py) runs every 4 hours and verifies:

  • All canary files still exist in their deployment locations
  • The Entra decoy account still exists

If any canary is missing, canary_agent creates a CRITICAL incident flagging potential tripwire removal by an attacker.

Deployed Canaries ​

See canary-token-inventory.md for the full inventory with token IDs, webhook URLs, deployment status, and last-verified dates.

Summary of deployed/pending canaries:

IDTypeLocationStatus
CT-001AWS KeyS3 bucket (prod)Pending token embedding
CT-002SharePoint DocSharePoint Security siteBlocked (Graph API scope)
CT-003DNSEmbedded in config filesPending manual creation
CT-004URLEach infra repo READMEPending
CF-001Honeyfiles3://cirius-veeam-prod-bucket/security/Pending (no PutObject)
CF-002Honeyfileciriusarchiveprod/canary/Pending (network rules)
CF-003Honeyfileciriusddearchiveprod/canary/Pending (network rules)
DA-001Entra Decoysvc-legacy-reporting@ciriusgroup.comPending (needs User Admin role)

Implementation Details ​

Webhook Endpoint (DECP-005) ​

  • Endpoint: POST /webhooks/canary
  • Auth: ?secret=<CANARY_WEBHOOK_SECRET> query parameter (constant-time comparison)
  • Source: bedrock-hub/app/routers/webhooks.py
  • Registered in: bedrock-hub/app/main.py
  • Required env var: CANARY_WEBHOOK_SECRET → KV secret canary-webhook-secret in cirius-openai-kv-prod
  • Incident severity: always CRITICAL, never suppressible
  • MITRE mapping: T1078 (Valid Accounts) / Initial Access

Canary Health Agent (DECP-005/009) ​

  • Agent: bedrock-hub/agents/canary_agent.py
  • Registered in: orchestrator.py as "canary" agent in PROD mini-agents
  • Run frequency: every 4 hours (orchestrator cycle)
  • Required env vars:
Env VarPurpose
CANARY_S3_BUCKETAWS S3 bucket with honeyfile
CANARY_S3_KEYS3 object key (default: PHI-patient-records-backup.txt)
CANARY_AZURE_PROD_ACCOUNTAzure PROD storage account
CANARY_AZURE_PROD_CONTAINERAzure PROD container (default: canary)
CANARY_AZURE_PROD_BLOBBlob name (default: PHI-patient-records-backup.txt)
CANARY_AZURE_DDE_ACCOUNTAzure DDE storage account
CANARY_AZURE_DDE_CONTAINERAzure DDE container (default: canary)
CANARY_AZURE_DDE_BLOBBlob name (default: PHI-patient-records-backup.txt)
CANARY_ENTRA_DECOY_UPNEntra decoy account UPN

All env vars must be added to job-orchestrator-cirius Container App Job.

Non-Suppression Policy ​

Canary token incidents must never be suppressed via known-good rules. The incident response process is:

  1. Treat as confirmed compromise immediately
  2. Block source IP at perimeter
  3. Preserve evidence (do not reset canary credentials during forensics)
  4. Activate the IR runbook
  5. After forensics, rotate all canary credentials and re-deploy

The canary_agent source is excluded from the analyst agent's known-good matching logic by design — any incident with source_agents=["canary_agent"] bypasses suppression.

Key Vault Requirements ​

SecretKV NameUsed By
Canary webhook shared secretcanary-webhook-secret/webhooks/canary + Container App Jobs

Compliance Notes ​

  • HIPAA §164.312(c)(1) — Integrity controls: canary files detect unauthorized PHI access
  • HIPAA §164.312(b) — Audit controls: all canary triggers are logged and create incidents
  • HITRUST — Deception layer satisfies threat intelligence and early detection controls
  • SOC2 — Supports CC6.1 (logical access) and CC7.3 (incident detection)

Future Enhancements ​

  • Deploy SharePoint canary document once Graph API scope is available (DECP-002)
  • Add canary tokens to each infra repo (DECP-004) — pending URL token creation
  • Add DNS canary domain to fake config files in ops-automation (DECP-003)
  • Integrate canary triggers with Palo Alto auto-block via Security Policy (future)
  • Add canary to on-premises file server shared drives (future)

This document is the living reference for Cirius Group's deception layer. Update when canaries are deployed, rotated, or triggered.

Internal use only — Cirius Group