Where to put your first three decoys

A decoy only works if an intruder finds it. Put it where nobody looks and it stays silent for the wrong reason. Put it on the internet and it never stops shouting. The useful place is in between: inside your network, on the path an intruder takes once they are in.

Start with what an intruder wants

After the first foothold, most intruders do the same three things: look around, find credentials, and go for the data that hurts most. That gives you three good first decoys.

1. A backup target in the server network. Backups are the first thing a ransomware operator wants to find and destroy. A decoy NAS with a tempting name is the one device they will not skip.
2. A file server near your users. Shares and remote desktop are what someone on a compromised laptop reaches for first.
3. Something boring in the office network. A printer blends into any office VLAN, and nobody logs into a printer by accident.

Make it look like it belongs

Match the decoy to the segment it sits in: a printer among the desks, a database server among the servers. Give it its own address on the network rather than a port on another machine, and a hardware address from a vendor that fits the device, because scanners show the vendor name.

Then make it findable. An attractive name in DNS such as backup or finance-share does more than any amount of tuning. So does a forgotten-looking reference to it in documentation or a script.

Keep your own tools out of the picture

The only things with a legitimate reason to touch a decoy are your own monitoring and vulnerability scanners. You know their addresses, so put them on the ignore list on day one. After that, every event is worth reading.

Do not put it on the internet

It is tempting, and it produces thousands of events from scanners that probe every address on the internet. None of them tell you anything about your network. Inside, every hit matters.

What a decoy will not see

Two honest limits. A stealth scan that never completes a connection is not recorded; a normal connection scan, service detection and any real login attempt are. And an experienced attacker who fingerprints the operating system can notice that a decoy Windows server answers like Linux. Most intruders are in too much of a hurry to check.

The deployment guide has the commands, and the profiles reference lists what each decoy pretends to be.