BlueCat-Illusive integration enables effective deception

Thrive on deception, and protect your network with an Illusive Networks integrated Adaptive DNS platform from BlueCat.


March 23, 2020

Deception is quickly emerging as one of the most innovative and effective ways to protect a network.  It’s an idea that occupies a sensible middle ground in the spectrum of cybersecurity tactics.  Instead of merely reacting to an attack in progress, or aggressively “hacking back”, deception allows enterprises to protect themselves by diverting the attack into a walled off zone.  When attackers try to use harvested credentials to infiltrate a network, they’re actually being examined and identified.

Implementing deception technology requires the creation of a network that appears real enough to fool attackers.  Generating the appropriate level of credibility usually means mixing real network data with markers which allow security administrators to discover and track malicious actors.  At a practical level, that requires a certain level of coordination between the security teams implementing deception technology and the network teams which control the network architecture.

The general rule of thumb for deception is that the less people know about it, the better.  Since attacks from insiders are a constant challenge, it’s important that knowledge of deception technology is limited to a small group of administrators.  The need for network resources to build out a realistic-looking environment unfortunately runs counter to this goal.

This is why Illusive Networks, a leader in deception technology, recently developed an integration with BlueCat’s Adaptive DNS platform.

The illusion of the real

Illusive’s ersatz networks deploy on endpoints and strategic intersections of network activity.  In these places, Illusive will associate a real IP address with a fake Active Directory profile.  If a malicious actor sends a DNS query to the deceptive IP address, the query will be directed to a trap server, which then produces a notification for the security team.

Ordinarily, Illusive needs help from the network team to build out these connections.  For every endpoint or strategic juncture they protect, they have to request an IP address from the network teams.  That’s usually a manual process – one which slows down deployments and prevents timely expansion to newer areas of the network.  Even worse, it involves notifying the network team when and where Illusive’s technology is deployed – hardly an ideal situation.

The automation factor

Using BlueCat’s Adaptive DNS platform, Illusive takes advantage of automated IP address provisioning to speed up deployments and minimize the number of administrators who are aware that deception is in use.

Reaching into the single source of truth for IPAM data, Illusive uses BlueCat’s API to automatically provision IP addresses for use in creating deceptive environments.  Network administrators know that an IP address is assigned, and ultimately regulate the pool those addresses come from – an essential control which prevents duplicate assignments and network outages.  At the same time, network administrators aren’t tipped off to how the IP address will be used, limiting the scope of knowledge to essential personnel only.

By integrating with BlueCat’s Adaptive DNS on the back end, Illusive makes its own deployments more dynamic, flexible, and reliable.  It can spin up or wind down deception on the fly, without the need to constantly submit help desk tickets to the network team.  Illusive’s customers in turn are ensured that every IP address used for deception won’t cause a devastating network conflict.

How to get it

Illusive’s integration with BlueCat is available now.  You can access it within the Illusive solution, either from the dashboard or through the API repository.  There you’ll find all the details about how to connect the two platforms.

Published in:

An avatar of the author

BlueCat is the Adaptive DNS company. The company’s mission is to help organizations deliver reliable and secure network access from any location and any network environment. To do this, BlueCat re-imagined DNS. The result – Adaptive DNS – is a dynamic, open, secure, scalable, and automated DDI management platform that supports the most challenging digital transformation initiatives, like adoption of hybrid cloud and rapid application development.

Related content

Get fast, resilient, and flexible DDI management with Integrity 9.6

With Integrity 9.6, network admins can get support for new DNS record types, architect and configure multi-primary DNS, and automate IP assignments.

Read more

Deepen your security insight with Infrastructure Assurance 8.3

BlueCat Infrastructure Assurance 8.3, with an enhanced analytics dashboard, including interactive widgets and top 10 alerts, is now available.

Read more

Security, automation, cloud integration keys to DDI solution success

Only 40% of enterprises believe they are fully successful with their DDI solution. Learn how to find greater success with new research from EMA and BlueCat.

Read more

Our commitment to Micetro customers and product investment

From CEO Stephen Devito, a word on BlueCat’s ongoing commitment to supporting Micetro customers and Micetro’s evolution as a network management tool.

Read more

Seven reasons to rethink firewall monitoring and boost automation 

With BlueCat Infrastructure Assurance, you can better protect your network with automated alerts and suggested remedies for hidden issues in your firewalls.

Read more

Five ways to avert issues with BlueCat Infrastructure Assurance

By flagging and notifying you of hidden issues before they cause damage, you can go from reactive to proactive in your Integrity DDI environment.

Read more