Active defense

Active defense can refer to a defensive strategy in the military or cybersecurity arena. In the cybersecurity arena, active defense may mean "asymmetric defenses," namely defenses that increase costs to cyber-adversaries by reducing costs to cyber-defenders. For example, an active defense data protection strategy leverages dynamic data movement, distribution, and re-encryption to make data harder to attack, steal, or destroy. Prior data protection approaches relied on encryption of data at rest, which leaves data vulnerable to attacks including stealing of ciphertext, cryptographic attack, attacks on encryption keys, destruction of encrypted data, ransomware attacks, insider attacks, and others. Three ACM computing conferences have explored moving target defense as a strategy for network and application-level security as well, for instance by rotating IP addresses or dynamically changing network topologies. Production implementations of MTD are provided by companies for applications including legacy systems, communications, and election security. Additionally, "active defense measures" are often another term used to define and refer to offensive cyber operations (OCOs) or computer network attacks (CNAs). Some have defined active defenses as including of deception or honeypots, which seek to confuse attackers with traps and advanced forensics. Examples of such honeypot technologies include Illusive Networks, TrapX, Cymmetria, Attivo, and others. Other types of active defenses might include automated incident response, which attempts to tie together different response strategies in order to increase work for attackers and decrease work for defenders.