In modern cloud security, the old adage remains true: “Defenders have to be right 100% of the time; attackers only have to be right once.”

Active defense and deception engineering flip this asymmetry on its head. By planting high-fidelity decoy credentials, fake database records, and canary network shares across your environment, the attacker now has to be right 100% of the time. Touch a single fake asset, and their presence is immediately exposed.

In this fifth installment of our Acuity Health Security Architecture series, we explore how lean security teams can operationalize deception engineering across distributed clinical networks.

Why Passive Monitoring Fails Against Ransomware

Passive monitoring relies on known signatures and heuristic thresholds. When an attacker gains valid credentials via phishing, their initial reconnaissance looks identical to legitimate administrative traffic. In healthcare environments, this allows adversaries to quietly map subnets and locate backup vaults before triggering a single alert.

flowchart TD
    Attacker["Phished Clinician Laptop"] --> Recon["Adversary Performs Internal Recon"]
    Recon --> TrapChoice{"Which Asset Does Attacker Target?"}
    
    TrapChoice -- Real EMR Server --> Stealth["Adversary Moves Slowly via Encrypted TLS"]
    TrapChoice -- Canary Credential --> Trip["Tripwire Fired! Canary Account Authenticated"]
    TrapChoice -- Decoy File Share --> Webhook["Canary Document Opened (Token Ping Sent)"]

    Trip & Webhook --> Sentinel["Microsoft Sentinel (Priority Severity 1 Alert)"]
    Sentinel --> AutoPlay["Automated Playbook: Isolate Host via CrowdStrike API"]
    AutoPlay --> Contain["Attacker Endpoint Quarantined in < 60 Seconds"]

Three Deception Traps for Healthcare Networks

1. Memory-Injected Honeytokens (LSASS Traps)

When attackers compromise a workstation, their first move is often dumping memory via Mimikatz to extract credentials. By injecting a high-privilege service account (svc_emr_sync_admin) into memory that has no legitimate business purpose, any authentication attempt using that username is an immediate, zero-false-positive indicator of compromise.

2. Database Canary Records

Inside our staging and production EHR schemas, we plant fake patient charts (dbo.VIP_Patients_Canary). If an insider or external attacker performs a bulk SELECT * query or extracts table data, automated SQL audit triggers fire an alert to Sentinel.

3. File System Decoy Traps

Decoy documents named 2026_Clinic_Executive_Salaries.xlsx are placed on internal file shares. The document contains an embedded tracking token that phones home to a cloud endpoint the instant the file is opened in Excel.

Automated Containment Playbook

To protect patient care without waiting for a manual SOC triage queue, tripwire alerts trigger automated Azure Logic Apps:

  1. Host Isolation: The source endpoint is immediately isolated from the network via the CrowdStrike Falcon API.
  2. Session Revocation: Azure AD revokes all active refresh tokens and OAuth sessions for the compromised user account.
  3. Forensic Snapshot: An automated memory capture request is dispatched to preserve evidence before the attacker can wipe their tracks.

[!TIP] Microsoft Sentinel Operations: To automate custom alert rules, KQL detections, and SOAR response playbooks in your own environment, check out the SixFiveMil/sentinel-ops repository on GitHub.

Up Next in the Series

When an unauthorized query touches patient records, how do you conduct a forensic investigation that holds up in a court of law?

In Part 6: Digital Forensics & Incident Response: Investigating the EHR VIP Database Breach (releasing Tuesday, October 13), we walk through live evidence acquisition, disk hashing, and reconstructing SQL breach timelines.