Sludge for Good：减缓网络攻击者的速度并增加其成本
Sludge for Good: Slowing and Imposing Costs on Cyber Attackers
摘要：
选择架构描述了向人们展示选择的设计。轻推是一个方面，旨在使“好”的结果容易，如使用密码米，以鼓励强密码。相反，污泥是增加交易成本的摩擦，通常被视为对用户不利。扭转这一概念，我们建议通过攻击性地使用污泥来消耗攻击者的时间和其他资源，从而实现积极的网络安全结果。到目前为止，大多数网络防御的设计都是为了达到最佳的强大和有效性，并尽可能快地阻止或消除攻击者。我们的补充方法是部署防御措施，以最大限度地消耗攻击者的时间和其他资源，同时尽可能减少对受害者的损害。这与零信任和假设违约的类似心态是一致的。Sludge Strategy通过在攻击之前、期间和之后使用欺骗和真实的设计功能为攻击者战略性地部署摩擦，引入了成本高昂的网络防御。我们提出了有效污泥的特性，并显示了从轻到重污泥的连续体。我们描述了攻击者的定量和定性成本，并提供了在实践中部署污泥的实际考虑。最后，我们研究了美国政府行动的真实例子，以挫败网络对手并使其付出代价。
英文摘要：
Choice architecture describes the design by which choices are presented to people. Nudges are an aspect intended to make "good" outcomes easy, such as using password meters to encourage strong passwords. Sludge, on the contrary, is friction that raises the transaction cost and is often seen as a negative to users. Turning this concept around, we propose applying sludge for positive cybersecurity outcomes by using it offensively to consume attackers' time and other resources. To date, most cyber defenses have been designed to be optimally strong and effective and prohibit or eliminate attackers as quickly as possible. Our complimentary approach is to also deploy defenses that seek to maximize the consumption of the attackers' time and other resources while causing as little damage as possible to the victim. This is consistent with zero trust and similar mindsets which assume breach. The Sludge Strategy introduces cost-imposing cyber defense by strategically deploying friction for attackers before, during, and after an attack using deception and authentic design features. We present the characteristics of effective sludge, and show a continuum from light to heavy sludge. We describe the quantitative and qualitative costs to attackers and offer practical considerations for deploying sludge in practice. Finally, we examine real-world examples of U.S. government operations to frustrate and impose cost on cyber adversaries.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
