Counterespionage Firewall

Use the Docker version of WPScan and the commands below. When prompted whether to update the database, you shouldn't need to.

• To verify that CEF deceives WPScan's username scan, issue the following command: docker run -it --rm wpscanteam/wpscan --url http://[yourbloghere.com] --enumerate u
• To verify that CEF deceives WPScan's plugin scan, issue the following command: docker run -it --rm wpscanteam/wpscan --url http://[yourbloghere.com] --plugins-detection aggressive
• To verify that CEF deceives WPScan's theme scan, issue the following command: docker run -it --rm wpscanteam/wpscan --url http://[yourbloghere.com] --enumerate t

No. CEF and was specifically designed to leave protection against active web attacks to WAFs, which do it best.

No. CEF specializes in web-type intelligence and leaves the protection of other services to the host firewall.

Yes.

CEF helps you earlier in the cyber-attack chain, during the Reconnaissance stage, to disrupt malicious research efforts. Remember, attacks do not necessarily correlate with the research origin(s).

An Intent Indicator is a trait derived from cyber threat intelligence that with high confidence indicates malicious intent. You do not need to activate every Intent Indicator powering CEF if for some reason one or more break your business traffic. E.g. A bank may want to block visitors using Tor to reduce fraud, while an online newspaper may recognize that readers and journalists have an interest in using Tor to avoid censorship and retribution.

BLUF: An Intent Indicator is earlier than an IoC. An IOC indicates that a breach already took place, allowing you only to respond after the fact. Intent Indicators are the attacker’s traits, or Tactics, Techniques, and Procedures (TTPs), observable during the recon phase--traits, that with high confidence, would not belong to legitimate visitor traffic and behavior.