Article
Decoys as an early warning system
The Cybersecurity and Infrastructure Security Agency released guidance this month encouraging organizations to consider cyber decoys on internal networks and internet-facing systems. Decoys are realistic but fake assets, such as files, user accounts and credentials, that no legitimate user should ever touch. Any interaction with one is a strong signal that an attacker is inside.
CISA says decoys can shorten the time it takes to spot an intrusion, make better use of thin security staffs and produce fewer false alarms than conventional monitoring. They also show defenders how attackers move. The agency frames them as part of a zero trust approach that assumes an adversary may eventually get some access, and is clear that they supplement rather than replace existing controls.
For community hospitals and regional systems with small teams, AHA News noted that decoys could serve as high-confidence tripwires around the electronic health record, financial systems and administrative accounts.
Protecting the keys to single sign-on
On September 17 the National Institute of Standards and Technology and CISA published NIST IR 8587, recommendations for protecting the tokens and identity assertions that single sign-on depends on. Hospitals rely heavily on these systems, and a forged or stolen token can give an attacker access without a password.
The report recommends short token lifetimes, generally no more than one hour, and rejecting expired tokens. It calls for strict management of signing keys, including keeping an inventory, rotating them on a set schedule and storing them in hardware-based or isolated systems rather than on the servers that use them. It also urges continuous review of accounts and access grants, and logging of token activity so misuse can be traced.
Questions for your security leader
- Do we have tripwires? Ask whether decoy accounts or files guard the record system, finance platforms and privileged accounts, and who responds when one is touched.
- How long do our tokens live? Review session and refresh token settings in your identity provider and cloud applications.
- Who holds the signing keys? Confirm where keys for single sign-on are stored, how often they rotate and what vendors manage on your behalf.
- Can we see token misuse? Make sure identity logs feed your monitoring tools and are retained long enough to investigate.
Archive entry for Sep 19, 2026, added Nov. 11, 2026.