In this technique, you should lure the enemy with tempting bait, like fishing in the sea or a river, so as to make an enemy who will not normally come out in fact leave its defenses.
—Bansenshūkai, Yo-nin II 1
With an image straight out of a haiku, Bansenshūkai calls an open-disguise infiltration technique suigetsu no jutsu—the art of the “moon on the water.”2 While the technique had many uses, shinobi used it primarily to target heavily fortified enemy camps—the kind that restricted people from leaving, entering, or even approaching. Instead of penetrating the camp’s defenses by force, shinobi would lure out their target, effectively tricking them into giving away ingress protocols such as insignias and other identifying marks, passwords, code words, and challenge-response signals. This technique also let shinobi tail targets as they returned to camp, lure defenders from their guard posts and infiltrate without resistance, or interact directly with targets and infiltrate through deception or offensive measures.
For targets especially reluctant to leave their heavily fortified defenses, the scroll instructs shinobi to seek help from their commanders to conduct advanced deceptions.3 For example, a commander could move forces into vulnerable positions, enticing the enemy to attack and thereby depleting the enemy’s defenses enough for shinobi to infiltrate. Alternatively, the shinobi would overpower the enemy when they returned, battle weary. The commander might even stage something more elaborate, like the beginning of a full-on, long-term castle siege. Then, shinobi might send a soldier posing as an allied general’s messenger to convince the enemy to leave their castle, join in a counteroffensive, and break the siege. To complete the ruse, the shinobi commander would send a small force to masquerade as allied reinforcements, both luring the target from their encampment and allowing shinobi to infiltrate while the gates were open.
According to the scroll, after shinobi successfully infiltrated the target using suigetsu no jutsu, they had to keep these thoughts in mind:
In this chapter, we will explore the ways this ancient technique could be deployed by a cyber threat actor and compare it to commonly used social engineering tactics. We’ll introduce a way to think abstractly about network communication signals as entering and/or leaving perimeters—despite the computer system’s not physically moving—and detail concepts for countering the moon on the water technique and social engineering attacks in general. Lastly, we’ll attempt a thought exercise scenario that mimics the conundrum ancient Japanese generals must have faced when targeted by moon on the water.
The shinobi moon on the water attack bears a striking similarity to today’s social engineering attacks, which exploit a human target’s decision-making processes and cognitive biases to manipulate them into revealing sensitive information or performing self-defeating actions. In cybersecurity, most social engineering tactics are used by adversaries operating inside enemy territory to exploit the target’s trust. Examples of typical social engineering attacks include:
Social engineering is a particularly challenging security problem because it exploits human nature in ways that technological controls cannot always defend against. As targets and victims become more aware of social engineering threats, many organizations lean on focused technical controls, security protocols, and user education to protect their valuable assets. Employees are trained in how to properly handle and care for sensitive information and systems, while security teams document procedures to verify the identity of unknown or unsolicited visitors and require physical escorts for non-employees on company grounds. Red teams conduct internal phishing and tailgating tests, among other exercises, to gauge employee awareness of and instill resistance to social engineering tactics. Administrators implement technical controls to block malicious documents and hyperlinks, employ data loss prevention (DLP) software, prevent unauthorized system changes, blacklist unregistered systems and external media, and use caller ID.
While these are all good and necessary security measures, the way people work has changed. And thinking around social engineering attacks has not yet evolved to fully consider defending against moon on the water–style attacks—the kind that attempt to lure the target outside its own defenses.
Today, things like bring your own device (BYOD) policies, full-time remote work, and multitenant clouds make workers and organizations more flexible. However, they also weaken traditionally strong perimeter security architectures and expose employees to new social engineering threats. For example, in most cases, stateful firewall rules do not permit external (internet) communication to pass through the firewall to an internal host. Instead, the firewall requires the internal (intranet) system to initiate contact before it allows responses from the external system to pass through to the internal host. So, while the internal host does not physically leave the organization’s defenses, doing so virtually—say, by visiting a malicious website—could allow threat actors to infiltrate within the responding communications. Essentially, this is digital tailgating.
In addition to directly compromising traditional security architectures, threat actors could use a number of moon on the water–style techniques to infiltrate heavily fortified organizations. Consider the following scenarios:
Note that while these attacks might not necessarily achieve an adversary’s end goal, they could provide means or information that, in conjunction with other exploits, accomplishes malicious objectives.
Most organizations perform social engineering awareness training and routinely phish test internal staff. While this strategy improves resiliency to such attacks, a significant percentage of personnel always fail. Unfortunately, most organizations leave staff vulnerable to social engineering. We need to do more to give employees the tools they need to guard against such deceptions.
All these measures will slow down business operations, but they also help mitigate social engineering attacks.
Where relevant, recommendations are presented with applicable security controls from the NIST 800-53 standard. Each should be evaluated with the concept of moon on the water in mind.
In this chapter, we described the advanced shinobi technique of moon on the water. We looked at various scenarios in which the moon on the water technique could be modernized to target businesses. We explored the challenges that social engineering presents and the various forms it can take. We reviewed existing security practices designed to handle social engineering and examined new defense concepts. And we lifted a thought exercise from the shinobi scrolls to demonstrate how fragile our trust model is and how hard it can be to safeguard against social engineering.
In the next chapter, we will discuss insider threats—one of the most fascinating topics in security. The shinobi scrolls provide detailed instructions on how to identify people who could be recruited as insiders with the help of some social engineering techniques—and they suggest a way to defend against insider threats that is contrary to modern best practices.