iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
The most reliable way to frustrate an adversary is to make the next step of an intrusion slower, harder to trust, easier to notice, or easier to interrupt. No single control does that for every attack. A stronger defense combines restricted access, behavior-focused detection, independent verification, and carefully chosen barriers to an attacker’s dependencies.
What does it mean to frustrate an adversary?
Frustration is not the same as prevention. A control may force an intruder to change tools, spend time rebuilding infrastructure, or take a noisier route. That can create opportunities to detect and contain an operation, but it does not guarantee that the operation will stop.
The practical question is which obstacle best fits your environment. These approaches address different stages and depend on different kinds of visibility:
| Approach | What it can change | What it depends on | Main trade-off |
|---|---|---|---|
| Restrict access and use deception | Limits easy entry paths; decoys can attract or expose suspicious activity | Accurate access rules, monitoring, and maintained decoys | Rules can disrupt legitimate work; a decoy alert needs investigation |
| Detect behavior rather than tool names | Can reveal an action even when an intruder changes utilities | Relevant telemetry, a picture of normal activity, and analytics that account for obfuscation | Requires tuning and can still be evaded |
| Constrain remote-management tools and agent sessions | Removes unauthorized routes or limits what a session can reach | A current inventory, enforceable software controls, and observable network paths | Restrictions must fit legitimate administration and application needs |
| Verify urgent requests independently | Slows social engineering that relies on a rushed decision | Agreed procedures and a known, separate contact channel | People need a clear way to act quickly without trusting the suspicious message |
| Block an attack-chain dependency | May interrupt a current handoff or force an attacker to rebuild infrastructure | Visibility into the relevant domain, URL, contract, or network request | An adversary may switch to a replacement dependency; blocking can affect legitimate use |
Reduce easy access and make suspicious activity visible
Restrict who can reach critical servers
Limit sign-in to critical servers to the accounts that genuinely need access. Alert on unauthorized connection attempts, and monitor changes to the restrictions themselves as well as changes to administrative groups. Otherwise, an attacker who gains a foothold may try to weaken the controls before using them.
#1 Best Overall
- EXPLORE THE ISLAND OF CATAN: Settle the uninhabited island of Catan by gathering resources, building infrastructure, and nurturing trade relationships.
- STRATEGY AND COMPETITION: Compete with 2-3 opponents to expand your settlements and cities while managing resources and avoiding the robber.
- TRADE, BUILD, AND SETTLE: Use brick, wood, wheat, ore, and sheep to construct roads, settlements, and cities in your race to 10 victory points.
- REPLAYABLE AND ENGAGING: With a modular hexagonal board, no two games are the same, offering endless strategic opportunities and replayability.
- FOR FAMILIES AND STRATEGY ENTHUSIASTS: Designed for 3-4 players, ages 10 and up, CATAN 6th Edition is perfect for family game nights and friendly competition. Add the CATAN 5-6 Player Extension (sold separately) to expand your game to 5-6 players.
For especially sensitive systems, distinct credentials or authentication methods can reduce reliance on a shared identity or routine sign-in path. Protected enclaves can add monitoring around critical infrastructure. These measures are useful only if exceptions are deliberate and changes to access are visible to the people responsible for responding.
Use decoys as tripwires, not proof
Deception can give defenders a signal when a person or program interacts with something that should not attract ordinary activity. Examples include honeypot email addresses based on previously leaked addresses on expired domains, fictional employee profiles seeded to attract malicious messages, and false servers, shares, accounts, or network space.
A honeypot message may reveal a lure or attacker infrastructure early enough to strengthen protections before the same approach reaches real staff. But an alert is a reason to investigate, not proof by itself that every interaction is malicious. Decoys also need to remain distinguishable from real assets and be monitored well enough for an alert to reach someone who can act on it.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Detect the action, not just the named tool
A detection that looks only for a familiar program can fail when an intruder uses a different implementation. For credential access, possible approaches include Mimikatz, comsvcs.dll, direct access to LSASS memory, or a custom utility. The tools differ; the underlying objective is to access credential material.
Rank #2
- Stratego is the strategic game where you challenge your opponents in the heat of battle
- Your task is to capture your opponent’s flag while defending your own
- Lead your men into battle, every move is crucial
- Includes 2 x 40 pre-printed playing pieces, Game board, Screen and 2 sorting trays for the pieces
- Suitable for 2 players, aged 8+
- Choose high-impact techniques. Identify the attacker actions that would matter most in your environment.
- Map alternate procedures. Consider how the same objective could be reached with other utilities, built-in components, or custom code.
- Find durable signals. Look for behaviors that remain relevant when a tool name, command syntax, or implementation changes.
- Check what your telemetry can show. Detection depends on having suitable event data and understanding normal organizational activity.
- Account for obfuscation. Consider whether encoding, transformations, or other concealment could hide the activity from the analytics you use.
MITRE ATT&CK can help teams organize techniques and the procedures associated with them. It is a way to structure defensive thinking, not a substitute for validating that your own systems produce the signals a detection needs.
Constrain remote-management software
Remote-monitoring and management (RMM) tools are used for legitimate administration, but an intruder can also misuse them to maintain access or interact with a compromised system. Cisco Talos’s October 1, 2026 article names AnyDesk, ScreenConnect, and Atera as examples an organization might block or alert on if they are not authorized. It also reports that Warlock ransomware has used Zoho Unattended Agent; this is a reported example, not a guarantee about current activity or a claim that the tool is inherently malicious.
Start with an inventory of approved RMM products and where they are needed. Then apply allowlisting where practical so approved software can run and unapproved products can be blocked or raise an alert. Windows Defender Application Control, AppLocker, and endpoint detection and response (EDR) platforms are examples of mechanisms that may enforce or support those rules. The right control depends on the organization’s actual software and administration needs; removing one route creates friction and a chance to detect activity, not certainty that the operation will stop.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minuteMake urgent requests independently verifiable
Social engineering often tries to make a person act before checking whether a request is genuine. Decide in advance which situations truly require an immediate response and how those situations would normally be communicated. Establish a verification route that does not depend on contact details supplied in the suspicious message.
Rank #3
- EXCITING TRAIN ADVENTURE: Embark on a journey across early 20th century North America, collecting train cards and claiming routes to expand your network and connect cities.
- EASY TO LEARN, HARD TO MASTER: With simple rules and engaging gameplay, Ticket to Ride is perfect for both new and experienced players, making it a great choice for family game nights.
- BEAUTIFUL GAME COMPONENTS: Features a giant map of the North American train network, accompanied by miniature trains for each player, enhancing the visual appeal and immersive experience.
- MULTIPLE WAYS TO WIN: Strategically collect color sets of train cards, complete your tickets, and build the longest routes to secure victory, offering endless replayability.
- FUN FOR ALL AGES: Whether you're playing with family or friends, Ticket to Ride offers hours of fun, making it an ideal choice for casual and competitive gamers alike.
For example, if a message says a child has been injured at school, call a number already known to belong to the school rather than a number included in the message. The same principle applies at work: use a previously established channel or contact, not the reply path provided by an unexpected request.
Give AI-agent sessions boundaries defenders can observe
For an AI agent, use a distinct identity for each run, short-lived credentials, and restricted destinations. Route network traffic through an independent gateway where activity can be observed or stopped. Unless a task specifically requires them, block access to sensitive targets such as cloud metadata services and Kubernetes interfaces.
Possible warning signs include unexpected writes, unusual API operations, calls to Kubernetes or VPN interfaces, public services used as command-and-control channels or dead drops, credential discovery followed by activity across accounts, rapid changes in destinations, DNS pinning, short-lived egress identities, and unusual traffic bursts. These are indicators to assess in context, not proof of malicious intent on their own.
Cisco Talos’s article refers to an Anthropic report describing four incidents in evaluation environments that had inadvertently been given internet access. The organizations were unnamed; the agents were not instructed to act maliciously, and the incidents were not described as conventional adversary operations. That example should not be treated as evidence that those agents conducted attacks. The defensive value here is in making each session identifiable, limiting its reach, and preserving a way to inspect or interrupt its activity.
Rank #4
- CLASSIC TILE PLACEMENT: Draw and place landscape tiles to build cities, roads, fields, and monasteries, then deploy meeples as knights, farmers, and monks to claim features and score points.
- STRATEGY FOR ADULTS AND FAMILIES: Carcassonne pairs intuitive rules with meaningful decisions, making it accessible for ages 7+ while still engaging experienced adult board gamers.
- REPLAYABLE MEDIEVAL ADVENTURE: Randomized tile draws create a different landscape every game, bringing fresh puzzles and competitive fun to family game night and casual group play.
- TWO TO FIVE PLAYERS: Built for 2-5 players with an average 35-minute playtime, Carcassonne fits weeknight sessions at home, family gatherings on vacation, and adult board game evenings.
- INCLUDES MINI-EXPANSIONS: The base game comes with The Abbot and The River mini-expansions in the box, adding variety to the classic Carcassonne board game experience from the start.
Break a dependency when you can see and safely block it
Some attack chains depend on an external location or service to pass instructions from one stage to the next. Cisco Talos describes an Amatera chain in which a Telegra.ph page concealed the command-and-control server location. Blocking that page could interrupt the handoff, so the malware could not receive collection instructions or further payloads. An interruption of that chain does not mean the attacker or other parts of the operation have been eliminated.
In another example, ZigCryptoStealer stored a command-and-control domain in metadata of a BNB Smart Chain contract. Blocking a specific contract could disrupt the current operation, but the adversary could deploy another. Whether that is practical depends on visibility into blockchain RPC requests and a way to distinguish the contract involved.
For known domains and URLs, DNS filtering, secure web gateways, proxies, or firewalls may provide ways to block or monitor access. If public blockchain or RPC access is unnecessary, blocking it may be simpler. If it is needed for legitimate work, allow approved services and monitor known malicious contracts instead. The choice should account for legitimate use as well as the ability to see what is being blocked.
Choose controls that fit the environment
Start with the attack paths and behaviors that would cause the most harm, then check whether your organization can observe and respond to them. A restriction that no one monitors, a decoy with no response process, or a detection without the necessary telemetry may look useful on paper but create little practical friction.
- Confirm which accounts, applications, and external services are genuinely required before restricting access.
- Decide who receives alerts and what evidence they need to investigate them.
- For software controls, define approved exceptions so routine administration is not mistaken for unauthorized activity.
- For verification procedures, make the independent channel easy to find and usable under time pressure.
- For network or contract blocking, account for legitimate dependencies and the possibility that an attacker may adapt.
The common thread is not a particular product or trick. It is changing the economics of the next step: reduce easy options, make remaining actions observable, and preserve a practical way to interrupt them.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
