A cycle showing four stages: collect raw data, analyze adversary behaviors, identify opportunities, and implement engagements. The Collect stage shows ghosts hovering around a computer network. The Analyze stage shows a ghost mapping the data it collected to ATT&CK to understand adversary vulnerabilities based on their behavior. The Identify stage shows a ghost using a magnifying glass to choose applicable engagement opportunities from the Engage matrix. The Implement stage shows three happy ghosts inside a “Trojan Horse” as they conduct the engagement.

The 10-Step Process helps defenders to walk through an operation from planning to operating and finally to analysis.

In 2013, Hy Rothstein and Barton Whaley co-edited a book titled “The Art and Science of Military Deception.” This book includes a chapter Whaley wrote entitled “The Process of Deception,” where he outlines a 10-step process for creating military deceptions. We have refined Whaley’s approach to create a 10-step process for denial, deception, and adversary engagement activities. This document explores each step in this process as it applies to adversary engagement operations.

Version: 1.0

Last updated: 2/28/2022

Fill out this form to provide feedback on this resource!