What is the best way to implement a secure network deception solution?

Deception is used for post infection detection during lateral movement at least by my Attivo (now Sentinel One) customers. They use it to obtain an IOC otherwise not found like this: 1. Deceptive honeynet traps are configured to mimic a high value target such as an AD or Dbase. 2. These traps are a few hops from what used to be called the DMZ, near whatever the edge to/from clouds/Internet is considered. 3. When other controls fail to catch a perpetrator, the trap we called BOTsink alerts the SOC/Blue Team/SIEM/MSSP. 4. Deceptive credentials on end points when stolen are not the actual, true credentials. 5. For DFIR, logs/PCAPs are gathered when the alarm rings. 6. Dwell time is vastly reduced with deception.

This can be done manually, but deception platforms can do most of the work automatically. Many of them can query your Active Directory to figure out OS versions and naming conventions (for hosts and user accounts), for example.

Network deception is simple to deploy, but when done in an isolated way the value will be limited. Hosts in the internal network, for example, will only be useful if there are lures/breacrumbs pointing to them, otherwise you may only have attack traffic reaching them when the attacker runs networks scans (not really common these days are scans are too noisy; unless you want to find simple things such as network worms - but there are simpler ways to do that, right? :-)) A mix of network hosts, breadcrumbs and honeytokens are the best bet to maximize the detection capabilities of your deception deployment.

There is no point in having deception in place if you are not looking at signals it generates. This is true for all detection technologies: They will only provide value when you are prepared to act on the generated alerts. Integrate your deception tools to your security monitoring infrastructure (your SIEM, for example) and processes. Review the detection settings and content regularly to ensure you are still seeing activity coming from your honeypots and honeytokens.