When Can the Defender Effectively Deceive Attackers in Security Games?