APT Or Everyday Cybercrime? How To Tell
Of the many attacks corporate networks face daily, advanced persistent threats are the most serious. Consider these tips to tell which kind of attack you're facing and what to do about it.
Oil companies, Internet technology firms, defense contractors, and even computer-security firms have all been targeted by persistent adversaries bent on stealing intellectual property and sensitive business information.
Advanced persistent threats (APTs)--a term that's become much maligned since the media locked onto it--describes attackers that are targeting specific companies and data, rather than searching for vulnerable targets of opportunity. Persistent attackers stole oil field exploration data from ExxonMobil, information on the Joint Strike Fighter from Lockheed Martin and Northrup Grumman, and sensitive data on SecurID tokens from RSA. For many in the industry, the question is no longer if they have been breached, but how deeply, said Richard Bejtlich, chief security officer of Mandiant.
More Security Insights
- The Untapped Potential of Mobile Apps for Commercial Customers
- Get Actionable Insight with Security Intelligence for Mainframe Environments
- The 451 Group Impact Report: Skybox Enters Vulnerability Management Space
- Securing Big Data: Securosis Recommendations for Hadoop and NoSQL Environments
"No one has been able to stop these guys, no one," he said. "They remain a problem for every company with valuable intellectual property."
Separating persistent threats from more opportunistic cybercrime-focused attacks is not easy, but can help inform defense, according to security experts. Block an opportunistic attack and the crisis is averted; block a persistent attacker and they will come back tomorrow, said Toralv Dirro, security strategist for McAfee's Labs in the Europe, Middle East, and Africa region.
"If someone is a victim of a targeted attack, there are patterns," Dirro said. "They should really follow up on identifying those patterns."
In many cases, the patterns are not clear. Even "advanced" attackers will only use, for example, the minimum force necessary to compromise a network. In some cases, attackers have rented botnets; in others, they've used standard cybercrime tools.
"It is never a case of, oh, they are using Poison Ivy, so it's APT--everyone is using Poison Ivy," Mandiant's Bejtlich said. "It really comes down to a lot of analysis to figure out what is going on."
Read our report on how to guard your systems from a SQL attack. Download the report now. (Free registration required.)