Advanced persistent threat

May 21st 2012
(Redirected from Advanced Persistent Threat)

Advanced persistent threat (APT) usually refers to a group, such as a foreign government, with both the capability and the intent to persistently and effectively target a specific entity. The term is commonly used to refer to cyber threats, in particular that of Internet-enabled espionage using a variety of intelligence gathering techniques to access sensitive information,^[1] but applies equally to other threats such as that of traditional espionage or attack.^[2] Other recognized attack vectors include infected media, supply chain compromise, and social engineering. Individuals, such as an individual hacker, are not usually referred to as an APT as they rarely have the resources to be both advanced and persistent even if they are intent on gaining access to, or attacking, a specific target.^[3]

Criteria^[4]

Objectives - The end goal of the threat, your adversary

Timeliness - The time spent probing and accessing your system

Resources - The level of knowledge and tools used in the event (skills and methods will weigh on this point)

Risk tolerance - The extent the threat will go to remain undetected

Skills and methods - The tools and techniques used throughout the event

Actions - The precise actions of a threat or numerous threats

Attack origination points - The number of points where the event originated

Numbers involved in the attack - How many internal and external systems were involved in the event, and how many people's systems have different influence/importance weights

Knowledge source - The ability to discern any information regarding any of the specific threats through online information gathering (you might be surprised by what you can find by a little proactive)

Life Cycle

Actors behind advanced persistent threats create a growing and changing risk to organizations' financial assets, intellectual property, and reputation^[5] by following a continuous process:

1. Target specific organizations for a singular objective

2. Attempt to gain a foothold in the environment, common tactics include spear phishing emails.

3. Use the compromised systems as access into the target network

4. Deploy additional tools that help fulfill the attack objective

5. Cover tracks to maintain access for future initiatives

The global landscape of APTs from all sources is sometimes referred to in the singular as "the" APT, as are references to the actor behind a specific incident or series of incidents.^{[citation needed]}

Common targets

The Stuxnet computer worm, which targeted the computer hardware of Iran's nuclear program, is one example. In this case, the Iranian government might consider the Stuxnet creators to be an Advanced Persistent Threat.

Within the computer security community, and increasingly within the media, the term is almost always used in reference to a long-term pattern of sophisticated hacking attacks aimed at governments, companies, and political activists, and by extension, also to refer to the groups behind these attacks.^{[citation needed]} Advanced persistent threat (APT) as a term may be shifting focus to computer based hacking due to the rising number of occurrences. PC World reported 81 percent increase from 2010 to 2011 of particularly advanced targeted computer hacking attacks.^[6]

A common misconception^[who?] associated with the APT is that the APT only targets Western governments. While examples of technological APTs against Western governments may be more publicized in the West, actors in many nations have used the technological (cyber) APT as a means to gather intelligence on individuals and groups of individuals of interest.^[7]^[8]^[9] The United States Cyber Command is tasked with coordinating the US military's response to this cyber threat.

Numerous sources have alleged that some APT groups are affiliated with, or are agents of, nation-states.^[10]^[11]^[12]

Businesses holding a large quantity of personally identifiable information are at high risk of being targeted by advanced persistent threats^[13]:

- Higher Education^[14]

- Financial Institutions

Definitions

Definitions of precisely what an APT is can vary, but can be summarized by their named requirements below:^[15]^[16]^[17]

Advanced – Operators behind the threat have a full spectrum of intelligence-gathering techniques at their disposal. These may include computer intrusion technologies and techniques, but also extend to conventional intelligence-gathering techniques such as telephone-interception technologies and satellite imaging. While individual components of the attack may not be classed as particularly "advanced" (e.g. malware components generated from commonly available do-it-yourself malware construction kits, or the use of easily procured exploit materials), their operators can typically access and develop more advanced tools as required. They often combine multiple targeting methods, tools, and techniques in order to reach and compromise their target and maintain access to it. Operators may also demonstrate a deliberate focus on operational security that differentiates them from "less advanced" threats.

Persistent – Operators give priority to a specific task, rather than opportunistically seeking information for financial or other gain. This distinction implies that the attackers are guided by external entities. The targeting is conducted through continuous monitoring and interaction in order to achieve the defined objectives. It does not mean a barrage of constant attacks and malware updates. In fact, a "low-and-slow" approach is usually more successful. If the operator loses access to their target they usually will reattempt access, and most often, successfully. One of the operator's goals is to maintain long-term access to the target, in contrast to threats who only need access to execute a specific task.

Threat – APTs are a threat because they have both capability and intent. APT attacks are executed by coordinated human actions, rather than by mindless and automated pieces of code. The operators have a specific objective and are skilled, motivated, organized and well funded.

References

^ "Anatomy of an Advanced Persistent Threat (APT)". Dell SecureWorks. http://go.secureworks.com/advancedthreats. Retrieved 2012-05-21.
^ "Are you being targeted by an Advanced Persistent Threat?". Command Five Pty Ltd. http://www.commandfive.com/apt.html. Retrieved 2011-03-31.
^ "The changing threat environment ...". Command Five Pty Ltd. http://www.commandfive.com/threats.html. Retrieved 2011-03-31.
^ Bodmer, Kilger, Carpenter, & Jones (2012). Reverse Deception: Organized Cyber Threat Counter-Exploitation. New York: McGraw-Hill Osborne Media. ISBN 0-07-177249-9, ISBN 978-0-07-177249-5
^ "Advanced Persistent Threats: Higher Education Security Risks". Dell SecureWorks. http://www.secureworks.com/resources/articles/featured_articles/20120709-hcr/. Retrieved 2012-09-15.
^ Olavsrud, Thor. "Targeted Attacks Increased, Became More Diverse in 2011". PCWorld. http://www.pcworld.com/printable/article/id,254730/printable.html.
^ "An Evolving Crisis". BusinessWeek. April 10, 2008. Archived from the original on 10 January 2010. http://www.businessweek.com/magazine/content/08_16/b4080032220668.htm. Retrieved 2010-01-20.
^ "The New E-spionage Threat". BusinessWeek. April 10, 2008. Archived from the original on 18 April 2011. http://www.businessweek.com/magazine/content/08_16/b4080032218430.htm. Retrieved 2011-03-19.
^ "Google Under Attack: The High Cost of Doing Business in China". Der Spiegel. 2010-01-19. Archived from the original on 21 January 2010. http://www.spiegel.de/international/world/0,1518,672742,00.html. Retrieved 2010-01-20.
^ "Under Cyberthreat: Defense Contractors". BusinessWeek. July 6, 2009. Archived from the original on 11 January 2010. http://www.businessweek.com/technology/content/jul2009/tc2009076_873512.htm. Retrieved 2010-01-20.
^ "Understanding the Advanced Persistent Threat". Tom Parker. February 4, 2010. http://tominfosec.blogspot.com/2010/02/understanding-apt.html. Retrieved 2010-02-04.
^ "Advanced Persistent Threat (or Informationized Force Operations)". Usenix, Michael K. Daly. November 4, 2009. http://www.usenix.org/event/lisa09/tech/slides/daly.pdf. Retrieved 2009-11-04.
^ "Anatomy of an Advanced Persistent Threat (APT)". Dell SecureWorks. http://go.secureworks.com/advancedthreats. Retrieved 2012-05-21.
^ Ingerman, Bret. "Top-Ten IT Issues, 2011". Educause Review. http://www.educause.edu/ero/article/top-ten-it-issues-2011.
^ "What's an APT? A Brief Definition". Damballa. January 20, 2010. Archived from the original on 11 February 2010. http://www.damballa.com/solutions/advanced-persistent-threats.php. Retrieved 2010-01-20.
^ "Are you being targeted by an Advanced Persistent Threat?". Command Five Pty Ltd. http://www.commandfive.com/apt.html. Retrieved 2011-03-31.
^ "The changing threat environment ...". Command Five Pty Ltd. http://www.commandfive.com/threats.html. Retrieved 2011-03-31.

DailyDDoSe

Pages

Tuesday, January 22, 2013