Targeted Attack Protection
By: Darin Barton CISSP, CISA
Targeted Attacks and Advanced Persistent Threats (APT) are now considered the Number #1 attack vector for cyber criminals.
WHY? Because it works!
What exactly is the difference between a Targeted Attack and an Advanced Persistent Threat (APT). In truth, they are similar but APT’s are generally thought of as being initiated by nation-states and focused mainly on the collection of data. High value objectives, such as; national defense and defense contractors, certain manufacturing sectors and the financial industry are most often the targets of APTs.
Most organizations should be concerned with Targeted Attacks since these attacks could be focused on stealing information, carrying out fraud or simply causing chaos within the network. This is an attack where an unauthorized person gains access to a network and remains undetected for as long as possible. The goal of the attack is to gain ongoing long-term access into systems without the end user or IT administrative team knowing of the threat.
WHY ARE TARGETED ATTACKS SO SUCCESSFUL?
Social Media has provided criminals with a vast amount of personal information to select from:
- Linked-In
Using this information, a cyber criminal can now direct attacks directly to a specific party increasing the likelihood that the recipient will click an infected link or download a Trojan infecting their machine with a backdoor program. The most intelligent and sophisticated of I.T. people can be deceived if the attack is done right. And, because some of these attacks are so complex many endpoint security applications do not catch the malware being introduced.
HOW CAN YOU PROTECT YOURSELF?:
Training your staff on Security Awareness has proven to be the best way to help mitigate regular threats to your environment; however, regardless of the amount of training, attacks will continue to occur and some will be successful. When a successful attack happens you need the ability to detect it as soon as possible and begin recovery procedures.
Using a threat emulation solution (also known as a sandbox solution) is one of the best ways to uncover malware or other attacks traversing your networks. Personally, I like the Trend Miro Deep Discovery solution for its in-depth security features and its ability to communicate with Trend protected endpoints to dynamically isolate devices from the network; but Cisco FireAMP is another solution to look for. Depending on your approach to IT Security, your existing architecture and environment, both of these solution should be highly considered and explored.
:Darin Barton CISSP, CISA is a senior security professional in Toronto Canada, with 20+ years experience in cybersecurity and investigations and currently employed with Access 2 Networks Inc. (A2N).
