How Can you Expose Targeted Attacks and Combat APTs?

Cybercriminals are employing more sophisticated techniques all the time and far too many companies and organizations still don’t have the protection they really need to safeguard their systems. The prevalence of targeted attacks and advanced persistent threats (APTs) is disturbing.

The risk is that security is breached, typically through manipulation of employees using a technique such as spear phishing, and existing security systems are unable to detect the attack. Data can be harvested for many months, or even years, before the breach is discovered.
According to a white paper (PDF) from the Enterprise Strategy Group, 59% of enterprise security professionals believe their organization has been the target of an APT, and 40% of large organizations have invested in various new security technologies as a direct result of APTs.

How do they get in?

Penetration may be achieved stealthily, typically with a targeted attack on an employee. The cybercriminal will gather data online, with social network accounts proving to be a particularly rich source. According to Trend Micro research (PDF), spear phishing is the preferred method, accounting for a staggering 91% of targeted attacks. The employee targeted will receive an email that appears to come from an organization like LinkedIn, and if they trust the content, they’ll follow the link within to a fake website where they may be tricked into allowing a cybercriminal to gain remote access to their computer.
Once the attacker has access to one employee’s computer they can use it to gain remote access to devices belonging to other employees in the organization. The threat has spread dramatically and traditional security tools will be none the wiser. Provided the attacker is careful to keep the data theft slow and steady, with frequent small file transfers rather than a big data dump, there’s little chance that it will be picked up by existing security systems.

How do you catch them?

The idea is to analyze downloads and network payloads in order to expose potentially malicious communications. It’s about detecting malware or human intrusions into your system by paying close attention to the addresses of any communication. Does the external location for a file transfer make sense? Does the address have a bad reputation? Are the SSL certificates legitimate?
It’s important to expose suspicious internal communications as well. Is there any reason that a specific employee’s computer should be the source of a remote desktop session on another employee’s device? A proper analysis will flag suspicious behavior and allow the IT department to assess the threat and take action to close it down.

Keep your guard up

The nature of this threat dictates the need for constant vigilance to keep the cybercriminals out. Shut down one route and they will continue to explore other avenues of access, the more obscure the better. There are many potential penetration points to consider. Activity must be analyzed across the entire organization and you need real-time information on potential attacks and known malicious sources.
How about blocking suspicious URLs and web-based content to stop penetration from the outset? Do you have application firewalls or database security? It’s also wise to ensure that you have data encryption technology in place; far too many companies focus on a Maginot line defense, pouring resources into defending against external attacks and forgetting that if attackers do gain access they can circumvent this security from within. Is your user authentication stringent enough?

How do you know you’ve caught them?

One of the most worrying aspects of APTs is that advanced attacks typically go unnoticed for over a year. You may be locking the stable door after the horse has bolted. That’s why an analysis of internal traffic is so vital. Suspicious behavior must be followed up and investigated. In the longer term you want to reach beyond identifying and blocking attacks to unmask the criminals responsible so that you can share intelligence to nullify their threat.
Targeted attacks are still on the rise. As governments and large organizations begin to take action and get a handle on the threat, there’s a real risk that many cybercriminals will look for easier prey. Don’t allow your company to be an easy target.
By Michelle Drolet, founder and CEO, Towerwall
Special to Infosec Island
This article was recently published in Infosec Island