Advanced Persistent Threats or ‘APT’s', have been receiving quite a bit of press lately.  If you’re not familiar with APT’s here is the Wikipedia definition:

Advanced Persistent Threat

Advanced persistent threat (APT) usually refers to a group, such as a foreign nation state government, with both the capability and the intent to persistently and effectively target a specific entity. The term is commonly used to refer to cyber threats, in particular that of Internet enabled espionage, but applies equally to other threats such as that of traditional espionage or attack.^[1] Other recognized attack vectors include infected media, supply chain compromise, and social engineering. Individuals, such as an individual hacker, are not usually referred to as an APT as they rarely have the resources to be both advanced and persistent even if they are intent on gaining access to, or attacking, a specific target.^[2]

I will be the first to admit that customers and vendors give lots of lip service to security but at the end of the day their spends tend to be more focused on compliance and operational efficiency.  So what’s the business case around APT’s?

Well, the Verizon Data Breach reports from 2010 and 2011 shed some interesting light on the subject.    Just so you know, the data collected in these cases are from joint assessments between Verizon and the U.S. Secret Service.  As with any study, it’s a sampling.  Meaning that trends witnessed may or may not be “real” because it’s hard to determine a sampling of something that is largely kept secret.

An interesting trend in the 2010 report illustrated that there has been a shift in targets as it relate to the number of data breaches.  Surprisingly it’s not financial services or public sector at the top.  It’s hospitality at the #1 spot with retail coming in second.  The take on the data is that the focus of APT’s has shifted to lower risk targets which are large in number and relatively high in yield.

Ok, so that’s all well and good.  But what can organizations do to protect themselves from APT’s?

1.  Keep an eye out for ‘Spear-phishers’. 

Spear-phishers are phishers who send targeted and calculated communications via e-mail and/or social media to high value targets.  These targets are typically called ‘whales’ and are C-level executives.   They have the most access to the most sensitive data.

What to do?  Educate your C-level and leverage anti-phishing technology where applicable. 

2.  Watch out for ‘SQL Injection’.

This is one of the key tools in the APT toolbox.  It’s concerning for a few reasons.  One being that script kiddies can readily access SQL Injection tools.  The other being that SQL Injection bypasses all traditional security controls such as firewalls, IDS, IPS etc.  .

How to stop it?  Use Database Firewall technology that employs SQL Grammar analysis and whitelisting technology.  Caution: Employer Plug (Oracle Database Firewall)

3.  Defense in Depth.

This one kind of goes without saying so I’ll say it anyway.  A great defense in depth strategy goes a long way to mitigating risk across the board.