Managing the Advanced Persistent Threat (APT) Lifecycle

As more businesses rely on the internet for remote working and commerce, their risk of cyber attacks increases. Security experts report a greater-than 50% rise in digital attacks compared to last year, and the year hasn’t ended yet. One of the most insidious of all cyber attacks is the advanced persistent threat (APT) attack.

What Is Advanced Persistent Threat?

An advanced persistent threat is an attack in which an unauthorized user gains access to a system or network and remains there for an extended period of time without being detected. Instead of a haphazard phishing scheme, APT involves specific objectives that target networks to do long-term damage. APT attacks as they are now known to cyber security professionals began before 2005. Since that time, cyber security experts have had a chance to observe and identify APT threats and risks.

While APT attacks are highly customized to their intended targets, they all seem to follow a similar pattern. They all have clearly defined, tangible objectives. For instance, a cyber criminal can use spear phishing emails to gain access to a network, but those emails are just a means to an end. She really wants network access only long enough to input fake credentials into its login system. With her new login credentials, she can legitimately access the organization’s computer system shortly before it makes a lucrative initial public offering announcement.

Other characteristics of APT attacks include lengthy reconnaissance activities, high levels of skill, and numerous tools. It’s common for cyber criminals to invest months gathering intelligence about a target’s computer system prior to an attack. They show advanced skills throughout the attacks. You’ll notice people who are just as adept at pulling off social engineering scams as they are with crafting malicious code on the fly. While most conventional hackers rely on second-rate digital tools to cause mischief, APT cyber criminals use methods and tools that are mostly associated with government intelligence agencies. APT attacks are often carried out by groups of cyber criminals.

Examples of Advanced Persistent Threats

APT attacks happen for a variety of reasons. Cyber activists such as Anonymous can act on a rumor that a company isn’t being socially responsible and conduct a denial of service attack on the organization’s network. A government-sponsored cyber spy group could get orders to find and steal information regarding a breakthrough component that was developed by a manufacturing company in a foreign country.

Here are some real-world examples of APT attacks that have recently occured.

Iran has been under economic sanctions for decades, and the actions have taken a toll on the nation’s finances. According to an APT watchdog community, the Iranian government sponsored hackers to find vulnerable networks, infiltrate them, and sell access to those breached networks to other cyber criminals for a steady stream of passive income.

One of the reasons why Iran continues to be under economic sanctions is its nuclear program. Economic pressure hasn’t stopped Iran from developing nuclear products. As a result, the United States and Israel are believed to have co-developed a piece of malware that can spy on and sabotage industrial control systems at power plants to halt Iran’s nuclear power development efforts.

How Serious Are Advanced Persistent Threats?

The risk to computer systems is very high when cyber criminals employ APT attacks. The risk to an organization’s reputation is even higher. APT attacks that breach networks put everyone’s personal data at risk. Depending on the malware and attack methods, cyber criminals can access user names, customer contact information, and employee records. When an APT attack is socially or politically motivated, cyber bullies can make a company look irresponsible or unethical with planted evidence, and the company won’t have an opportunity to defend itself against the accusations.

When dealing with government-sponsored APT attacks, the stakes get even higher. Countries that gather and tally votes electronically can have election results skewed by foreign governments, rogue domestic enemies, or both. Unethical governments can also steal intellectual property from commercial enterprises in other countries to strengthen their own economies.

Is Your Organization at Risk for an APT Attack?

A variety of public and private-sector entities become targets of APT attacks. While financial institutions and technology companies are obviously at risk, APT cyber criminals most often attack organizations that receive, store, and transmit people’s personal information. Some of these organizations include telecommunications companies, medical facilities, and universities.

Your company is also at risk if it provides critical products and services to the public. One way to destabilize a region is to shut down its power grid. Using spear phishing emails and some clever social engineering techniques, cyber terrorists can infect systems with malware and stop power from reaching residents and business owners.

Challenges for Detecting and Minimizing APT Risks

The subtle nature of APT attacks make them hard to detect, combat, and prevent. Cyber criminals who pull off APT attacks stalk their targets and take measured actions to gain information. Cyber security professionals only have a small window of opportunity to detect a threat and pursue protective actions. Once cyber criminals gain access to a network, they don’t follow the common script of conventional hackers. Their responses are highly adaptive, which means that IT staff members are unlikely to understand the nature of the attacks until the cyber criminals accomplish their objectives.

Most conventional hackers operate on limited budgets and steal personal information as a side hustle. Many cyber thieves who perpetrate APT attacks appear to be heavily funded. Deep pockets allow them to wage sophisticated warfare for longer periods of time. As a result, APT attacks lead to mass data theft that further erodes the security of a company, its employees, and its customers.

Ways to Secure Your Organization Against APT

An advanced persistent threat is an attack in which an unauthorized user gains access to a system or network and remains there for an extended period of time without being detected. Instead of treating APT attacks like conventional hacking schemes, you’ll need to know the lifecycle of APT attacks to safeguard your organization against them.

Here are the steps in the APT lifecycle:

– Select target based on objectives
– Introduce target to an organized team
– Get or develop tools
– Gather intelligence on target’s employees and network
– Do a test to guard against early detection
– Breach the system
– Collect data and transmit it externally
– Increase access and get legitimate log-in credentials
– Cover digital tracks to stay hidden

Having in-house or contract Identity and Access Management (IAM) professionals strengthen your company’s policies and protocols for network user access helps to stop APT cyber criminals at nearly every phase of the APT lifecycle. Installing firewalls and enabling email protections are standard practices for advanced threat protection (ATP). Many IAM professionals recommend ATP tools that support quarantining of suspicious files, data encryption, and IP blacklisting. They may also suggest that your organization conduct quarterly ATP security audits.

Conclusion

Cyber criminals who launch APT attacks are usually sophisticated programmers who are armed with an extensive arsenal of digital tools and intelligence data. While APT scenarios seem nearly impossible to guard against, there are protocols and tools that can help. Protection begins with knowing the typical APT lifecycle and applying the right mitigation strategies at each phase.