DATA SECURITY KNOWLEDGE BASE

What is an Advanced Persistent Threat (APT)?

An advanced persistent threat (APT) refers to a continuous computer hacking process in which a cybercriminal carries out a prolonged attack against a specific target. Since advanced persistent threats occur over an extended period of time, the advanced persistent threat must be stealthy and well-coordinated. Advanced persistent threats usually victimize organizations and/or governments, and typically have financial or political motives.

Advanced persistent threats are used to steal data without causing damage to the network or organization. In addition, advanced persistent threat attacks are most often carried out against organizations with valuable information, including financial institutions, healthcare organizations, manufacturing companies, and national defense organizations. The main difference between advanced persistent threats and other hacking methods is that in order to be successful, advanced persistent threats must be undetectable throughout the entire duration of the attack.

Advanced Persistent Threat Life Cycle

The initial step an attacker takes when beginning an advanced persistent threat attack is acquiring information to learn more about their target. Next, the advanced persistent threat proceeds with the attacker penetrating the target’s network through hacking or social engineering methods and distributing malware to the desired destinations. Once the network is compromised, the advanced persistent threat attacker keeps a low profile while they develop a plan to access and/or steal the information that is being targeted. Once the advanced persistent threat attack is in full swing, the attacker will capture information over an extended duration of time. The last step in an advanced persistent threat attack involves the attacker exfiltrating that data, covering their tracks, and using the stolen information based on their motives.

Advanced Persistent Threat Detection

Advanced persistent threats can be very difficult to detect due to the covertness of the attacker. An advanced persistent threat attack can go on for months with no visible signs to the target. Additionally, often times when a target realizes they are under attack they only discover a fraction of the attack as a whole. However, there are various warning signs that could signal that your business is under attack.

One of the most obvious warning signs of an advanced persistent threat attack is suspicious emails, as email phishing techniques are a popular way for attackers to gain entry into targeted networks. Another indication of compromise to look for is abnormal traffic and/or suspicious connections within your company’s network. Furthermore, advanced persistent threat attackers may try to issue commands to your company’s key applications. The last major warning sign of an advanced persistent threat attack is unauthorized attempts to access your company’s sensitive data or unusual data transfers.

Advanced Persistent Threat Protection

Despite the stealthy nature of advanced persistent threat attacks, there are preventative measures companies can take to protect themselves against the loss of critical information. One of the most important steps in protecting against advanced persistent threats is to have layered data security protections in place and know what data you are trying to protect. This will not only help to prevent advanced persistent threats, but will also ensure that your most sensitive data would remain protected if an advanced persistent threat attack were to happen.

Another critical safeguard in protecting against an advanced persistent attack is having continuous security awareness training for all employees. This ensures that all employees are aware of what to look out for when online and using email. Other technological safeguards against advanced persistent attacks include but are not limited to application whitelisting, encryption, data classification, security analytics, and managed security services.