APT Security: Understanding, Detecting, and Mitigating the Threat

What Is APT Security?

This article outlines the risks posed by APTs, and how you can secure your network with APT security best practices.

An Advanced Persistent Threat (APT) is a complex attack that allows malicious actors to gain access to sensitive information undetected. APTs typically use a combination of tools and techniques to penetrate networks and conceal their presence. Attackers may use malware, spyware, root or boot kits, network propagation mechanisms, and sophisticated social engineering strategies like spear-phishing or whaling.

An APT may target any organization—victims range from small companies to large institutions and government agencies. Almost all organizations hold and process sensitive information, such as customer data and payment card information. Attackers can exploit this information to commit corporate espionage, sabotage your operations, or steal from your customers.

Even if you have a small company, it is essential to have a strategy to mitigate the threat of APTs.

The APT Challenge

The world is experiencing a growing wave of malware, with millions of new malware types introduced daily. Even more problematic is the evolution and proliferation of threat types. Security teams are increasingly dealing with advanced persistent threats (APTs), which employ advanced stealth techniques to attack well-defined targets.

For example, APTs may target high-value individuals including business professionals, technology leaders, and architects. APTs are usually operated by hostile nation-states or organized criminal organizations. These actors are usually aggressive, well-funded, and very skilled. Therefore, APT is one of the most complex security threats to detect and eliminate.

The explosive increase in data due to new technologies such as cloud computing, big data, and the Internet of Things (IoT) is exacerbating the information security situation. For example, one self-driving car can generate 40 GB of data per day. The volume of data entering the enterprise environment grows exponentially, necessitating a new approach to data security and placing new demands on personnel and infrastructure.

Organizations are realizing that traditional countermeasures and controls such as firewalls, intrusion detection systems (IDS), and monitoring, are still needed but not sufficient to detect APTs.

APT Trends

Here are a few important trends shaping the APT threat and the efforts to defend against it:

• Remote access and devices accessing unknown, unsecured networks increases the need for equipment such as VPN gateways.
• Organizations are grappling with the growing threat of voice phishing or “vishing” of remote employees to compromise their credentials or personal devices.
• Ransomware groups are shifting their strategy. The success of sophisticated, targeted attacks will cause more major ransomware players to start acquiring APT capabilities. These gangs invest some of the funds from their attacks into advanced tools and attack strategies. Learn more in our guide to ransomware protection.
• There are more direct, systematic attacks that affect critical infrastructure or are aimed at disruption of secondary systems, exploiting the fact that life is more dependent on technology than ever before.
• Companies are taking action against zero-day brokers, who identify vulnerabilities and sell them on the open market.
• 5G vulnerabilities are emerging as adoption of this technology increases, and more devices depend on the connectivity it provides. Attackers are searching for and will discover exploitable vulnerabilities.
• More countries will use legal prosecution as part of their security strategy. As part of legal charges against APT criminals, prosecutors are exposing APT group toolsets, “burning” them, and preventing other APTs from using them. This can hurt the activity and progress of any APT group using the toolset.

Signs of an Advanced Persistent Threat

APTs are challenging to identify, and their success relies on remaining concealed. However, an organization can look for warning signs to help its security team respond:

• Unusual user behavior—if an authorized user displays unusual network behavior, this could indicate an attack. An example could be logging in several times over the weekend.
• A sizable movement of data—an unexpected increase of database activity, including large amounts of information being transferred to an external server or throughout the network, could indicate an APT.
• Backdoor trojans—if you identify backdoor trojans, it could indicate that an attacker is using them to achieve and maintain access throughout the network.
• Unusual data files—when an attacker moves data off the server, they often create files with unusual sizes or file formats to streamline the process.

APT Security Measures

Traffic Monitoring

Monitor Your Network Perimeter
Examining traffic within your network perimeter can alert security personnel to any abnormal activity that could indicate malicious activity. You should monitor ingress and egress traffic to prevent the creation of backdoors and to block stolen data extraction.

Install Web Application Firewalls (WAF)
WAF installed on the edge of a network examines traffic to your web application servers, thus safeguarding vulnerable attack surfaces. A WAF can help isolate application-layer attacks, including RFI and SQL injection attacks, which attackers typically use in the APT infiltration stage.

Use Internal Traffic Monitoring Tools

Internal traffic monitoring tools such as firewalls offer a granular view that can help you discover traffic abnormalities (such as unusually large data transfers or irregular logins). Such traffic abnormalities could point to a current APT attack. Furthermore, you can monitor access to system honeypots or sensitive file shares.

Remove Backdoor Shells
Incoming traffic monitoring services might also help identify and remove backdoor shells. You can detect these weaknesses by intercepting the attacker’s remote requests.

Application and Domain Allowlisting

Allowlisting is a method of managing domains allowed to access your network and applications that your users install. You can use this method to reduce the success rate of APT attacks by limiting the available attack surfaces.

However, this security measure is not always effective, as even a highly trustworthy domain could be compromised, and attackers can guise malicious files as legitimate software. Furthermore, attackers commonly exploit and compromise older versions of software products.

For a successful allowlist, you should enforce strict update policies to make sure your users always use the most recent version of all applications on the list.

Access Control

Your employees generally represent the greatest risk and most vulnerable point in the security perimeter. Attackers often view your network users as a simple gateway to bypass your defenses and grow their hold within your security perimeter.

Potential targets commonly fall into one of these three categories:

• Irresponsible users—who disregard network security policies and unwittingly grant access to potential threats.
• Malicious insiders—who deliberately misuse their user credentials to give perpetrators access.
• Compromised users—when attackers have compromised the user’s network access privileges.

You need to conduct a review of everyone in your organization when establishing comprehensive security controls. You should specifically focus on the data your employees can access, classifying data on a must-know basis. This classification process helps stop an intruder from hijacking login credentials from a low-level employee utilizing it to obtain sensitive information.

You should secure key network access points through two-factor authentication (2FA). Users thus need a second form of authentication when accessing sensitive information. This approach stops cybercriminals disguised as valid users from moving around the network.

APT Security with Perception Point

Perception Point provides enterprise-grade security to protect email, browsers, cloud collaboration platforms and proprietary apps from all types of cyberattacks.

An all-included managed Incident Response service is available for all customers 24/7. Perception Point’s team of cybersecurity experts will manage incidents, provide analysis and reporting, and optimize detection on-the-fly. The service drastically minimizes the need for internal IT or SOC team resources, reducing the time required to react and mitigate web-borne attacks by up to 75%.

Customers deploying the solution will experience fewer breaches, while providing their users with a better experience as they have the freedom to browse the web, use SaaS applications that they require, and access privileged corporate data, confidently, securely, and without added latency.

Contact us for a demo of our Advanced Threat Prevention solutions, today.