What is an Advanced Persistent Threat (APT) and How Does it Impact Businesses?

Advanced Persistent Threats, or APTs, are a classification of cybersecurity threats emphasizing long-lasting and pervasive attacks. These threat actors are typically large-scaled threats attacking targets of opportunity associated with economic or political goals. These “advanced” attacks are several levels more dangerous than traditional attacks in that they expand on three cornerstones of modern cyber threats:

APTs are:

1. Continuous: An APT isn’t simply a drive-by attack, a theft of information or a breach of a system. APTs are categorized by the ways in which they embed themselves into systems to maximize their impact, whether that be damaging the system or stealing information. 
2. Clandestine: These attacks are increasingly secret, using any and all methods to hide their operations and their origins. Many modern APT threats have been found to be sponsored or supported by foreign governments seeking to destabilize U.S. infrastructure. 
3. Sophisticated: Due to state sponsorship and increasingly lucrative ransoms, many hacker groups creating and launching ATPs can implement some of the most advanced and technically innovative software in the world… much to challenge unsuspecting security experts in the private and public sector. 

It’s somewhat easier to think of cybersecurity threats as single-event incidents that can be mediated, mitigated and forgotten. But, as we are seeing both in modern attacks on SolarWinds cloud applications, the Colonial Pipeline ransomware and the increasing incidents of cyberwarfare against private infrastructure in places like Russia, Europe and the U.S., these sophisticated attacks are changing how we think of compliance and security, especially in the defense supply chain. 

What Are the Different Aspects of an APT?

What sets an APT apart from more traditional forms of cyberattacks is the unique set of components in a typical APT payload. 

APTs are broken down into five different stages:

1. Gaining Access: APTs begin by gaining unauthorized access to a system. At this stage, APTs will most likely leverage known vulnerabilities in public-facing applications, IAM systems and limitations in security best practices. Sometimes they will look back into records of reported bugs to determine what they will attempt. The SolarWinds Sunburst hack, for example, was traced back to a .NET backdoor reported as early as 2017. 
2. Establish a Foothold: Once access is gained, the APT will inject malware into the system to begin propagation. This malware will quickly establish back doors, smokescreens and obfuscation to change code and system settings without warning administrators. 
3. Grow Roots: Once malware is in place, the APT will then spend time exploring and exploiting the system by cracking passwords, looking for flaws in authorization policies and copying data. At this stage, the attacking software, so long as it remains undiscovered, will most likely find success in achieving administrator rights, installing bots to monitor network traffic and propagating itself in connected systems. 
4. Lateral Movement: Once roots are deep, the APT, like seeds from a dandelion, will begin to spread to connected servers and client systems. We saw this at play in the SolarWinds attack, where a centralized APT was able to spread into cloud environments of clients like Microsoft, Oracle and several government agencies. 
5. Monitoring: The APT malware, now firmly embedded into the system, will monitor system activities, network traffic and applications so long as it remains undiscovered. At this stage, the APT is simply harvesting information for whatever purpose the attackers see fit. 

As you can see, APTs are insidious in their operation. Long-lasting, quickly shifting and driven by secrecy and sophisticated technology, APTs are one of the largest cyber threats that modern businesses and government agencies face today. 

How Can I Combat APTs?

The truth is that a system that is 100% resistant to APTs does not exist. It’s up to businesses and agencies to therefore take care with compliance and security measures that meet the demands of their operations and the data they manage. 

With that being said, there are several steps to take to improve your chances against an APT:

• Remain Compliant: Compliance isn’t a foolproof practice, but it can go a long way towards maintaining a secure posture against APT attacks. Furthermore, don’t consider compliance and end goals in themselves. Some frameworks like CMMC will include specific requirements to address APTs, but not every industry includes such requirements. Even if you are compliant, always ask what you should do, what you can do and what you must do to maximize security.
• Use Whitelists, not Blacklists: Attacks can come from any network accepting connections… so take a proactive step in securing pivotal systems by implementing a whitelist, rather than a blacklist, for security. A whitelist will block all applications other than those permitted and closes quite a few security holes. 
• Maintain Upgrades and Patches: This can get complex, but it is imperative that your systems and software are updated and patched against the latest threats. Old vulnerabilities can lie dormant for years before an exploit brings down your infrastructure. If you cannot properly manage patches and updates, then work with a partner that can manage them for you. 
• Maintain Strict IAM Control: Identity and Access Management (IAM) is a key part of security and the one where many hackers make their attacks. Improperly configured IAM can allow a hacker to bypass otherwise strong biometrics or Multi-Factor Authentication, or propagate through sensitive systems with administrator controls. 
• Maintain Training, Education and Physical Security: On-site security is just as important as networked security. Make sure your employees have proper compliance training and security best practices education. Also ensure that any workstation, any data storeroom and any device is protected with compliant technology and common sense from your people. 

APTs Present a Challenge for
Enterprise Companies and SMBs 

We often think of APTs as major attacks that threaten the most important organizations, like utility companies, major banks, defense contractors and government agencies. As more businesses rely on data and cloud environments to do business, however, these APTs are quickly becoming a problem across all enterprises. 

To fight the rise in sophisticated attacks, it’s critical that we all play our part in proper cybersecurity. That means robust security engineering, managed upgrades and patch management, continuous monitoring and intelligent compliance that addresses real threats and not just a checklist. These steps will allow you to protect private data while continuing to do business safely. 

Want to Learn More About
SecureStrux Managed Security Services?

Contact us with the form below.