Editor's note

Persistent
Within Information Security Community, and mainly
amongst hacking techniques experts, there is a belief
that no matter how many protective measures you
implement, targets will always be potentially vulnerable
if there is enough time and motivation. Unfortunately
this has proven to be true in most cases.
In fact, when we say that these attacks are persistent
we mean that they focus in a given target, using different
techniques until reaching their goal.
Usually when computer attacks are addressed from a
business standpoint, it is very common to say that it has
to do with a large scale businesses; in other words that
the ultimate goal is to launch a massive threat that will
only hit on a restricted number of victims, though this is
more than enough to have a return on investment and
profit.
Threat
Use of different techniques and coordination of multiple
resources to achieve a goal, tell us about a very strong
motivation: APT attacks share a feature in common;
all individuals involved in the attack are determined to
accomplish their objective.
A threat is the possibility of materializing a risk; if we
think about a group of organized people, with resources
at hand, the necessary skills to use those resources and
the determination to insist on the attack, it is clear that
the hacking maxim mentioned before gains a renewed
meaning!
What Is Hidden In The Name: If All The Aforesaid
Had Not Worried You …
It’s important to bear in mind that this kind of attacks are
also based on unknown techniques, i.e. vulnerabilities
or exploits non massively diffused or announced, since
perpetrators of these attacks have the necessary time
and skills to develop them.
This is a key reason why these kinds of attacks
are different from the rest. While traditional attacks
pursue simple targets (based on a cost-effective ratio
between their efforts to vulnerate and the financial
gain), APT attackers are willing to do everything just
for accomplishing their goal, even if it implies the
development of some new kind of threat.
Use of unknown threats and new kinds of attacks
bring value added for APTs, something attackers are
really looking for; this makes their early detection more
difficult! Like we said, these attacks are characterized
by their sneakiness; the purpose here is to keep threat
inactive or acting undetectably, steeling information. For
example, by enhancing effectiveness time; the longer
these techniques (used to permeate information and
starterkit 02/2011(2)
SOCIAL FRAUD
make use of the threat) remain anonymous, the better
for attackers.
Digital Identity And Brand… Weren’t They
“Intangible”?
If there is something Advanced Performance Threats
have made possible, is the fact that they have turned
some kind of assets usually referred to as intangibles
into something concrete. Of course, the Marketing
& Finance Areas have always known quite well the
(monetary) value of a brand (both for a company and
for a line of specific products). Nonetheless many IT
Departments have not handled the same business
parameters to value and protect these assets.
However, from the attack that infringed security of
a renowned consumers good brand and modified the
contents of a recipe where those those products were
used, up to more complex issues where very expensive
Intellectual Property infringements took place, the
threats referred to in this whitepaper show the high
exposure degree to which a company’s most significant
assets are exposed (in fact many authors agree that
brand is the most valuable asset).
Technology and Security Areas Managers should pay
much attention on this issue. If their objective is to add
value to the business and become strategic business
areas for the organization, the fact of the company
investing lots of money in advertising and social
action campaigns to raise the value of a brand, and
then having this value affected because of computer
attacks, would not only jeopardize the organization’s
confidence on these areas, it might as well be seen as
a weakness.
Conclusion
We shall review next some key items at the time of
evaluating our protection against APT attacks; once
again do not consider this as a thorough list, since
we may find many other information sources with
different and highly useful recommendations. Though
I do strongly recommend considering all these
aspects and analyzing how each one applies to the
organization.
Risk Analysis: Imminent Realization!
In general, the best way to understand what proactive
measures are required to reduce exposure degree,
and therefore threatening risks for organizations is to
perform a risk analysis.
However, please note that I am referring to
quantitative risk analyses, made in a wide awake
and thorough manner, including all organization’s
information assets, i.e. the kind of interdisciplinary
Page 32 http://pentestmag.com