RiskUKNovember2017

Cyber Security: Advanced Persistent Threats
network and having the right tools to pinpoint
the signal from within the network noise. It’s
therefore unlikely that you’ll be able to identify
the APT by performing simple host-based
analysis, since that’s the sort of security APT
attacks are specifically designed to bypass.
Neither may a standard firewall at the
perimeter and anti-virus software on the
endpoint be sufficient to detect APT activity,
especially so if these are threats that haven’t
been seen before. The addition of network
behavioural monitoring to complement these
more traditional security tools provides a
means for detecting ongoing behaviours, even
if they’ve bypassed these other defences.
Blended security architecture
Having a blended security architecture such as
this ensures that, even in the event some
security layers are subverted, a backstop is in
place to prevent ongoing damage. No network
will be 100% secure. It’s vital that, in the event
an APT is present on your network, you’re able
to clearly see when and where it’s active such
that you can take the necessary remedial steps
with the minimum amount of disruption.
Given that APTs are designed to be
persistent, if you’re performing long-term
analysis and correlation it’s possible to identify
the behaviours associated with the APT in order
to prevent it from causing real damage.
Defences should be regularly tested to
ensure that an attacker cannot gain access and
also to make certain that the security tools
employed are identifying the attack in progress.
Business continuity procedures should also be
regularly reviewed and exercised. Consider all
options of an attack and have measures in
place to identify, limit and remove the threat,
recover quickly from the episode and limit
service interruption for the business overall.
APTs are evolving to become more stealthy,
for example by cleaning up any event logs that
have been made by operations performed.
They’re also often aware of virtual machines, so
sandboxing techniques are now proving to be
less effective. APTs tend to use any resources
that they have available on the exploited host
in order to reduce the ability of detection.
This applies to any attack, whether it be from
an APT or mainstream malware, as they’re
always developing to ensure they remain
undetected on a network or device for as long
as possible. File-less malware has become
more prevalent of late, meaning that existing
security solutions watching for evidence of
exploit from activities such as malware
installation on to the hard drive and/or registry
changes are no longer detecting occurrences.
“Defences should be regularly tested to ensure that an
attacker cannot gain access and also to make certain that
the security tools are identifying the attack in progress”
Many APTs are aimed at highly sophisticated
organisations with advanced security, meaning
that gaining ‘legitimate’ access through
techniques such as social engineering or
credential theft are a ‘must’ for them. For
example, it’s often the case that users re-use
passwords which may be exposed in unrelated
data breaches. Attackers can then employ them
to gain access to the network.
There’s no magic trick to shortcut the
detection of APTs, and don’t assume that APTs
are going to be detected in a short timeframe,
either. It can often take a significant amount of
time, resources and tooling to identify the
threat and then perform the forensics needed
to understand what actually happened.
Technology developments such as the Cloud
and BYOD add convenience to an organisation,
but at the potential risk of security. Steps can
be taken to secure sensitive data such as
issuing secured devices and making sure some
areas of the network are ‘air-gapped’.
Some enterprises react to the threat by
installing the most advanced and expensive
tools, without fully understanding what they
offer and how to use them effectively. Equally,
enterprises may install tools simply to meet
policies and ‘tick the box’. It’s always the case
that an organisation should implement a
strategic and measured approach to security.
Persistence can pay off when trying to gain
access to a network, and it’s likely that
someone who’s determined to break in will
almost certainly be successful in doing so.
Organisations must architect a network to
minimise the impact should a breach occur.
Have a backstop in place. Should the APT
make it through your primary and secondary
security defences, its time on the network and
resulting damage can be limited. Network
behavioural monitoring can play a vital role
here. The staged and covert nature of APTs
means correlation of behaviours over time is
critical in their identification and isolation.
Using more traditional network security tools to
deliver anomaly detection or using the latest
reputation feeds are helpful, but they will
certainly not be enough to allow you to identify
the threat and reduce your exposure.
An educated approach to security is crucial,
ensuring Best Practice is in place such that all
networks, endpoints and services are secure
and all end users suitably trained.
Daniel Driver:
Head of Perception Cyber
Security at Chemring
Technology Solutions
65
www.risk-uk.com