CS Sep-Oct 2021

APTs
malware to install backdoors that
bypass authentication.
The defence-in-depth model needs to
evolve to stay relevant by adopting
automated security and a zero-trust model,
she points out. "With this model, security
teams can scale their efforts in the
constantly-changing world of cybersecurity.
There are different levels of traditional
cybersecurity tools, such as firewalls,
antivirus, and defence in depth (IPS, IDS),
which aren't enough against an attack by
an APT. Still, they are necessary as essential
foundational must-haves from a security
standpoint. Advanced security consisting of
network devices with sandboxing systems,
new generation SIEM, EDR and subscriptions
to cyber intelligence services are essential to
detect and respond to attacks of the APT
magnitude. Early detection of APT attacks
is critical for successful mitigation before
networks are compromised and sensitive
data is exposed."
APT is a multi-faceted attack and defences
must include multiple techniques, such
as email filtering, endpoint protection,
privileged access management, and visibility
into the traffic and user behaviour," continues
Sundaresan, expanding on these as follows:
Email filtering: "Most APT attacks leverage
phishing to gain initial access. Filtering
emails, and blocking malicious links or
attachments within emails, can stop these
penetration attempts."
Endpoint protection: "Most APT attacks
involve the takeover of endpoint devices.
Advanced anti-malware protection and
Endpoint Detection and Response can help
identify and react to compromise of an
endpoint by APT actors."
Access control and Privileged Access
Management: "Strong authentication
measures and close management of user
accounts, with a particular focus on
privileged accounts, can reduce APT risks."
Monitoring of traffic, user and entity
behaviour: "Visibility and monitoring can help
identify penetrations, lateral movement and
exfiltration at different stages of an APT
attack."
As the definition of APT implies success
against you and your organisation, never has
detection and response been so important,
she concludes. "Preparation is paramount;
the fight against APT is a continuous effort,"
she warns. "Organisations need to become
aware of the nature of these attacks, and the
types of effective practices and technologies
that can help to combat them."
MURKY DEPTHS
For years, threat actors, like nation states and
cybercriminals, had distinct motivations and
different tools, comments Sam Curry, chief
security officer, Cybereason. "Nation states, or
'advanced persistent threats' as we called
them, moved like submarines, stalking ships
in the waters of target networks, carrying out
the policies of their governments and
providing asymmetric options, aside from the
normal diplomatic, economic, and military
strategies and tactics.
"By contrast, the fight against cybercriminals
more resembled battleship warfare than
submarine. The motivation among criminals
was profit and, as such, it was about
maximising the number of victims and
wringing every drop from an infection for as
long as possible. Even in the old days, the
security industry was not up to the task of
stopping either the malicious operations of
nation states nor the smash-and-grab theft
of cybercriminals."
The silver lining, however, adds Curry, is
the emergence of endpoint detection and
response (EDR), which is often mistaken
for a mere extension of existing endpoint
protection technologies like antivirus or
personal firewalls. "It is a tool for finding the
Sam Curry, Cybereason: nation states moved
like submarines, stalking ships in the waters
of target networks.
Bindu Sundaresan, AT&T Cybersecurity: the
defence-in-depth model needs to evolve to
stay relevant.
www.computingsecurity.co.uk @CSMagAndAwards September 2021 computing security
33