CS Oct 2021

advanced threat protection
A SHAPE-SHIFTING WORLD
ATTACKERS USE TRUSTED CLOUD SERVICES AND CONSTANTLY CHANGE THEIR
TACTICS TO AVOID KNOWN PATTERNS OF BEHAVIOUR. CAN ADVANCED THREAT
PROTECTION STILL BE EXPECTED TO KEEP PACE AGAINST SUCH FORCES?
Patrick Wragg, Integrity360: the key to
advanced threat protection is layers -
ensuring your operating systems and
applications are up to date; users are
educated; and that you have the latest
security solutions in place.
Advanced threat protection (ATP)
refers to a category of security
solutions that defends against
sophisticated malware or hacking-based
attacks, targeting sensitive data. ATP
solutions can be available as software or
as managed services. They can differ in
approaches and components, but most
include some combination of endpoint
agents, network devices, email gateways,
malware protection systems, and a
centralised management console to
correlate alerts and manage defences.
But how do they operate and perform 'in
anger', so to speak, and where might there
be any weaknesses? At the same time,
in a world where the threat levels alter
dramatically and rapidly at an alarming rate,
where might they need to be adapted to
counter future emerging challenges?
"Perhaps it's become a cliché, but advanced
threat protection requires detection and
containment, 'beyond the email gateway',"
says Mike Fleck, VP marketing at Cyren.
"Cybersecurity and industry professionals
have been using this term to describe the
need for organisations to have a layered
security approach with security controls and
incident response capabilities to deal with
the advanced threats that slip past the email
perimeter and arrive in a user's mailbox.
HEART OF THE ORGANISATION
"Email is the most common method of
delivering threats - advanced and otherwise
- because it is one of the few ways to
transport an attack straight to the heart of
an organisation, through its people. What's
more, the most favoured approach to an
email attack is phishing [ie, harvesting login
information using spoofed web pages of
trusted brands]; once attackers have the
ability to remotely log in to a corporate
network, they can launch convincible fraud
campaigns and surveil the environment to
find the most sensitive data to steal or the
most business-critical servers to infect with
ransomware."
Security controls beyond the gateway
have traditionally focused on data loss
prevention, sophisticated malware analysis
and endpoint security solutions, he points
out. "However, advanced email threats still
evade detection and containment largely
because attackers use trusted cloud services
and constantly change their tactics to avoid
known patterns of behaviour. Endpoint
security agents can quickly spot a
compromised device, but it may be too late.
Data loss prevention can detect sensitive
data as it leaves the organisation, but only
after the initial compromise. There is clearly
a gap in advanced threat protection
capabilities between the email server and
the end user device. This gap is easy to see
when you understand the degree to which
enterprises rely on employees to identify
advanced threats in their mailboxes."
A better way is to simply add a layer of
automated detection and incident response
to the mailboxes, Fleck adds. "As enterprises
migrate their email servers to cloud
offerings like Office 365, it becomes easier
to close this gap by using APIs to connect
advanced threat protection clouds to
email mailbox clouds. This layer of
control complements the detection and
containment efforts already underway by
14
computing security October 2021 @CSMagAndAwards www.computingsecurity.co.uk