APT – Advanced Persistent Threat is the latest buzz word in the industry. Everyone who is in the Security Industry, professionals and business alike want to get into the bandwagon that is called APT. Security product vendors are all gearing to cater to “APT” and all their current product lines or future releases address APT in some form of the other. Now, the fever has spread to the IT Management as well and now they want their Security teams to detect and prevent APT. Even though the InfoSec public has caught up with it, how much thought have we put into understanding the magnitude of the problem at hand? Is it enough to just jump on to something without understanding it fully or do we need a more educated and intelligent decision making?

Let us find out more in this post!!!!

As always, I would like to define APT to start with. This is key because once the definitions are clear, all we would need is to align our thinking to that definition. Then, I will list down what flaws we have in our current approach towards security. Finally, I will try to list down as many possible solutions to the problem at hand.

Defining APT:
Simply put, APT is a Security Threat to the Enterprise (even End User for that matter) that is Advanced in execution that traditional security filters are not able to catch outright and is persistent enough that it keeps moving from one compromised target to another evading detection. 

Is it a technology of the future? – No, it is not. APT is nothing but a threat we are not trained to see. One of the main reasons why APT has been so successful in many organizations is the fact that we have an outdated security strategy. For example, we are keen on tracking a Data Exfiltration from a compromised machine. How do we do it today?

• To start of with, we look for Data Loss Prevention Solutions and see which vendor is the market leader
• Then we implement DLP solutions with basic policies for generic data loss (PDF, WORD DOC, XLS, Source Codes, Credit Card Numbers, PAN, PII etc)
• We fine tune the DLP policies for our enterprise specifically and implement detection and prevention capabilities
• We log the data from DLP solutions to SIEM and alert when something of interest happens.
• In addition or In replacement, IDS/IPS rules will be implemented to identify data loss traffic based on REGEX file names etc.
• In some cases we would also look at Traffic going to Blacklisted Domains and IP.

Let us now take the same example of Data Exfiltration and see how Behavior profiling would help:

1. We would have complete details about where sensitive data is residing, the VLAN, the Server, the Folder, The file, The DB tables etc.
2. To the Sensitive Machine/Network/Data, We would know who has access to and Who does not?
3. We would also track who has a copy of that data – what is the machine, where is it residing (desktop, laptop, mobile) etc.
4. The data usage by which team, which individuals etc are also profiled and that would give us the subset of people handling that sensitive data
5. Any theft of that data would be through one of the above actors/entities.
6. Tracking each of their machines activity over time would give us a Normal behavior profile.
7. Digital Markers on such sensitive data can also be placed by the corporations to track data use/flow
8. We can also track periodicity of data access, time of access, track the data changes etc through Digital Markers
9. Any deviations from Normal behavior is a potential Data Exfiltration action and needs to be investigated
10. Behavior profiles thus created can be used in addition to Signature based detection

This requires intimate co-ordination with various teams and also requires great understanding of what your Network does, what it is supposed to do. This while being the most logical is the most challenging to implement and thus the most rewarding as well. Behavior profiling is being used in the Intelligence Community for a long time, but the Technology community is still to embrace this. Enterprise data is becoming critical and with threats like APT, our fundamentals are being questioned.

This approach can help after the fact but from preventing the occurrence a Long term solution is needed. From a long term perspective the only solution is building Networks and Applications (OS as well as Apps) from ground up to treat security as a embedded character and not an add on feature.

What are your thoughts on APT? How do you think we should change our Security thought process, technology and all to combat it? Sound on below!!!