A review of more than 1,500 security professionals has found that more than one in five enterprises has experienced an APT attack at some point – but more than 60% of respondents said they feel it’s “only a matter of time” before their enterprise is targeted.
The study, carried out by ISACA and Trend Micro, also found that 94% characterize APTs as representing a credible threat to national security and economic stability.
APTs, an espionage tactic often intended to steal intellectual property, have made headlines in recent years for their success in relying on savvy, ongoing techniques to breach major enterprise and government networks worldwide. "Attacks such as the Google Aurora threat and the RSA breach make it clear that they pose a major threat to organizations in all industries, not just government," ISACA noted.
“APTs are sophisticated, stealthy and unrelenting,” said Christos Dimitriadis, international vice president of ISACA and head of information security at INTRALOT Group. “Traditional cyberthreats often move right on if they cannot penetrate their initial target, but an APT will continually attempt to penetrate the desired target until it meets its objective – and once it does, it can disguise itself and morph when needed, making it difficult to identify or stop.”
More than 60% of survey respondents say they are ready to respond to APT attacks. However, anti-virus and anti-malware (95%) and network perimeter technologies such as firewalls (93%) top the list of controls that their enterprises are using to stop APTs – a concerning finding, ISACA said, given that APTs are known to avoid being caught by these types of controls. Further, more than 80% say their enterprises have not updated their vendor agreements to protect against APTs. In short, security is not keeping up with the level of the threat, a reality that IT departments seem increasingly aware of, but are doing little to remediate.
“APTs call for many defensive approaches, from awareness training and amending third-party agreements to ensure vendors are well-protected, to implementing technical controls,” said Jo Stewart-Rattray, director of ISACA and director of information security and IT assurance at BRM Holdich.
The study also shows that 87% believe bring your own device (BYOD), combined with rooting or jailbreaking the device, makes a successful APT attack more likely; but mobile security controls, which can be quite effective, are used much less frequently.
Loss of enterprise intellectual property was cited as the biggest risk of an APT (by more than a quarter of respondents), followed closely by loss of customer or employee personally identifiable information (PII). About 90% of respondents believe that the use of social networking sites increases the likelihood of a successful APT.
Nonetheless, APTs are continuing to be successful. “We are only in February and already we can declare 2013 as the year of the hack,” said Tom Kellermann, CISM, trusted advisor to the US government and vice president of cybersecurity for Trend Micro. “ISACA's research reveals that enterprises are under attack and they don’t even know it. Bringing this awareness into the curriculum of education for security professionals is necessary to enable them to build the custom defense they need to combat these targeted attacks.”