Advanced Persistent Threat (APT)

The word APT originated first when Google became victim of a targeted attack originating from China along with 30 other technology firms, defense contractors and large enterprises which were penetrated by hackers with the use of an array of social engineering, targeted malware and monitoring technologies to quietly access reams of sensitive corporate data.
Advanced Persistent Threat has been defined by security professionals actively countering APT as an adversary such that ADVANCED means adversary being able to operate in full spectrum of computer intrusion, like using publicly available exploit against well known vulnerability or ca n also elevate their game to research new vulnerabilities and develop custom exploits depending on target’s condition.
PERSISTENT means the adversary is formally tasked to accomplish a mission though they are not simply opportunistic intruders, but work as an intelligent unit, receiving directives and working to satisfy their masters. It does not mean that they are continuously executing malicious code on victim computers. They maintain their level of interaction needed to execute their goals.
THREAT means that the adversary is not only a piece of mindless code but an organized, funded and motivated threat.
In brief, APT is an adversary who conducts offensive digital operations also known as computer network operations or computer network exploitation for supporting different state-related objectives.
APT are just 4 years old and its target can be divided into four phases: -
1. Late 1990s –military victim,
2. 2000-2004 non-military government victims,
3. 2005-2009 defense industrial base and
4. 2009-present – intellectual property rich targets and software companies.
COUNTERING APT: -
The most effective counter-APT weapon is a trained and knowledgeable information security analyst though many vendors have marketed adopting APT and even registered APT themed domain names, but the best way would be to provide knowledge to business leaders about the threat so that they support organizational security programs suggested by competent and informed staff.
Counter APT awareness should be developed and local Federal Bureau of Investigation office should be contacted and threat briefing can be requested to promote managerial attention.
From the technical view, Visibility should be built which will provide situational awareness with a chance to discover and hopefully frustrating APT activities.
The goal of counter-APT operations should be to make it as difficult as possible for the adversary to steal intellectual property, “increasing the cost per megabyte,” .

REFERENCE:
- RICHARD BEJTLICH – director of incident response for General Electric.