Are advanced persistent threats here to stay?

The recent discovery of an advanced persistent threat inside RSA proves what the company had been saying for weeks: This new breed of threat against high-value targets is probably inevitable.

April 1, 2011

Because they often exploit carefully husbanded zero-day vulnerabilities, “there is some percentage that is always going to get through,” Hartman said. “While it may be impractical, even impossible, to prevent APTs, organizations nevertheless can deflect such attacks by making themselves difficult, unprofitable targets, or by discovering APTs early to prevent large-scale damage,” the paper states. “This involves developing intelligent, comprehensive approaches to help organizations become faster and more efficient at detecting APTs, neutralizing them and identifying perpetrators.” RSA has started using at least one of those elements — information sharing — with the announcement of the breach, and RSA Executive Chairman Art Coviello promised to continue the process.

There's plenty of irony in the recent announcement by RSA, EMC's security division, that information about its SecurID two-factor authentication product apparently has been stolen through a sophisticated advanced persistent threat.

Last month’s announcement merely illustrates what the company has been saying for some time: Such threats probably are inevitable for high-value targets, and traditional defenses don't provide adequate protection.

It is commendable that RSA has publicly announced the incident to customers and investors despite the potential for embarrassment. That openness, if continued, could help provide valuable intelligence about such threats and help in the development of effective defenses against them. In fact, RSA advocated such openness in a recent white paper.

An advanced persistent threat, usually referred to as an APT, is a descriptive rather than technical term that describes a broad class of attacks. RSA Chief Technology Officer Bret Hartman enumerated APTs' distinguishing characteristics during the RSA Security Conference in February.

“It’s low and slow,” intended to infiltrate quietly and insert itself in various places in a system so it's difficult to remove if detected.
It is targeted, going after high-value assets, such as intellectual property, that can provide a return on the expense of sophisticated, possibly one-of-a-kind attacks.
A human is behind it, motivated and with the resources to persist with multiple attacks against a target.

As with most security threats, it is unlikely that we will be able to completely win the battle against APTs, but defenses can be improved. Toward that end, RSA and VMware released in February a security brief on improving security operations to tackle these threats.

The paper outlines core elements for defending against APTs:

Risk planning to better understand potential information targets.
Attack modeling to better understand potential attacks.
Virtualized environments to better segregate information and systems.
Predictive analysis to integrate compliance monitoring with risk management.
Automated, risk-based decision systems to quickly assess and respond to threats.
Forensic analysis and information sharing to help defend against future attacks.

“As appropriate, we will share our experiences from these attacks with our customers, partners and the rest of the security vendor ecosystem and work in concert with these organizations to develop means to better protect us all from these growing and ever more sophisticated forms of cybersecurity threat,” he wrote in an open letter.

Inevitably, there will be some proprietary information involved in RSA’s investigation, and not every detail will be revealed. But RSA has an opportunity to practice what it has preached by releasing as much information as possible about the breach.

NEXT STORY: Shifting cyber landscape presents risks, offers opportunities