Advanced Persistent Threats

Advanced Persistent Threats are becoming an increasingly prevalent threat to organisations and the information they hold. Advanced Persistent Threats are a type of attack that are defined by the National Institute of Standards and Technology (2011) as being a highly sophisticated attack, well-orchestrated, well-funded and are targeted at specific organisations or people. These type of attacks seek to gain a foothold inside an organisation, remain undetected and over a specific time frame from Advanced Persistent Threats
hours to months laterally move across the network and exfiltrate data, the specific information assets they desire undetected, often more than once. This is as opposed to the more conventional opportunist attacker who isn’t interested in any particular target or any specific data. If the attacker doesn’t succeed the first time they will simply move onto the next weakest victim, these types of attack have often in the passed been used only to heighten the profile of a hacker. Attack vectors include Spear fishing attempts with either email content or attachments carrying the payload through to malware and more commonly malvertising.

Evidence of high profile targeted Advanced Persistent Threats are being reported in the press more than ever. Some examples of such being Target’s 2013 breach, Sony 2014 breach and more recently Ashley Madison 2015 this list goes on. Upholding the confidentiality, availability and integrity of information that these sites and companies hold is possible through the use of good IT Governance. With an effective and current Information Security Management System in place and utilizing good strong controls organisations can better protect themselves from Advanced Persistent Threats.

Ensuring user awareness training is provided. Ensuring the desktop is appropriately secured. Keeping software up to date. Ensuring strong Authentication mechanisms are in place. Ensuring Antivirus, Firewalls and Host Intrusion Detection/Prevention systems are appropriately configured and kept up to date are all only some of the controls that should be in place as a standard to help mitigate the risk.

All too often perimeter defenses are in place and appropriately secured from the outside, however from inside out, the desktop and the actual user are all attack vectors that are left open to threats.  The threat landscape is constantly evolving, we need to stay on top in order to try and evade APTs.

Blocking Advertisements and Malvertising

This is an interesting topic, blocking advertisements for me is a must. I not only feel much safer, I know I am safer browsing pages on the net with an Ad Blocker, I personally use Ad Block Plus for Firefox. There has been lots of press regarding malvertising of late, Huffington Post and FHM being victim. IT governance are seen to be quoting RiskIQ figures from this years Blackhat conference of malvertising being up 80% from last year. The Malvertising that we are seeing across the net coming from bad ad companies are particularly dangerous not requiring interaction from users, simply visiting the site being enough to become infected with malware. IT Security folk often have very clean surfing habits, however average users that aren’t as aware browsing the net will be susceptible to downloading malware without them even knowing. The malvertising needs a vessel in order to carry itself over to the victims computer in order for it to be exploited, that usually being a vulnerability in flash or Java. Keep it up to date – better still if you can live without it, do so, or block it with a add-on like ‘no script‘ for Firefox.

I do however sympathise with sites that rely on advertising to stay on the net, I realise I’m not supporting my favorite sites by blocking their ads as they are not receiving revenue from the ad companies however I’m not willing to compromise my own security either.

One interesting idea being the Google Contributor Service where people pay to not see advertising on sites that use google ads, instead they see a banner thanking them for contributing. One idea that will remain in play is paying our favorite sites  for their content on a subscription basis.  It will be interesting to see how this problem unfolds itself, one thing is for sure the problem is increasing and as malvertising increases, so will the use of Ad blockers which will only concatenate the problem of content providers not getting paid!

What are your thoughts…