Controls to Address APTs

Controls to Address Advanced Persistent Threats & Information Warfare:

• Preventive Controls: These are the controls which prevent loss from occurring. For example, this control that applies separation of responsibilities like one employee can submit a payment request and second employee must authorize that request, it will minimizes the chances that employee can submit fraudulent payments.
• Detective Controls: These controls are especially for the monitoring activity to find out the cases where correct practices were not followed. For example, business might settle the general payment request audit logs to identify fraud payments logs
• Corrective Controls: Corrective controls are designed to restore the system back to the state prior to a destructive event. For example, business may apply full refurbishment of a system from backup tapes after evidence is found that someone has inappropriately altered the payment data.

Advanced persistent threats usually target victims at users’ ends using social engineering technique, attacks that are usually more effective because they are targeted with knowledge gathered from social networking sites.

It is possible that hackers will search for information readily available on the Internet to find individual victims and organizational roles to target. They do this in order to gain knowledge of organizational arrangement, internal working and eventually to target individuals they trust will potentially have access to or own the most sensitive data.

It is important that organizations behave like their opponent and understand that it is any loophole that can be used against their organizations and that a determined attacker will stop at not to find a technical vulnerability to exploit or determine where loopholes exist in your business ideas. It is critical that all organizations take the appropriate steps to deal with the social engineering aspects of users.

Following are a few more general best practices to adopt to control APT and information warfare attacks:

• Always use defense in depth concept for security, single technology will not prohibit advanced targeted attacks.
• Continuous integration and security intelligence between your security controls should be a stated security program objective.
• Setting awareness in security controls should be a important requirement while evaluating the security of protection platforms.
• Evaluation of all security technologies and existing controls if required, update or upgrade them and apply advanced features in the latest available products or services to continue with changes in the threat background.
• Review the policies applied but do it with the idea of joining the security processes between each technology so that actual management of threats is possible and decreasing of breach events is the more likely possible.
• Staff suitably to ensure that you can operate all the upcoming technologies and required to engage third parties to manage more service security checks while you focus on the strategic security processes and technologies.