Advanced persistent threats are a new way of life
Connecting state and local government leaders
The recent discovery of an advanced persistent threat inside RSA proves what the company had been saying for weeks: This new breed of threat against high-value targets is probably inevitable.
There's plenty of irony in the recent announcement by RSA, EMC's security division, that information about its SecurID two-factor authentication product apparently has been stolen through a sophisticated advanced persistent threat.
Last month’s announcement merely illustrates what the company has been saying for some time: Such threats probably are inevitable for high-value targets, and traditional defenses don't provide adequate protection.
It is commendable that RSA has publicly announced the incident to customers and investors despite the potential for embarrassment. That openness, if continued, could help provide valuable intelligence about such threats and help in the development of effective defenses against them. In fact, RSA advocated such openness in a recent white paper.
Related stories:
Hackers gain access to RSA's SecurID security tokens
New cyber threats emerging, and IPv6 won't make defense any easier
An advanced persistent threat, usually referred to as an APT, is a descriptive rather than technical term that describes a broad class of attacks. RSA Chief Technology Officer Bret Hartman enumerated APTs' distinguishing characteristics during the RSA Security Conference in February.
- “It’s low and slow,” intended to infiltrate quietly and insert itself in various places in a system so it's difficult to remove if detected.
- It is targeted, going after high-value assets, such as intellectual property, that can provide a return on the expense of sophisticated, possibly one-of-a-kind attacks.
- A human is behind it, motivated and with the resources to persist with multiple attacks against a target.
As with most security threats, it is unlikely that we will be able to completely win the battle against APTs, but defenses can be improved. Toward that end, RSA and VMware released in February a security brief on improving security operations to tackle these threats.
The paper outlines core elements for defending against APTs:
- Risk planning to better understand potential information targets.
- Attack modeling to better understand potential attacks.
- Virtualized environments to better segregate information and systems.
- Predictive analysis to integrate compliance monitoring with risk management.
- Automated, risk-based decision systems to quickly assess and respond to threats.
- Forensic analysis and information sharing to help defend against future attacks.
“As appropriate, we will share our experiences from these attacks with our customers, partners and the rest of the security vendor ecosystem and work in concert with these organizations to develop means to better protect us all from these growing and ever more sophisticated forms of cybersecurity threat,” he wrote in an open letter.
Inevitably, there will be some proprietary information involved in RSA’s investigation, and not every detail will be revealed. But RSA has an opportunity to practice what it has preached by releasing as much information as possible about the breach.