Learning points from Advanced Persistent Threats

I’ve been very busy this year as you might gather from my rather thin postings. It’s a positive sign in fact as it reflects the mushrooming demands of a growing industry which has a long way further to grow.      

One thing that is currently occupying my attention is the subject of APTs, which I’m currently researching for a new publication. It’s an interesting and fast moving topic. Ten years ago nobody was interested in this level of threat. I was even accused of being a ‘doomsayer’ by ZDNet for warning about such risks. But what strikes me about APTs today is that nearly all of the published information about them is either factual analysis about how they work, or promotional claims about new technologies to make them go away.

What’s lacking are the learning points from actual attacks. It’s understandable given that most companies prefer to keep quiet about attacks. Yet this is the information we need. If we’d been warned earlier about the full facts of these attacks we might have done things differently.  

We need to know things such as: What should we do differently? How can we discover an attack? What measures should be implemented to minimise future risks?  This information is still hard to come by. Implementing ISO standards does not solve the problem. Committees, responsibilities and policies certainly don’t deliver enough.

Going beyond today’s best practices should be the focus of security researchers today. Too many are still trying to invent new ways of outdated controls to unsympathetic executive boards. I have occasional debates with Fred Piper on the subject of whether today’s practices are better than nothing. I claim they’re not because they’re an expensive distraction. He says they still serve some use. But we both agree they’re not good enough.

So I invite anybody who has a great new idea on how to reduce the risk of APTs to contribute it to my current research. You’ll get full credit. We need your innovation. At the same time, I must encourage anyone who has experienced an APT attack to share their views on what they would do differently in the future. We need your experience.