Cyber security survey reveals one in five had an APT attack

The study, undertaken by the global IT compliance association ISACA, also suggests that 94% of respondents believe that APTs represent a credible threat to economic stability – yet most enterprises are employing ineffective technologies to protect themselves. APTs, an espionage tactic often intended to steal intellectual property, have made headlines in recent years for breaching major enterprise and government networks worldwide. Attacks such as the Google Aurora threat and the RSA breach made it clear that they pose a major threat to organisations in all industries. More than 60% of survey respondents say that it's only a matter of time before their enterprise is targeted. "APTs are sophisticated, stealthy and unrelenting," comments Christos Dimitriadis, international vice president of ISACA and head of information security at INTRALOT. "Traditional cyber threats often move right on if they cannot penetrate their initial target, but an APT will continually attempt to penetrate the desired target until it meets its objective. And once it does, it can disguise itself and morph when needed, making it difficult to identify or stop." More than 60% of the survey respondents say they are ready to respond to APT attacks. However, antivirus and antimalware and network perimeter technologies such as firewalls top the list of controls their enterprises are using to stop APTs. That, points out Dimitriadis, is concerning, given that APTs are known to avoid being caught by these types of controls. The study shows that mobile security controls, which can be quite effective, are used much less frequently. "APTs call for many defensive approaches, from awareness training and amending third-party agreements to ensure vendors are well-protected, to implementing technical controls," comments Jo Stewart-Rattray, director of ISACA and director of information security and IT assurance at BRM Holdich.