In March 2011, approximately a month after hosting the world’s largest cybersecurity conference, RSA (the security division of EMC) announced that it had been the victim of a successful APT attack. Although many experts would not place this attack in the same category as some of the more sophisticated intelligence-gathering attacks that have been mounted on governments and Fortune 500 companies, this was clearly a professional, targeted attack by a major APT actor.
The attack itself was relatively simple, but effective: It was initiated by a phishing email exploiting an Adobe flash vulnerability embedded in an attached spreadsheet. The intrusion resulted in the theft of confidential information, including data relating to RSA’s best-selling SecurID authentication technology. The attack used a piece of malware named PoisonIvy, which at the time was a widely available remote access Trojan that had been used to steal information from companies in the chemical and motor sectors as well as from human rights organizations.
The Most Famous Advanced Persistent Threats in History
The Most Famous Advanced Persistent Threats in History
Many of today’s most destructive advanced persistent threats (APTs) were conceived a decade ago, so enterprises that rely on most traditional approaches to cybersecurity are unlikely to succeed against the next generation of attacks. This is one of the cautions in a new book published by global IT association ISACA in cybersecurity awareness month.
Advanced Persistent Threats: How to Manage the Risk to Your Business advises that traditional defenses such as firewalls and anti-malware are not up to the challenge of today’s APTs and that organizations need to add skills, processes and technology to their cybersecurity arsenal.
While new tools are needed to combat ever changing security threats, it is helpful to examine the history of the APT, because it is possible to derive many important lessons for defending against them in the future. The earliest use of the term “advanced persistent threat” emerged from the U.S. government sector in 2005, describing a new, deceptive form of attack that targeted selected employees and tricked them into downloading a file or accessing a website infected with Trojan horse software. This slideshow summarizes known facts, anecdotal evidence and reported claims behind some of the most well known attacks experienced over the last 15 years.
