A global cybersecurity
survey of more than 1,500 security professionals found that more
than one in five said their enterprise has experienced an advanced
persistent threat (APT) attack. According to the study by global IT
association ISACA, 94 percent say APTs represent a credible threat to
national security and economic stability, yet most enterprises are
employing ineffective technologies to protect themselves.
“We are only in February and already we can declare 2013 as the year of the hack”
APTs, an espionage tactic intended to steal intellectual property, have
made headlines in recent years for breaching major enterprise and
government networks worldwide. More than 60 percent of survey
respondents say that it’s only a matter of time before their enterprise
is targeted.
ISACA’s Advanced Persistent Threat Awareness: Study Results
shows that 96 percent of respondents say they are at least somewhat
familiar with APTs. While this is positive, 53 percent say they do not
believe APTs differ from traditional threats—indicating that many do not
fully understand them.
“APTs are sophisticated, stealthy and unrelenting,” said Christos
Dimitriadis, Ph.D., CISA, CISM, CRISC, international vice president of
ISACA and head of information security at INTRALOT GROUP. “Traditional
cyberthreats often move right on if they cannot penetrate their initial
target, but an APT will continually attempt to penetrate the desired
target until it meets its objective—and once it does, it can disguise
itself and morph when needed, making it difficult to identify or stop.”
More than 60 percent of survey respondents say they are ready to respond
to APT attacks. However, antivirus and antimalware (95 percent) and
network perimeter technologies such as firewalls (93 percent) top the
list of controls their enterprises are using to stop APTs—a concerning
finding, given that APTs are known to avoid being caught by these types
of controls. The study shows that mobile security controls, which are
more effective, are used much less frequently.
“APTs call for many defensive approaches, from awareness training and
amending third-party agreements to ensure vendors are well-protected, to
implementing technical controls,” said Jo Stewart-Rattray, CISA, CISM,
CGEIT, CRISC, FACS CP, director of ISACA and director of information
security and IT assurance at BRM Holdich.
The study also found that:
- 90 percent of respondents believe that the use of social networking sites increases the likelihood of a successful APT.
- 87 percent believe “bring your own device” (BYOD), combined with rooting or jailbreaking the device, makes a successful APT attack more likely.
- More than 80 percent say their enterprises have not updated their vendor agreements to protect against APTs.
“We are only in February and already we can declare 2013 as the year of
the hack,” said Tom Kellermann, CISM, trusted advisor to the US
government and vice president of cyber security for Trend Micro.
“ISACA's research reveals that enterprises are under attack and they
don’t even know it. Bringing this awareness into the curriculum of
education for security professionals is necessary to enable them to
build the custom defense they need to combat these targeted attacks.”
Descarga Reporte:
- Concienciación acerca de las amenazas persistentes avanzadas - Resultados del Estudio [ES]
- ISACA’s Advanced Persistent Threat Awareness: Study Results [EN]
No hay comentarios:
Publicar un comentario