I’ve been on about security threats being misunderstood and/or overblown. And companies that are just plain doing it wrong. But this one is a rare combination rant, about something that doesn’t exactly exist, and companies that are promoting this misconception. And now it’s becoming a de-facto default answer due to stupid trade rags that regurgitate this piece of marketing excrement. The recent RSA incident has finally sent me over the edge on this.
Advanced Persistent Threat (APT) is the pointless (and silly) term that’s been made up by smart industry professionals (shout out to Kevin Mandia) and grossly misused by marketing and executives.
Who uses this term? Usually, any dipshit who wants to come off “smarter than you are”. Like ‘this unfortunate incident was a result of Advanced Persistent Threat’. Or ‘Does your product defend against APT? Our product is the only one on the market with this capability’ (God help me if I ever read that anywhere).
What does APT really mean? Let’s break it down, Wikipedia style -
Advanced – It’s good.
Persistent – It’s not giving up.
Threat – It’s after you.
Wait… Did I miss something here? Isn’t this the threat that we, as the IT Security Community, really care about? All this time were we supposed to be on the lookout for the Advanced Slacker Threat? Or the Moronic Persistent Threat? The Moronic Slacker Threat?? They make stuff for all of that (anti-virus/spam, I[D|P]S, Firewalls, Web Filters, etc), and if you don’t have that stuff, you’re Not Doing It Right.
But wait… Don’t we, as IT Security Professionals already calculate Risk based on Threats and Vulnerabilities and hasn’t it been around, like, forever? Sure we do - Risk is a function of Threat and Vulnerability, or more commonly described as:
R = T * V
Well, whatever. That might be the idea, but typically we do a crappy job of defining threats. In (almost) all cases, it’s glossed over like “sure, threats exist, and they’re everywhere, both inside and outside your organization”. Then they go on to blather on about vulnerabilities (V) because that’s the cool stuff.
In the physical security industry, a threat is defined as:
T = P(Ta) + M(Tm)
(See below for a long dissertation about physical security, or just trust me… )
Which is the probability ranking of the Threat Agent acting against you P(Ta) plus the magnitude of harm the Threat Agent would have on your organization M(Tm). If we plug in the physical value for Threat into the tried and true risk equation (and expanding out) we get:
R = P(Ta)*V + M(Tm)*V
Then there’s vulnerability. Vulnerability is an inverse function of Effort to Remediate (Ee), expressable as V = 1 / Ee. Vulnerability approaches zero as exploitation effort approaches infinity. Hence, vulnerability is never zero.
So what does this show? First, it shows that as long as there is some kind asset loss that would result in harm to your organization, you will always have Risk – which we’ve always known. But more importantly, it shows that if you don’t have an asset that is both worthwhile for an attacker to obtain and which causes harm to your business, you don’t have any Risk. Here’s some practical scenarios (assuming that these descriptions are the extent of the incident for demonstration purposes):
Would you care about one workstation being compromised to join a spam-bot army? Just spam? No.
How about that same workstation with a keylogger that records passwords? Yep.
How about a whole bunch of those keyloggers on a bunch of systems? You bet.
How about a website compromised to spread malware to external visitors? Not so much.
SQL / Command injection attempts against front end inventory management systems? Hell yeah.
Clear text passwords in use to manage mailing list subscriptions? No.
Users evading web filters to surf porn? Nope (unless we’re the government, clergy, or known hostile workplace).
“Rogue” sniffers running the internal network? Big trouble.
Denial of service attacks against a public web presence? Meh.
Phishing? No.
Spear-phishing / Social Engineering? Oh, my, yes.
Are any of the above new scary attack vectors? No.
Have we been worried about these for years? Yes.
Are they considered parts of what the proverbial “APT” will attempt to get access. Yep.
So is it possible to defend against APT? We’ve been protecting against APT for years, just not calling it that. Duh - Winning!
——————————–
Physical Security Threat:
In the physical security realm, the term “adversary” is used. When performing what is referred to in the physical security industry as a “Threat Risk Assessment”, one of the core constructs is identifying the adversary and what they’re after - the ”Threat Agent”. Threat agents are sometimes generalized into categories, such as vandal, disgruntled worker, violent criminal, white-collar criminal, organized crime ring, corporate spy, activist, or terrorist. Each of these Threat Agents may have a different motivation. For example, a vandal is motivated to defame the target, whereas a violent criminal is motivated to exact physical harm to individuals. Likewise, a terrorist may be motivated to cause the most harm to an entity in any way possible, whereas a white-collar criminal is motivated to gather items of financial value.
But you’re not done yet – the meat of defining the threat is coupling the above with the magnitude of loss that could occur with a successful attack. The magnitude of loss is dependent on the motivation (target) of the Threat Agent. Typcially this is expressed as something like:
T = P(Ta) + M(Tm)
Where Threat (T) equals the probability ranking of the Threat Agent acting against you P(Ta) plus the magnitude of harm the Threat Agent would have on your organization M(Tm). Probability can be drawn from asset value – does your organization have something that the threat agent would like to have? A lot of it? If you’ve got a lot of it, you can safely assume a high probability. If you lost that something, how bad would it be to your organization? How about if you lost it several times (data is funny that way – reminds me of a joke about a prostitute, but I’ll save that for happy hour)? That’s how to figure Magnitude. This is a GREAT model to identify the threat, as it links the who, what, and why together.