APTs: New term, old problem

Share this article:
Will Irace
Will Irace
Scuba divers are fond of saying that to survive a shark encounter you must only swim faster than your buddy. It is conventional wisdom in the security world too: If I have bars on my windows and you don't, I'll feel safer. But consider the elite security practitioners among us. Who has the talent, resources and motivation to protect their infrastructure, employees and customers? Are RSA and Google on your list of exceptional swimmers? They're on mine, yet both have been reverberating in the news under breathless headlines proclaiming a new era of advanced persistent threats (APTs). If their defenses weren't adequate, what hope is there for the rest of us?

The truth is: We don't know.

But we know (or should know) what we have that is of value. In a broad sense, we also know what kinds of harm can come to those valuables (see “confidentiality, integrity, availability, breach thereof”). We also know that we're immersed in a threat/countermeasure arms race that started decades ago when we learned that some people who use computers – shocker, I know – cannot be trusted. While it is true that more and more sophisticated techniques increasingly target applications, content and consumers of content (namely, human beings), we're well advised to come up for air just long enough to remember that attackers will use the simplest approach available to get the job done.

So let's pause for a reality check. Do we have a clear sense of what we need to protect and where it is? Do our employees know what is expected of them? Do they have our trust and confidence? Are we focused on protecting things of value from risk or harm, or are we bogged down on regulatory compliance issues?

There may come a time when the fastest swimmers are the ones with no secrets to protect at all. Until then, let's forgo the APT hysteria long enough to make sure we're doing a good job on the fundamentals.

Share this article:
You must be a registered member of SC Magazine to post a comment.

Sign up to our newsletters

TOP COMMENTS

More in Opinions

Heartbleed, Shellshock and POODLE: The sky is not falling

Heartbleed, Shellshock and POODLE: The sky is not ...

While it may seem like 2014 is the year of the vulnerability, in reality, this year has not been much different than years past.

Technology alone isn't going to secure IoT connected devices

Technology alone isn't going to secure IoT connected ...

It's clear that vulnerabilities continue to exist, despite our best efforts to combat them. In fact, we have addressed many of the same problems before.

DDoS is the new spam...and it's everyone's problem now

DDoS is the new spam...and it's everyone's problem ...

As new solutions emerge, it's critical for organizations to protect themselves by being informed, aware, and acting whenever possible. Those that don't take action are playing a very dangerous game.