(April 3, 2023) In a previous post, we discussed how organizations could improve protection against advanced persistent threats by understanding the cyber kill chain. The better you understand the cyber kill chain, the better prepared you’ll be to evaluate your cybersecurity posture and defenses. The better your defenses, the earlier in the chain you’ll be able to identify threats and disrupt the attack. The earlier in the chain a threat is addressed, the less impact it will have. The components of advanced persistent threat protection revolve around a layered security approach.
This all sounds very logical, but the idea isn’t to oversimplify advanced threat protection. A carefully planned, layered approach to security allows you to identify a threat even if it slips through initial lines of defense.
Traditional signature-based tools still play an important role in security, but they no longer offer adequate protection. Signature-based tools can only see known threats based on unique identifiers or signatures, that can take weeks to create and distribute. The reality of the modern threat landscape is that new attacks are launched every single day. One cybersecurity report found that 95 percent of analyzed malware files were less than a day old.
Feeling the HEAT
Take, for example, a new breed of attack called highly evasive adaptive threats (HEAT). Malicious actors are very familiar with the types of security tools that most organizations have in place. They use various techniques to evade those tools, thus maximizing their chance of success. HEAT attacks are also “adaptive” in that they evolve over time to address changes in security technologies in order to maintain their evasiveness.
HEAT attacks are designed to gain initial access to a system or network. In some cases, the attackers monetize this access by selling it to other malicious actors. As a result, a single HEAT attack can result in multiple malware attacks. HEAT attacks are also used to deploy an APT that does the actual damage. HEAT should not be viewed as distinct and separate from APTs because attackers often use them hand in hand.
These blended threats are best addressed by a layered security approach that combines multiple defenses to protect systems and data. If an attack can get past one security control, there are other tools in place that can help to identify and block the threat, thus disrupting the cyber kill chain.
Elements of a Layered Approach
Behavioral analysis is an essential component of a layered security strategy. Behavior analysis can dynamically assess the risk of a threat based on its capabilities, activity, or even potential activity and intent. This makes it possible to identify and mitigate unknown threats without the need for a signature. Organizations use behavioral analysis to guard against HEAT attacks and new types of malware and to identify a unique instance of malware that targets a specific organization, system, or user. Behavioral analysis can also determine what malware is capable of doing when activated in an environment, and acquire important data about the threat.
When threats are detected, they can automatically be moved to a secure, isolated test environment, or sandbox, where they can be executed and analyzed on a much deeper level without risk to your network. This process is called sandboxing. Sandboxing is critical to detecting APTs and zero-day threats that pass through traditional email filters and other tools.
Mainstream specializes in the development and implementation of advanced threat protection strategies that overcome the shortcomings of legacy tools. We work with organizations to develop and implement layered cybersecurity solutions that reduce the risks posed by HEAT and APTs. Contact us today for additional information.
ABOUT MAINSTREAM TECHNOLOGIES
Mainstream Technologies delivers a full range of technology services in Arkansas and the surrounding region including managed technology services and consulting, custom software development, and cybersecurity services. We also offer industry-leading data center services in our Little Rock facilities. Established in 1996, Mainstream has earned a reputation for delivering quality, reliable, and professional technology services for public and private-sector customers across the United States.
Jeff Pracht
IT Business Development Manager
(479) 715-8629 Office
(501) 529-0008 Mobile
