ISACA - end users wrongly fighting APTs with AV

More than one in five firms have been stung by APT attack, according to research from global body

End users are leaning too heavily on traditional security technologies such as firewalls and anti-virus software to stave off the growing threat posed by advance persistent threats (APTs).

That is the conclusion of IT association ISACA, whose research of 1,500 global IT security professionals suggested that more than one in five enterprises have been stung by an APT attack.

Known for their sophisticated, stealthy and unrelenting nature, APTs are often used by cybercriminals to steal intellectual property. Recent attacks such as Google Aurora and the RSA breach show the method poses a major threat to companies in all industries, not just government, ISACA said.

Some 60 per cent of those polled in Q4 by ISACA said they thought it would only be a matter of time before their firm was targeted. And some 94 per cent throught that APTs represent a credible threat to national security and economic stability.

But despite this, most enterprises are employing ineffective technologies to protect themselves against APTs, ISACA said.

Some 95 per cent are fending off the threat with antivirus and antimalware, with 93 per cent attempting to stop APTs using network perimeter technologies such as firewall. ISACA said this was "concerning" given that APTs are known to have evaded such controls.

In contrast, mobile security controls - which ISACA said can be quite effective, are used much less frequently.

"While these controls [AV and firewalls] are proficient for defending against traditional attacks, they are probably not as suited for preventing APTs," the report stated. "This is true for a number of reasons: APTs exploit zero-day threats, which are often unknown vulnerabilities, and many APTs enter the enterprise through well-designed spear phishing attacks.

"This indicates that additional controls - such as network segregation and perhaps an increased focus on email security and user education could be beneficial."
ISACA said the survey suggested there is still a gap in the understanding of what APTs are and how to defend against them.

Although 68 per cent of respondents said they are familiar with APTs, 53 per cent laboured under the misconception that APTs are similar to traditional threats.