The RSA 2011 advanced persistent threats summit and recommendations

¶ … Persistent Threats (APT) Summit occurred in July of 2011 over two days in Washington DC and was an attempt to bring together the top leaders from the government and from business to help target the influence that such threats pose. The summit also functioned as a means for drafting up ways to protect against the most detrimental APTs and to discuss defense mitigation (rsa.com). Advanced Persistent Threats are essentially "needles in a haystack" and they are small but significant threats that can too easily go undetected in the entire system. The summit did draft up some of the most multi-faceted recommendations. For instance, the summit leaders urged "chief executives in every industry sector not to delay devoting attention and funding to combat advanced threats and to 'plan and act as though you've already been breached.' Lawmakers urged to remove legal barriers that impede information sharing among global security ecosystem.Real-time intelligence sharing, early detection, end-user security training and testing and incident response named key elements to better defend against advanced threats and recover from inevitable cyber attacks" (emc.com, 2011). But the reality is that this summit found the need to compel the RSA to bring an enhanced level of furthered education via dialogue through cyber security, business leaders and government leaders throughout the world, through a range of intensive and advanced threat summits at regularly scheduled intervals throughout the year.

One finding that was highly significant as a finding during this summit was the fact that there was a pronounced transformation in vector shifting with a more pronounced target on people. For instance, it was found that the newest perimeter is that of the individual -- the human being (rsa.com). Another terribly relevant finding was that "Anyone can be phished given the right context -- and attackers have growing access to information about would-be targets through social networking sites that help them identify the right people to go after within the organization and also personalize their attacks" (rsa.com). Furthermore, an enhanced finding demonstrated how user training alone was not the fundamental means of neutralizing spear-phishing or other forms of targeting (rsa.com). This training needs to be paired up with user restrictions and combined visibility as a more successful means of control (rsa.com).

The vulnerabilities that existed within the system were that the system was too easily compromised. Once a hacker had gained even the most minimal access, he was able to engage the system in a range of full-scale attacks, getting to higher and higher levels of access.

Successful Attack Methods Carried Out

Regarding the authentication breach, the attack methods used in this case revolved around methods of hacking individual employees of the company, rather than the company infrastructure itself. For instance, "The first thing actors like those behind the APT do is seek publicly available information about specific employees -- social media sites are always a favorite. With that in hand they then send that user a Spear Phishing email. Often the email uses target-relevant content; for instance, if you're in the finance department, it may talk about some advice on regulatory controls" (rsa.com, 2011). In this particular case, phishing emails were sent to low profile employees who weren't terribly high value: the subject line of the email read "2011 recruitment plan" (rsa.com, 2011). The email was actually written well enough to trick one of the employees in retrieving it from their junk mail folder and opening up the attached excel file: "The spreadsheet contained a zero-day exploit that installs a backdoor through an Adobe Flash vulnerability (CVE-2011-0609). As a side note, by now Adobe has released a patch for the zero-day, so it can no longer be used to inject malware onto patched machines" (rsa.com, 2011). The attacker then set a form of remote administration in place which facilitated the attacker in controlling the machine, giving it access from a remote location (rsa.com, 2011). At this point digital shoulder surfing is established, getting clear on this particular employee's level of access: "One cannot stress enough the point about APTs being, first and foremost, a new attack doctrine built to circumvent the existing perimeter and endpoint defenses" (rsa.com, 2011). Thus, the attack methods centered around the following: phishing and zero day attack, a poision ivy tool to access the back door, the attacker elevates access to important user/admin accounts and particular systems, data is taken from private servers and is centered for exfiltration, data is then exfiltrated through encrypted files to another, often compromised machine at a hosting provider (rsa.com, 2011) .

Technologies to Alleviate the Problems

"A solution for APT that emphasizes detection -- and not prevention -- goes beyond scanning infection vectors, and instead focuses on whether unexpected or unauthorized communication is taking place using an organization's IP address or web interface domain within a botnet traffic" (Cohen-Abravanel, 2013). Thus, the best system determines if a malware infection exists in real time as it is observing real time communication, between an organization's machine and the adversarial machine (Cohen-Abravanel, 2013). The best APT systems use a form of technology which is 100% evidence-based and which do not bank on any false positives (Cohen-Abravanel, 2013). Only a legitimate infection which is initiated by malware communication is what raises any alarms (Cohen-Abravanel, 2013).

Another technology would prevent files from being so easily extracted. If there was another level of protection in place which required additional authorization or passwords in the process of extracting files would indeed be a sufficient level of protection against hackers, at least to some extent.