Aim higher, reach further.

Watching and Waiting

Most cyberattacks are random. But some attackers know exactly whom they want, and how to strike.

It is called an advanced persistent threat, and if it sounds like something out of a Tom Clancy novel, that's because it pretty much is.

More in Leadership in IT

CIO Journal


APTs are the cutting edge of cyberattacks, and even the most hardened security pros say they are almost impossible to prevent.

"There isn't a corporation in the nation today that can't be penetrated, not one," says Mike McConnell, who was the U.S. Director of National Intelligence until 2009 and is now vice chairman at consulting firm Booz Allen Hamilton.

Whereas many cyberattacks pick victims at random—anyone who downloads a piece of malicious software or opens an attachment will do—the instigators of APTs carefully choose their targets and wait patiently for just the right moment to strike.

When they do, it is often with new code that is unlikely to be detected by security programs. And once the perpetrators gain access to a company's systems, they are likely to stay there, siphoning out important documents and information.


Fortunately, only a small portion of cyberattacks are APTs.

"Last year there were 300 million [cyberattacks]," says Francis deSouza, group president of enterprise at security company Symantec Corp. SYMC -0.18 % "Only a subset were advanced and targeted and persistent."

The companies that are targeted by APTs tend to have, or have access to, sensitive information—defense contractors and financial firms are good examples.

APTs often are launched by groups associated with foreign governments. Whereas most cyberattacks aim to steal financial data, APTs typically target intellectual property.

Security experts say companies can't stop every APT. The bad guys are that good. But there are ways to minimize the threat.

Know Yourself

"Think about what your company does and what might be attractive to an attacker," says Dave Martin, chief security officer at storage-technology maker EMC Corp. EMC -0.28 %

In some cases the answer is obvious—a company that designs fighter jets would likely want to safeguard those blueprints.

But more often, companies are in the middle of a supply chain and may be targeted because something they have could be used to exploit others.

For example, a hacker used an APT last year to steal security credentials maintained by the RSA security division of EMC, the company disclosed. EMC wasn't the final target in the attack; instead the criminal used the stolen credentials to gain access to the systems at other companies.

Mr. Martin says companies should ask themselves questions such as: What information do I have? Which of my business partners allow my employees to access their systems? How would a breach impact my supply chain?

"It could just be a bolt that's instrumental in a motor," he says.

Treat It Differently

It isn't practical to provide absolute security for everything. It is a lot easier when the focus is narrow.

Because APTs target high-value information, security experts suggest taking greater steps to protect it, much like a bank keeps the really valuable stuff locked in a vault.

Because APTs tend to target people, it also makes sense to treat workers who have access to sensitive information differently.

This is a fundamental shift from the way businesses traditionally have approached security.

It used to be that businesses relied on creating a secure perimeter to keep out the bad guys, but allowed legitimate traffic to move unencumbered on a corporate network. Most security tools are still designed with this model in mind.

In the age of APTs, however, the industry is "moving away from protecting the infrastructure and to protecting information assets," says Mr. deSouza of Symantec.

Embrace Social

One of the characteristics of an APT is that the perpetrators take their time, researching how best to attack a company.

Often, security experts say, the attacker will try to glean clues from social-networking sites like LinkedIn and Facebook. There, the criminal can identify an employee in, say, human resources or marketing.

The criminal can troll sites like Facebook to learn the names of the employee's friends and that person's interests. The hacker can even visit Twitter to get a sense of how someone writes.

Mr. deSouza says he saw one attack where a hacker learned that a systems administrator had five children. The hacker crafted an email with a malicious file attachment that appeared to come from the company's human-resources department and contain information about a new benefit program for families with four or more kids.

Whereas some companies block social-media sites from the workplace, Hart Rossman, vice president and chief technology officer for cyber programs at defense contractor SAIC Inc., says security teams should embrace them. The hackers are looking at them, so "we have to look at that data," too, he says.

Although the technology isn't there yet, Mr. Rossman would like to be able to provide employees with information that might make them think twice before opening email attachments, such as a warning that the person claiming to be a friend of a friend isn't connected to the email recipient on any social networks, or hasn't ever responded quickly to a message.

The idea is an acknowledgment that companies won't block every malicious email. "You can't rely on five guys to protect the enterprise," Mr. Rossman says.

Mine for Signs

The instigators of APTs are stealthy, but they do leave tracks.

The problem is that most companies can't find them.

Advances in data-mining programs that collect and analyze vast amounts of information can make it easier to spot things that might indicate an attack. The hard part is knowing what to look for in the company's logs.

"We have a year's worth of data," says EMC's Mr. Martin. "In a large enterprise everything looks like an anomaly. Just looking for anomalies isn't going to work."

Some security experts suggest looking at network-traffic logs that show what websites computers in the company tried to reach and the numerical addresses of the sites that those computers ended up connecting with.

Attackers sometimes cover their tracks by disguising the addresses to which they send stolen information. If the logs show that a website name and the numerical address don't match, that can be a sign of an APT, the experts say.

EMC also studies the behavior of people who have been targeted by hackers, Mr. Martin says. "We're interested in finding what kind of behaviors are more vulnerable," he says. "Maybe everyone does 100 things the same every day, but these four people who were compromised also did this other one thing."

Be Reasonable

Knowing how much to spend on security and how many people to dedicate to the task can be challenging. Here's a tip from the experts: While it is hard to detect an APT, it is comparatively easy to find out how and when an attack occurred after it has been identified. Mr. Rossman suggests keeping track of how long it takes to detect an APT after it is launched. If the time is getting shorter, it is a good sign that a security program is working.

Mr. Worthen is a staff reporter in The Wall Street Journal's San Francisco bureau. He can be reached at

Show More Archives

Popular on WSJ

Editors’ Picks