More companies now have to worry about "advanced persistent threat"
"The phrase 'advanced persistent threat' is something you're going to be hearing a lot more of the next two years," said Martin Roesch, founder of Sourcefire Inc.
That's one bit of perspective Roesch has to offer on last week's news of Google (and 30+ other companies) getting hacked by someone from inside China, by perhaps the Chinese government itself.
Roesch's company, based in Columbia, Md., crafts intrusion detection and prevention defenses for major government and military agencies and, increasingly, major companies.
Roesch says that government military networks have been accustomed to seeing the kind of sophisticated cyber attacks that Google Inc. experienced last week.
But the attack on Google may have been a watershed moment for corporations.
"This is the first time that nation-state-grade tactics were used against a commercial target," Roesch said. "They were trying to hide. They were taking the time to cover the tracks."
Hence the hacking term "advanced persistent threat," or APT. HackingUniverse.com defines APT as: ...cyber attacks mounted by organizational teams that have deep resources, advanced penetration skills, specific target profiles and are remarkably persisent in their efforts. They tend to use sophisticated custom malware that can circumvent most defenses, stealthy tactics and demonstrate good situational awareness by evaluating defenders responses and escalating their attack techniques accordingly.
Indeed, what may be remarkable in Google's case is not the hacking itself, but the fact that Google was able to sniff it out.
What the attack on Google means is that more companies in different industries will need to pay more attention to APT, from defense contractors to banks to health care systems, Roesch told me.
"I think you are seeing a new level of attacking taking place here," Roesch said. "I think this [attack on Google and others] does change the game and the scope of the problem. You have to consider a whole new security posture."
This is an archived version of the technology blog. For updated coverage, see the current baltTech location: baltimoresun.com/balttech
Categories: Big Ideas, Government Tech, Web Dev & Apps








Comments
I think this is a little off "This is the first time that nation-state-grade tactics were used against a commercial target,".
This is the first time it's been discovered and made public. Espionage is nothing new, the attack vector has changed, but the threat has always been there.
I would bet that we see more discoveries of APT infiltration now that it's getting attention and people are looking for it.
Posted by: Jason Lewis | January 21, 2010 9:11 AM