Thursday, December 15, 2011

Advanced Persistent Threats - Thank You Wikipedia

My head is near exploding, as I'm sure yours is, from all the APT news.  It's everywhere, I swear I saw it on the cover of the Weekly World News.

What annoys me is that the first several times I heard about an APT, "they" were basically describing any other virus or malware.  The only difference was that the writers did a better job hiding their command and control, and they used more, and varying, ways to hide from AV and stay resident.  This is a lame term as there is no line where quality achieves the level of Advanced!!

After hearing about the nature of the RSA breach, I have decided to only give credence to those who refer to an APT as an actor.  APTs are not code.  An APT is someone, some organization, or a nation state who is well funded, highly sophisticated, and persistent in their goal to compromise something.

I went to Wikipedia to see what the masses were saying, assuming the worst.  Wikipedia agrees with me?  I may  have to turn in my security spurs.  :-P

Proper use, "I am an advanced persistent threat".

Improper user, "I created an advanced persistent threat".

You can kill or jail an advanced persistent threat, but you can't delete it.