ISACA cyber security survey reveals that one in five enterprises has experienced an APT attack

A global cyber security survey of more than 1 500 security professionals found that more than one in five said their enterprises have experienced an advanced persistent threat (APT) attack. According to the study by global IT association ISACA, 94% say APTs represent a credible threat to national security and economic stability, yet most enterprises are employing ineffective technologies to protect themselves.

APTs, an espionage tactic intended to steal intellectual property, have made headlines in recent years for breaching major enterprise and government networks worldwide. More than 60% of survey respondents say it's only a matter of time before their enterprises are targeted.

ISACA's Advanced Persistent Threat Awareness: Study Results show that 96% of respondents say they are at least somewhat familiar with APTs. While this is positive, 53% say they do not believe APTs differ from traditional threats - indicating that many do not fully understand them.

"APTs are sophisticated, stealthy and unrelenting," said Christos Dimitriadis, Ph.D., CISA, CISM, CRISC, international vice-president of ISACA and head of information security at Intralot Group. "Traditional cyber threats often move right on if they cannot penetrate their initial target, but an APT will continually attempt to penetrate the desired target until it meets its objective - and once it does, it can disguise itself and morph when needed, making it difficult to identify or stop."

More than 60% of survey respondents say they are ready to respond to APT attacks. However, anti-virus and anti-malware (95%) and network perimeter technologies such as firewalls (93%) top the list of controls their enterprises are using to stop APTs - a concerning finding, given that APTs are known to avoid being caught by these types of controls. The study shows that mobile security controls, which are more effective, are used much less frequently.

"APTs call for many defensive approaches, from awareness training and amending third-party agreements to ensure vendors are well-protected, to implementing technical controls," said Jo Stewart-Rattray, CISA, CISM, CGEIT, CRISC, FACS CP, director of ISACA and director of information security and IT assurance at BRM Holdich.

The study also found that:

* 90% of respondents believe the use of social networking sites increases the likelihood of a successful APT.

* 87% believe "bring your own device" (BYOD), combined with rooting or jail-breaking the device, makes a successful APT attack more likely.

* More than 80% say their enterprises have not updated their vendor agreements to protect against APTs.

"We are only in February and already we can declare 2013 as the year of the hack," said Tom Kellermann, CISM, trusted advisor to the US government and vice-president of cyber security for Trend Micro. "ISACA's research reveals that enterprises are under attack and they don't even know it. Bringing this awareness into the curriculum of education for security professionals is necessary to enable them to build the custom defence they need to combat these targeted attacks."

The ISACA study, sponsored by Trend Micro, is available as a free download at www.isaca.org/cybersecurity.