As organizations grapple with the explosion of new and novel threats, they are often constrained by both time and resources to address them. With the cybersecurity skills gap expected to reach 1.8 million by 2022, according to The Wall Street Journal, teams are often left with a need to prioritize their workloads based on what will maximize the return on their efforts.

While, for most, this means addressing commodity malware and deploying antivirus solutions for signature-based threats, large organizations are particularly susceptible to the most dangerous attack out there: the unknown unknown, which, in cybersecurity, manifests as an advanced threat.

What Is an Advanced Persistent Threat (APT)?

Advanced threats are what keep chief information security officers (CISOs) up at night. They are the most difficult to detect and defend, but pose the greatest risk to the organization. These attacks are typically perpetrated by highly capable, well-equipped threat actors — commonly nation states or state-sponsored groups — via specific, targeted actions.

Threat intelligence researchers and intelligence agencies are constantly inventing entertaining monikers for these groups, such as Office Monkeys and Stone Panda, but their work is far more notable than their identities. While these hacking collectives are largely nameless and faceless, you’ve likely seen their work in the form of high-profile data breaches. In each of these instances, the attackers used evasive tactics, which made it significantly more difficult to see where the attacks originated and how they traversed the network.

How Do Companies Defend Against Advanced Persistent Threats?

With essentially unlimited resources at their disposal, advanced threat actors present an interesting challenge for security teams who don’t enjoy that same luxury. With the cost of a data breach reaching $3.9 million and average advanced persistent threat (APT) dwell times exceeding 80 days, the pressure has never been higher for security operations center (SOC) teams to act quickly and decisively in detection and response. And while not all threats are created equal, the same applies to cyberdefenses.

With so many questions about how to best defend against advanced threats, IBM Security partnered with the SANS Institute to better understand how organizations are addressing them. In a survey of more than 360 security practitioners from various industries and company sizes, SANS explored what threats organizations have seen in their environments, common detection blind spots and how security teams respond.

Let’s take a closer look at some of the major takeaways from the SANS survey.

What You Don’t Know Can Hurt You

One of the key tenants of advanced threat defense is organizationwide visibility. Visibility is what gives SOC teams home-field advantage over threat actors, because analysts are intimately familiar with the organization’s infrastructure and normal operating state. A lack of environmental visibility often contributes to blind spots in detection and makes it difficult to respond with incomplete or missing information. More than 48 percent of respondents said that a lack of insight into where data is being processed is the top visibility gap in advanced threat detection.

This issue is compounded further by the adoption of cloud services and the rise of the hybrid cloud. Cloud infrastructure can introduce a host of threat vectors that may not be present in on-premises environments, such as cross-cloud and cross-tenant attacks. Almost 77 percent of respondents are entirely in the cloud or have a hybrid strategy, which illustrates just how important it is for the modern SOC to monitor and analyze this attack surface.

Organizations still struggle with detecting shadow IT, particularly in the cloud, because unapproved software-as-a-service (SaaS) app use by line of business users puts corporate information at risk. Visibility into this activity is particularly important for insider threat detection; organizations need to see if users are exfiltrating data to personal cloud storage services, such as Google Drive or Dropbox.

While cloud isn’t more or less secure than deployment on-premises, 55 percent of respondents said they had blind spots in cloud environments where their current security analytics solution cannot integrate. Security teams should look for solutions that integrate across infrastructure-as-a-service (IaaS), platform-as-a-service (PaaS) and SaaS solutions to enable visibility into cloud activity and risk to correlate data against existing, noncloud log sources.

Anomalous User Activity Could Indicate an Advanced Attack

Another key takeaway from the report is the lack of insight into user activity. Credentials compromise, often by phishing, is one of the most common vectors for advanced threats. When attackers steal credentials from a privileged user, they often exploit them to launch additional attacks from within and then abuse the victim’s level of access to spread their foothold to other systems. Advanced attackers often move quickly to steal and abuse legitimate account credentials, and the higher the privilege of these accounts, the more targeted they are. Some of the largest and most notable breaches in recent memory have been caused by credentials compromise, including Target and Starwood.

In the survey, respondents cited credentials hijacking (52 percent) and privileged user abuse (49 percent) as the most common threats in their environment, yet only 40 percent of organizations track user behavior anomalies as a metric for their SOC team. There is a detection gap in organizations’ ability to monitor exactly what is baselined as normal in their environment to detect anomalies, with more than 47 percent struggling to do so. Organizations should look to employ solutions that baseline normal user access and detect when a user deviates from this behavior.

To learn more, register to download the full report, “SANS Institute: Effectively Addressing Advanced Threats.”

More from Intelligence & Analytics

BlackCat (ALPHV) Ransomware Levels Up for Stealth, Speed and Exfiltration

9 min read - This blog was made possible through contributions from Kat Metrick, Kevin Henson, Agnes Ramos-Beauchamp, Thanassis Diogos, Diego Matos Martins and Joseph Spero. BlackCat ransomware, which was among the top ransomware families observed by IBM Security X-Force in 2022, according to the 2023 X-Force Threat Intelligence Index, continues to wreak havoc across organizations globally this year. BlackCat (a.k.a. ALPHV) ransomware affiliates' more recent attacks include targeting organizations in the healthcare, government, education, manufacturing and hospitality sectors. Reportedly, several of these incidents resulted…

9 min read

Despite Tech Layoffs, Cybersecurity Positions are Hiring

4 min read - It’s easy to read today’s headlines and think that now isn’t the best time to look for a job in the tech industry. However, that’s not necessarily true. When you read deeper into the stories and numbers, cybersecurity positions are still very much in demand. Cybersecurity professionals are landing jobs every day, and IT professionals from other roles may be able to transfer their skills into cybersecurity relatively easily. As cybersecurity continues to remain a top business priority, organizations will…

4 min read

79% of Cyber Pros Make Decisions Without Threat Intelligence

4 min read - In a recent report, 79% of security pros say they make decisions without adversary insights “at least the majority of the time.” Why aren’t companies effectively leveraging threat intelligence? And does the C-Suite know this is going on? It’s not unusual for attackers to stay concealed within an organization’s computer systems for extended periods of time. And if their methods and behavioral patterns are unfamiliar, they can cause significant harm before the security team even realizes a breach has occurred.…

4 min read

Why People Skills Matter as Much as Industry Experience

4 min read - As the project manager at a large tech company, I always went to Jim when I needed help. While others on my team had more technical expertise, Jim was easy to work with. He explained technical concepts in a way anyone could understand and patiently answered my seemingly endless questions. We spent many hours collaborating and brainstorming ideas about product features as well as new processes for the team. But Jim was especially valuable when I needed help with other…

4 min read