Mandiant M-Trends on APT
If you want to read a concise yet informative and clue-backed report on advanced persistent threat, I recommend completing this form to receive the first Mandiant M-Trends report. Mandiant occupies a unique position with respect to this problem because they are one of only two security service companies with substantial counter-APT consulting experience.
You may read blog posts and commentary from other security service providers who either 1) suddenly claim counter-APT expertise or 2) deride "APT" as just a marketing term, or FUD, or some other term to hide their inexperience with this problem. The fact remains that, when organizations meet in closed forums to do real work on this problem, the names and faces are fairly constant. They don't include those trying to make an APT "splash" or those pretending APT is not a real problem.
Mandiant finishes its report with the following statement:
[T]his is a war of attrition against an enemy with extensive resources. It is a long fight, one that never ends. You will never declare victory.
I can already hear the skeptics saying "It never ends, so you can keep paying Mandiant consulting fees!" or "It never ends, so you can keep upgrading security products!" You're wrong, but nothing I say will convince some of you. The fact of the matter is that until the threat is addressed at the nation-state to nation-state level, victim organizations will continue to remain victims. This is not a problem that is going to be solved by victims better defending themselves. The cost is simply too great to take a vulnerability-centric approach. We need a threat-centric approach, where those with the authority to apply pressure on the threat are allowed to do so, using a variety of instruments of national power. This is the unfortunate reality of the conflict in which we are now engaged.
Comments
I've made this comment before but I will repeat it. I know of no organization taking a "vulnerability-centric" approach. None. And your nation-state comments are meaningless for organizations that has presences in every country in the world. When my points of presence is in China and I'm being attacked by someone in China - the US can do very little. But you are ex-military so I am not surprised by the limited point of view.
However, I wanted to post in response to Yoshi. You do realize Bejtlich is a Director at ~GE~. And just because you assets distributed worldwide doesn't mean you are helpless. There are network designs, service models, segmentation, etc. that can be done. I think it's rather naive to dismiss this guy's viewpoint due to being ex-military when he is current ultra-corporate.
Right now, APT is just *not* applicable. It's not applicable to Level 3 and 4 merchants (at least). It's not applicable to healthcare (outside of the MIC). It's just not.
Now sure, Mandiant's marketing is just that, marketing, and we expect an amount of stupidity from *any* marketing organization. But theirs is based on exaggerating the applicability of the APT.
I'm with you, Rich - we used to just call the APT "nation-state threats" when we did work for the DOE & f500 energy concerns. I believe you that there is a real threat here. It's just not, to quote Mandiant's marketing "spy vs. everyone".
Further, unless the Taliban is attacking U.S. networks in conjunction with their kinetic attacks in Afghanistan, no one that I know of is engaged in "defensive cyber warfare" in the United States. And since when is espionage considered warfare? Did they change the LOAC when I wasn't looking?
Exactly.
maybe not
come back in 10 years jeff, then ill listen
Good post. I agree with you here, and have a few brief comments.
I can already hear the skeptics saying...
First, I've found, it's easy to be a skeptic when you're incapable of observing the problem in the first place, or cannot frame the problem correctly. The latter is something we've both been trying to address for some time now in the public domain. Gaining problem appreciation through observation is a little more difficult on account of the operational security imperatives that impede complete exposure of this activity. Google did us a favor here, IMO.
Second, regarding threat versus vulnerability centric defense, I would say that nearly every organization takes a vulnerability-, or at best attack-centric approach. The classic IR model that nearly everyone uses, for instance, is attack-centric and does nothing to assist net defenders in leveraging threat intelligence for improving CND. It's merely an assessment activity after a compromise occurs. That's only a small part of the puzzle.
Finally (this comment is getting long - sorry), I think some of the commenters may be disagreeing simply because of variable definitions of 'war'. I will admit I hate using the term 'cyberwar' to describe this activity because it flirts with hyperbole, but contemporary scholars on the subject such as Greg Rattray in his seminal work Strategic Warfare in Cyberspace clearly place the topics we speak of here in the realm of 'war.' Whether or not matters of espionage are technically a 'war' is really an academic discussion; we shouldn't let it distract us from dealing with what the consensus of victims truly believes is a serious problem.
Who is the other one? Just wondering.
I don't believe its necessary to refer to acts of cyber espionage as "war" in order to treat it as a serious problem.
I didn't have any intention of suggesting that. In fact, that's why I made the following comment:
we shouldn't let it distract us from dealing with what the consensus of victims truly believes is a serious problem.
I think we're in agreement on those points.
I will add, though, that I feel the Mandiant report is important in the scheme of what we are trying to accomplish. There are plenty of decision-makers in affected industries who still do not appreciate the threat as it relates to CNE. Data and case studies are important in making the case.
CNA, OTOH, has much more traction due to its innate excitement, but the importance of the difference in strategic objectives achieved by each is often lost. If we aren't careful to articulate both, separately, they will be observed as the same and our collective management of the problem will be ineffective. For an example, consider any media report or opinion about stolen data that talks about "Cyber 9/11" in the same context.
I won't belabor the point here because I already wrote two posts about it at my blog.
You said this in your post:
Mandiant occupies a unique position with respect to this problem because they are one of only two security service companies with substantial counter-APT consulting experience.
If you can disclose this information: Who is the security service company?
"no one that I know of is engaged in "defensive cyber warfare" in the United States."
Exactly.
------
Richard, brilliantly articulated explanation of the problem with Jeff's research. Unfortunately for Jeff size of ego has no direct correlation with amount of experience.