In-depth

Why the FUD around APT does more harm than good

Davey Winder calls on the security industry to stop using scare tactics, and start using education, in the fight against APTs

OPINION: ISACA, which used to be known as the Information Systems Audit and Control Association, published a report last week that sheds some interesting light on another acronym which annoys the hell out of me. And that is APT, which stands for either Advanced Persistent Threat or Absurdly Pointless Terminology depending on whether you are selling something or not.

The term APT is often flagged by vendors as some kind of bogeyman problem to scare you into buying the solution. It reminds me, more often than not, of a salesmen shouting 'FIRE! FIRE!' through your letterbox before embarking on a sales pitch for fire extinguishers.

ISACA isn't selling anything in particular, so I read the report. What I discovered was that 1 in 5 enterprises had experienced an APT attack and two thirds are scared enough to think it's only a matter of time before they are attacked this way.

It reminds me, more often than not, of a salesmen shouting 'FIRE! FIRE!' through your letterbox before embarking on a sales pitch for fire extinguishers.

Unsurprisingly, only 15 per cent thought they were prepared to defend themselves against one.

I am not surprised by this lack of preparation, simply because the hype surrounding APT is so rife that confusion rules the roost.

That confusion results in 40 per cent of the enterprises questioned in that survey not using security training and controls to defend themselves against this kind of stealthy and ongoing threat, and 70 per cent not using mobile controls despite this being a preferred route to kick-start such attacks.

I'm not arguing that vendors, or anyone else for that matter, should stop spreading the word about any type of threat to enterprise data but I am dead set against FUD being used to sell stuff rather than a focus on education. So here's a thought, and one that will probably get me kicked off a few more vendor lunch invite lists (like I care.)

It's time to focus more on education and less on the hard sell. Concentrate on ensuring your customers understand the basics of data security, really understand I mean, and the FUD surrounding APTs will start to melt away.

So if users know how to spot and deal with phishing (even persistent phishing) via email, social media or text message, then many APT attacks will go nowhere, slowly.

Featured Resources

B2B under quarantine

Key B2C e-commerce features B2B need to adopt to survive

Download now

The top three IT pains of the new reality and how to solve them

Driving more resiliency with unified operations and service management

Download now

The five essentials from your endpoint security partner

Empower your MSP business to operate efficiently

Download now

How fashion retailers are redesigning their digital future

Fashion retail guide

Download now

Recommended

X-rated phishing attacks just keep growing
phishing

X-rated phishing attacks just keep growing

4 Jun 2021
Nigerian cyber criminals target Texas unemployment system
cyber security

Nigerian cyber criminals target Texas unemployment system

27 May 2021
Hackers use open source Microsoft dev platform to deliver trojans
Security

Hackers use open source Microsoft dev platform to deliver trojans

14 May 2021
eBay, Apple, Microsoft, Facebook, and Google were phishers’ top targets in 2020
phishing

eBay, Apple, Microsoft, Facebook, and Google were phishers’ top targets in 2020

20 Apr 2021

Most Popular

The benefits of workload optimisation
Sponsored

The benefits of workload optimisation

16 Jul 2021
RMIT to be first Australian university to implement AWS supercomputing facility
high-performance computing (HPC)

RMIT to be first Australian university to implement AWS supercomputing facility

28 Jul 2021
Samsung Galaxy S21 5G review: A rose-tinted experience
Mobile Phones

Samsung Galaxy S21 5G review: A rose-tinted experience

14 Jul 2021