Modelling Technical Countermeasures of Advanced Persistent Threats

Abstract

An advanced persistent threat (APT) is a highly targeted and sophisticated attack directed at the internetworked computer user at the workplace. They typically employ zero-day malware, stealth, and multiple advanced techniques to gain entry and maintain presence undetected inside the network. As a result, preventing their ingress at the network perimeter and detection once infiltration occurs, continues to be a challenge. In this respect, the major objective of this research is to propose a classification schema for the APT technical countermeasures. We interviewed senior managers working in government and private organizations in the United Arab Emirates over a period of four years (2014 to 2017) to gain their perspective of the threat and elicit technical countermeasures. We anticipate the proposed methods and practices can assist organizations, not only in the UAE but also in the wider global context, to implement an appropriate mix of countermeasures for APT threats from a multi-dimensional perspective.