The study shows that 96 percent of respondents say they are at least somewhat familiar with APTs. While this is a positive finding, 53 percent of respondents say they do not believe APTs differ from traditional threats—indicating that many do not fully understand APTs.
“APTs are sophisticated, stealthy and unrelenting,” said Christos Dimitriadis, international VP of ISACA. “Traditional cyberthreats often move right on if they cannot penetrate their initial target, but an APT will continually attempt to penetrate the desired target until it meets its objective—and once it does, it can disguise itself and morph when needed, making it difficult to identify or stop.”
More than 60 percent of survey respondents say they are ready to respond to APT attacks. However, antivirus and antimalware (95 percent) and network perimeter technologies such as firewalls (93 percent) top the list of controls their enterprises are using to stop APTs—a concerning finding, given that APTs are known to avoid being caught by these types of controls.
The study shows that mobile security controls, which can be quite effective, are used much less frequently.
The study also found that:
- Loss of enterprise intellectual property was cited as the biggest risk of an APT (by more than a quarter of respondents), followed closely by loss of customer or employee personally identifiable information (PII).
- 90 percent of respondents believe that the use of social networking sites increases the likelihood of a successful APT.
- 87 percent believe “bring your own device” (BYOD), combined with rooting or jailbreaking the device, makes a successful APT attack more likely.
- More than 80 percent say their enterprises have not updated their vendor agreements to protect against APTs.