ISACA cyber security survey reveals that one in five enterprises have experienced an APT attack
14 February 2013—A global cyber-security survey
of more than 1,500 security professionals found that more than one in five respondents said their enterprise has
experienced an advanced persistent threat (APT) attack. According to the study by global IT association ISACA, 94
percent say APTs represent a credible threat to national security and economic stability, yet most enterprises are
employing ineffective technologies to protect themselves.
APTs, an espionage tactic often intended to steal intellectual property, have made headlines in recent years for
breaching major enterprise and government networks worldwide. Attacks such as the Google Aurora threat and the RSA
breach make it clear that they pose a major threat to organisations in all industries, not just government. More than 60
percent of survey respondents say that it’s only a matter of time before their enterprise is targeted.
ISACA’s survey, Advanced Persistent Threat Awareness: Study Results, shows that 96 percent of respondents say they are at least somewhat familiar with APTs. While this is a positive
finding, 53 percent of respondents say they do not believe APTs differ from traditional threats—indicating that many do
not fully understand APTs.
“APTs are sophisticated, stealthy and unrelenting,” said Christos Dimitriadis, Ph.D., CISA, CISM, CRISC, international
vice president of ISACA and head of information security at INTRALOT GROUP. “Traditional cyberthreats often move right
on if they cannot penetrate their initial target, but an APT will continually attempt to penetrate the desired target
until it meets its objective—and once it does, it can disguise itself and morph when needed, making it difficult to
identify or stop.”
More than 60 percent of survey respondents say they are ready to respond to APT attacks. However, antivirus and
antimalware (95 percent) and network perimeter technologies such as firewalls (93 percent) top the list of controls
their enterprises are using to stop APTs—a concerning finding, given that APTs are known to avoid being caught by these
types of controls. The study shows that mobile security controls, which can be quite effective, are used much less
“APTs call for many defensive approaches, from awareness training and amending third-party agreements to ensure vendors
are well-protected, to implementing technical controls,” said Jo Stewart-Rattray, CISA, CISM, CGEIT, CRISC, FACS CP,
director of ISACA and director of information security and IT assurance at BRM Holdich.
The study also found that:
• Loss of enterprise intellectual property was cited as the biggest risk of an APT (by more than a quarter of
respondents), followed closely by loss of customer or employee personally identifiable information (PII).
• 90 percent of respondents believe that the use of social networking sites increases the likelihood of a successful
• 87 percent believe “bring your own device” (BYOD), combined with rooting or jailbreaking the device, makes a
successful APT attack more likely.
• More than 80 percent say their enterprises have not updated their vendor agreements to protect against APTs.
“We are only in February and already we can declare 2013 as the year of the hack,” said Tom Kellermann, CISM, trusted
advisor to the US government and vice president of cyber security for Trend Micro. “ISACA's research reveals that
enterprises are under attack and they don’t even know it. Bringing this awareness into the curriculum of education for
security professionals is necessary to enable them to build the custom defence they need to combat these targeted
The ISACA study, sponsored by Trend Micro, examined awareness of APTs, direct experience with APTs, security controls
and processes in place, and APT impact on policies and practices. Full results are available as a free download at www.isaca.org/cybersecurity