Strategically-Motivated Advanced Persistent Threat: Definition, Process, Tactics and a Disinformation Model of Counterattack

TL;DR

This paper provides a formal definition of advanced persistent threats, models their operational stages based on military science, and introduces a disinformation strategy to counteract their situational awareness and decision-making capabilities.

Contribution

It offers a rigorous, holistic model of S-APT operations and a novel disinformation framework to enhance counterattack strategies against these threats.

Findings

Developed a formal definition of APT and S-APT.

Created a comprehensive model of APT operational stages.

Proposed a disinformation approach to impair S-APT decision-making.

Abstract

Advanced persistent threat (APT) is widely acknowledged to be the most sophisticated and potent class of security threat. APT refers to knowledgeable human attackers that are organized, highly sophisticated and motivated to achieve their objectives against a targeted organization(s) over a prolonged period. Strategically-motivated APTs or S-APTs are distinct in that they draw their objectives from the broader strategic agenda of third parties such as criminal syndicates, nation-states, and rival corporations. In this paper we review the use of the term - Advanced Persistent Threat - and present a formal definition. We then draw on military science, the science of organized conflict, for a theoretical basis to develop a rigorous and holistic model of the stages of an APT operation which we subsequently use to explain how S-APTs execute their strategically motivated operations using tactics, techniques and procedures. Finally, we present a general disinformation model, derived from situation awareness theory, and explain how disinformation can be used to attack the situation awareness and decision making of not only S-APT operators, but also the entities that back them.