Advanced Persistent Threat (APT) Gain Access 1-10-60 Challenge( Advanced Persistent Threat (APT), Gain Access, 1-10-60 Challenge ) attack uses continuous, clandestine, and sophisticated hacking techniques to gain access to a system and remain inside for a proloned period of time, with potentially destructive consequences.

Stage 1: Gain Access Look, Learn, and Remain( Gain Access, Look, Learn, and Remain )
Like a burglar forcing open a door with a crowbar, cybercriminals usually gain entry through a network front door( network, front door ), an infected file router( file, router ), junk email, or an app vulnerability hardening( vulnerability, hardening ) to insert malware firewall( malware, firewall ) into a target network.

Functional Testing Performance/Load Testing Penetration Testing( Functional Testing, Performance/Load Testing, Penetration Testing ): Test cases performed to confirm the system operates as it was designed/specified and meets all functional requirements – Availability Confidentiality( Availability, Confidentiality ) and Integrity Confidentiality( Integrity, Confidentiality )

Performance/Load Testing Penetration Testing Functional Testing( Performance/Load Testing, Penetration Testing, Functional Testing ): Test cases performed to confirm the system operates as it was designed/specified and meets performance requirements under a real or simulated load - Availability Confidentiality( Availability, Confidentiality )

Penetration Testing Performance/Load Testing Functional Testing( Penetration Testing, Performance/Load Testing, Functional Testing ): Test cases performed to simulate intrusion by an intentional or unintentional cyber threat actor – Confidentiality and Availability (perhaps some Integrity)

Preparation Panic Trainning( Preparation, Panic, Trainning ): Without good preparation, any subsequent incident response is going to be disorganized and has the potential to make the incident worse.

Detection Preparation Analysis( Detection, Preparation, Analysis ): Process where the organization first becomes aware of a set of events that possibly indicates malicious activity. Depending on the size, an org may receive >100 million events per day.

Detection sources can include:
Activity logs Retrospective( Activity logs, Retrospective ): A security analyst may receive an alert that a specific administrator account was in use during the time where the administrator was on vacation.
External sources Internal users( External sources, Internal users ): An ISP or law enforcement agency may detect malicious activity originating in an organization's network and contact them and advise them of the situation.
Internal users External sources( Internal users, External sources ): An employee contacting the help desk and informing agent that services are no longer available, or files are suddenly encrypted

CSIRT senior analyst(s) Incident response coordinator Security operations center analyst CSIRT analyst(s):( CSIRT senior analyst(s), Incident response coordinator, Security operations center analyst, CSIRT analyst(s): ): Personnel with extensive minimal( extensive, minimal ) training and experience in incident response, digital forensics, network data examination

CSIRT analyst(s) Security operations center analyst Legal( CSIRT analyst(s), Security operations center analyst, Legal ): Personnel with CSIRT responsibilities that have less extensive( less, extensive ) exposure or experience in incident response activities

Security operations center analyst CSIRT analyst(s) Chief Information Security Officer (CISO( Security operations center analyst, CSIRT analyst(s), Chief Information Security Officer (CISO ): Analysts assigned to the 24/7 Security Operations Center (SOC) monitoring reporting( monitoring, reporting ) capability; serve as the point person when it comes to incident detection isolation( detection, isolation ) and alerting.

Organizational support personnel Tech support personnel IT security engineer(s) / analyst(s)( Organizational support personnel, Tech support personnel, IT security engineer(s) / analyst(s) ): Assist with a variety of non-technical technical( non-technical, technical ) issues that fall outside those that are addressed by the CSIRT core and technical support personnel.

Stage 2: Establish Foothold Gain Access Move Laterally Look, Learn, and Remain Deepen Access( Establish Foothold, Gain Access, Move Laterally, Look, Learn, and Remain, Deepen Access )
Cybercriminals implant malware anti virus( malware, anti virus ) that allows the creation of a network of backdoors hardening( backdoors, hardening ) and tunnels used to move around in systems undetected detected( undetected, detected ).
The malware often employs techniques like rewriting code to help hackers cover expose( cover, expose ) their tracks.

Stage 3: Deepen Access Move Laterally Gain Access Look, Learn, and Remain Establish Foothold( Deepen Access, Move Laterally, Gain Access, Look, Learn, and Remain, Establish Foothold )
Once inside, hackers use techniques such as password cracking to gain access to administrator user( administrator, user ) rights so they can control more of the system and get even greater lesser( greater, lesser ) levels of access.

Stage 4: Move Laterally Deepen Access Establish Foothold Gain Access Look, Learn, and Remain( Move Laterally, Deepen Access, Establish Foothold, Gain Access, Look, Learn, and Remain )
Deeper inside the system with administrator user( administrator, user ) rights, hackers can move around at will. They can also attempt to access other servers and other secure parts of the network.

Stage 5: Look, Learn, and Remain Move Laterally Gain Access Deepen Access Establish Foothold( Look, Learn, and Remain, Move Laterally, Gain Access, Deepen Access, Establish Foothold )
From inside system, hackers understand how it works and its vulnerabilities
Harvest the information they want at will.
Hackers keep this process running indefinitely or withdraw once they accomplish a specific goal.
They often leave a back door open to access the system again in the future.