10. Cybersecurity Incident Response Against Advanced Persistent Threats (APTs)

Recent technological innovations and new age computing models in IT infrastructure have provided faster bandwidth speeds, cloud computing, mobile computing and virtualization have virtually melted the boundaries between traditional on premise and internet based enterprise security perimeter. This has created a data-rich digital era, which is in fact an excellent opportunity for hackers and threat vectors leading to cybercrime. In fact, cybercrime has been progressing at the highest pace in last few years. Advanced Persistent Threat or APT is a highly sophisticated threat. Initially, such attacks focused and targeted government, state, or financial institutions only. However, recent breach reports and studies have started to indicate the trend of APT involving wider domains. This chapter takes a critical look at the impact and incidents due to advanced persistent threats and the advanced evasion techniques for packing, encryption, and behavior obfuscation during APT attacks to hide their malicious behavior and evade detection.