strategically motivated advanced persistent threat definition process tactics and a disinformation model of counterattack

• DOI: 10.48550/arxiv.2103.15005
• Publication Date: 2019-09-01
• Authors: Atif Ahmad; Jeb Webb; Kevin C. Desouza; James Boorman
• Keywords: FOS: Computer and information sciences; Computer Science - Cryptography and Security; 0211 other engineering and technologies; 0202 electrical engineering, electronic engineering, information engineering; 02 engineering and technology; 16. Peace & justice; Cryptography and Security (cs.CR)

Advanced persistent threat (APT) is widely acknowledged to be the most sophisticated and potent class of security threat. APT refers to knowledgeable human attackers that are organized, highly sophisticated and motivated to achieve their objectives against a targeted organization(s) over a prolonged period. Strategically-motivated APTs or S-APTs are distinct in that they draw their objectives from the broader strategic agenda of third parties such as criminal syndicates, nation-states, and rival corporations. In this paper we review the use of the term - Advanced Persistent Threat - and present a formal definition. We then draw on military science, the science of organized conflict, for a theoretical basis to develop a rigorous and holistic model of the stages of an APT operation which we subsequently use to explain how S-APTs execute their strategically motivated operations using tactics, techniques and procedures. Finally, we present a general disinformation model, derived from situation awareness theory, and explain how disinformation can be used to attack the situation awareness and decision making of not only S-APT operators, but also the entities that back them.