Analysis Of Advanced Persistent Threats

The supply chain management is considered as a management concept from past two decades as the customers are concerned about timely and safe delivery. The competitiveness has been increasing among the companies to deliver the products as quickly as possible to the customers all around the world. This has made the supply chain management as a vital tool for the management. This is also measured as a competitive parameter for the companies.

A single insider could steal secrets from critical infrastructures or leave them vulnerable to a future hack, which could have residual effects for years, such as the company Target and its reputation after the company was hacked. Further, insiders like Edward Snowden have set back American national security for years to come, by exposing secret security practices to the world. The government proposed in S.3414, to conduct background checks, focus on employee training, and assure that the necessary management are enlisted. These steps might stop the insider threat, but are measures to help reduce the threat. The benefits would also lead to better productivity and ensure the right employees are emplace to meet the industry standards and comply with policy. A new proposed bill should incorporate this feature within the government and be an option within privately owned critical infrastructures with incentives if guidance is

8. Which domain requires annual security awareness training and employee background checks for sensitive positions to help mitigate risk from employee sabotage? The user domain. Employees should at least be aware of social engineered attacks and potential risk that they, the employee could do.

As such, our company’s people resources pose the greatest risk for security breach. Our way to help mitigate risk in this area is to keep communication lines open in this area and to continually mandate security knowledge training, with mandatory updates on a regular basis. When the employees are informed of company policy when facing a security matter, they are better equipped to act in the best or right way. In this way knowledge is power – or at least empowerment to act in the best interest of the company’s information security.

Although competitive bidding will continue to be used, especially in the public sector, to ascertain market prices for non-strategic items, many of these items will be outsourced to third-party buyers or consortia to conduct the bidding. Moreover, organizations will continue to purchase most non-strategic products and services under master contracts, some of which will be negotiated by consortia that have leveraged and buying expertise. A trend is expanding for the continued use of third-party purchasing by primarily private sector firms pursuing all forms of competitive advantage possibilities.

An APT or Advanced persistent threat is a group of people who are highly motivated (financially, politically or economically) working together, well skilled, and patient. They have advanced technical tool which is not available to other attackers. They use vulnerabilities revealed by the APT or APT sponsor that is not disclosed to anyone else hence it's very difficult to defend them. They're chronic and consciousness on exploiting one or more unique objectives instead of just any target of opportunity. APT use social engineering as a tool to get more details of those specific targets. APTs are either funded by Governments or adversaries as they need a lot of resources to go after any target. APTs are well organized as they could move after the easy objectives and avoid the comfortable networks. It goes after particular goals primarily based on what it desires to take advantage of from the ones targets. An APT might be willing to make investments months or years of time toward infiltrating and Compromising a desired goal. APTs might be military units, different government-sponsored entities, or beneath the control of nongovernmental actors, including organizations, activist agencies, or organized crime. Few examples in which

Social engineering are all those activities that are done by a hacker to manipulate that human tendency to trust so as to gain unauthorized access to the valued information that are in the computer system. The IT specialist agrees that despite the secure networks and firewall being used, the security of the IT is based on the trust in the protection and

As mentioned previously, we believe that the APT involved in our attack is in the weaponized phase of an attack. In this phase, the APT will used the information he or she obtained from the reconnaissance phase to develop a weapon (i.e. malware with an additional payload) specifically designed to target our weaknesses. The common method for delivery is email; however, it could be a fake website that users are redirected to. For example, users access their social media accounts, such as Facebook, Twitter, or even the previously mentioned LinkenIn) and they open a private message with an attachment or link to the fake website where the user inadvertently launches the cleverly designed attack. In creating the weaponized attack, APTs have access

Over the last few years the amount of security breaches that have been reported have had one factor that has been prevalent in majority of the attacks. That factor is the employee’s and how they are manipulated into giving the intruder/hacker exactly what they needed without realizing it. The use of social engineering in data breaches and fraud has been steadily increasing over the years. Confidentiality, integrity, and availability the three components of the CIA triad in network security can all be compromised by the risk of social engineering.

4. Security Awareness: A large percentage of successful attacks do not necessarily exploit technical vulnerabilities. Instead they rely on social engineering and people’s willingness to trust others. There are two extremes: either employees in an organization totally mistrust each other to such an extent that the sharing of data or information is nil; or, at the other end of the scale, you have total trust between all employees. In organizations neither approach is desirable. There has to be an element of trust throughout an organization but checks and balances are just as

Which domain requires annual security awareness training and employee background checks for sensitive positions to help mitigate risk from employee sabotage?

Ping sweeps and port scans are two techniques that a malicious computer user such as a hacker can utilize to compromise an Enterprise networks security and gain access to their proprietary data. For example, private email messages can be forwarded to a rogue destination email address: Done by installing a virus program into a user’s email client through a discovered active computers open TCP/IP IMAP port (port number 143) that is not being currently used by that user (Clarke, 2008). The virus then could take advantage of security vulnerabilities in that users email client program and forward emails from that users inbox over to another destination email address without them knowing about

Most companies lack the ability to quickly contact each outsourced supplier, vendor or licencee in their supply chain. Many companies have done alot of work in the area of managing global supply chains better. A web based Supplier Ethical Management (SEM) platform has been developed which allows companies to maintain contact information for most or all of its suppliers and communicate critical information to them on a regular basis. Using an SEM platform is probably

Users: This can include social engineering threats, misconfiguration of equipment, and inside threats where employees steal or leak information intentionally.

The Supply Chain required the cooperation of all the company 's internal departments with external parties, for example, the supplier to get a product that meets market needs in a timely manner. And that there is integration of all parties in terms of the information involved at the right time to get the right product for the right quantities in the right place at the right time for the client to meet the requirement of the