What Is Advanced Threat Protection? (ATP)

A threat can earn this label for a few different reasons. For instance, a threat may be advanced if:

• Its perpetrators have unlimited resources or tools to carry out an attack and maintain access to a network
• Attackers have ready access to funding to adapt an attack as needed
• An attack has been crafted to target a specific organization

Let’s put a little more context around advanced threats in their various forms.

Advanced Persistent Threats

An advanced persistent threat (APT—not to be confused with ATP) is an attack in which an attacker stealthily gains access to an organization’s network and establishes a foothold, allowing them to remain there undetected for an extended period. APTs often target a specific company and tend to use advanced malware that can bypass or dodge common security measures. They are sophisticated attacks that need to be met with equally sophisticated defense.

Once an attacker gains access to a target network, usually through credential phishing attacks or malware, they may be able to access anything from company data to private conversations and other sensitive material. If they stay undetected for long enough—weeks, months, or perhaps even years—they can gather huge amounts of data to use for malicious purposes.

What Are the Most Common Advanced Attack Methods?

Advanced attacks share a few core techniques that most frequently get bad actors where they want to go. The most prevalent of these are:

• Phishing lures a user into following a link from a seemingly trusted source to gain access to company credentials or information. This is the most common method for APT attackers to gain access to an internal network.
• Installing malware helps cyberattackers burrow deeper into a network once they’ve gained access, enabling them to monitor activity and collect company data. This is most often done through phishing.
• Password cracking allows attackers to gain administrative access and have free rein within a network.
• Creating a backdoor ensures a way back into the network if an attacker needs to leave.