Document Type
Conference Proceeding
Publication Date
Spring 3-17-2022
Abstract
Advanced Persistent Threats (APTs) are state-sponsored actors who break into computer networks for political or industrial espionage. Because of the nature of cyberspace and ever-changing sophisticated attack techniques, it is challenging to prevent and detect APT attacks. 2020 United States Federal Government data breach once again showed how difficult to protect networks from targeted attacks. Among many other solutions and techniques, zero trust is a promising security architecture that might effectively prevent the intrusion attempts of APT actors. In the zero trust model, no process insider or outside the network is trusted by default. Zero trust is also called perimeterless security to indicate that it changes the focus from network devices to assets. All processes are required to verify themselves to access the resources. In this paper, we focused on APT prevention. We sought an answer to the question: "could the 2020 United States Federal Government data breach have been prevented if the attacked networks used zero trust architecture?" To answer this question, we used MITRE's ATT&CK® framework to extract how the APT29 threat group techniques could be mitigated to prevent initial access to federal networks. Secondly, we listed basic constructs of the zero trust model using NIST Special Publication 800-207 and several other academic and industry resources. Finally, we analyzed how zero trust can prevent malicious APT activities. We found that zero trust has a strong potential of preventing APT attacks or mitigating them significantly. We also suggested that vulnerability scanning, application developer guidance, and training should not be neglected in zero trust implementations as they are not explicitly or strongly mentioned in NIST SP 800-207 and are among the mostly referred controls in academic and industry publications.
College/Unit
College of Arts, Sciences and Technology
Academic Department
CIS and Mathematics
Publication or Event Title
17th International Conference on Cyber Warfare and Security, State University of New York at Albany, Albany, New York, USA
First Page
92
Last Page
101
ISSN
2048-9889
DOI
10.34190/iccws.17.1.10
Creative Commons License
This work is licensed under a Creative Commons Attribution-NonCommercial-No Derivative Works 4.0 International License.
Recommended Citation
Karabacak, B., & Whittaker, T. (2022, March). Zero trust and advanced persistent threats: Who will win the war?. Proceedings of the 17th International Conference on Cyber Warfare and Security, USA, 17(1), 92-101. https://doi.org/10.34190/iccws.17.1.10