Towards Improving APT Mitigation: A Case for Counter-APT Red Teaming

摘要

Vulnerabilities leveraged by Advanced Persistent Threats (APTs) that ultimately allow them to gain access to critical data and unveil private information are often far removed from the portions of the security environment where initial access is gained. This paper presents a defensible scholarly decomposition of the red-team process itself and discusses how traditional red-team assessments may not be the most effective solution for emulating APT threats and mitigating their impacts. Counter APT red teaming (CAPTR teaming) is presented as a novel red-teaming process towards addressing such shortcomings of current well-known red-team practices.