ISACA Cybersecurity Survey Reveals That One in Five Enterprises Have
Experienced an APT Attack
ROLLING MEADOWS, Ill. -- February 13, 2013
A global cybersecurity survey of more than 1,500 security professionals found
that more than one in five said their enterprise has experienced an advanced
persistent threat (APT) attack. According to the study by global IT
association ISACA, 94 percent say APTs represent a credible threat to national
security and economic stability, yet most enterprises are employing
ineffective technologies to protect themselves.
APTs, an espionage tactic intended to steal intellectual property, have made
headlines in recent years for breaching major enterprise and government
networks worldwide. More than 60 percent of survey respondents say that it’s
only a matter of time before their enterprise is targeted.
ISACA’s Advanced Persistent Threat Awareness: Study Results shows that 96
percent of respondents say they are at least somewhat familiar with APTs.
While this is positive, 53 percent say they do not believe APTs differ from
traditional threats—indicating that many do not fully understand them.
“APTs are sophisticated, stealthy and unrelenting,” said Christos Dimitriadis,
Ph.D., CISA, CISM, CRISC, international vice president of ISACA and head of
information security at INTRALOT GROUP. “Traditional cyberthreats often move
right on if they cannot penetrate their initial target, but an APT will
continually attempt to penetrate the desired target until it meets its
objective—and once it does, it can disguise itself and morph when needed,
making it difficult to identify or stop.”
More than 60 percent of survey respondents say they are ready to respond to
APT attacks. However, antivirus and antimalware (95 percent) and network
perimeter technologies such as firewalls (93 percent) top the list of controls
their enterprises are using to stop APTs—a concerning finding, given that APTs
are known to avoid being caught by these types of controls. The study shows
that mobile security controls, which are more effective, are used much less
“APTs call for many defensive approaches, from awareness training and amending
third-party agreements to ensure vendors are well-protected, to implementing
technical controls,” said Jo Stewart-Rattray, CISA, CISM, CGEIT, CRISC, FACS
CP, director of ISACA and director of information security and IT assurance at
The study also found that:
*90 percent of respondents believe that the use of social networking sites
increases the likelihood of a successful APT.
*87 percent believe “bring your own device” (BYOD), combined with rooting
or jailbreaking the device, makes a successful APT attack more likely.
*More than 80 percent say their enterprises have not updated their vendor
agreements to protect against APTs.
“We are only in February and already we can declare 2013 as the year of the
hack,” said Tom Kellermann, CISM, trusted advisor to the US government and
vice president of cyber security for Trend Micro. “ISACA's research reveals
that enterprises are under attack and they don’t even know it. Bringing this
awareness into the curriculum of education for security professionals is
necessary to enable them to build the custom defense they need to combat these
The ISACA study, sponsored by Trend Micro, is available as a free download at
With 100,000 members worldwide, ISACA ^ (www.isaca.org) helps enterprises
ensure trust in, and value from, their information and systems. Founded in
1969, ISACA attests IT skills and knowledge through the CISA, CISM, CGEIT and
CRISC certifications. ISACA developed the COBIT framework, which helps
enterprises manage and govern their information and technology.
Joanne Duffer, +1.847.660.5564
Marv Gellman, 646-935-3907
Alan Wallace, +1.425.522.3180
Press spacebar to pause and continue. Press esc to stop.