Does Symantec Endpoint Protection defend against Advanced Persistent Threats (APTs)?

Products

• Endpoint Protection

Issue/Introduction

Targeted attacks using low-prevalence malware can often evade traditional AntiVirus defenses, leading to theft of intellectual property, sabotage or breach of customer data. How can Symantec Endpoint Protection (SEP) help defend against these determined attack campaigns from persistent adversaries?    

Resolution

Symantec adds protection against all malware samples that come to our attention, regardless of their source. This includes malware created by well-financed or state-sponsored groups.

To reduce risk, it is important that:

• All endpoints must be defended by a reliably-working SEP client and with definitions that are kept up to date.
• Logs of activity within the organization be actively monitored.  Suspicious files or traffic identified by SEP should be investigated by the security admin and action taken, when necessary.
• SEP be used as part of a layered defense.  Additional security measures must be put in place on mail servers and other means of entry into the network. 
• Be aware that stopping malware alone is not adequate.  Many APT groups use legitimate tools as well as malware.  See our blog and white paper, Attackers are increasingly living off the land
• If possible, organizations should use  Symantec Endpoint Threat Defense for Active Directory and Symantec Endpoint Detection and Response (previously known as Symantec Advanced Threat Protection).  The advanced AI algorithms and machine learning technology Targeted Attack Analytics (TAA) that is built into Symantec EDR has proven effective against a number of recent adversary campaigns. One example: Gallmaker: New Attack Group Eschews Malware to Live off the Land
• All users should be educated to follow best security practices and measures should be taken to harden the environment against intrusion.
• Additional information can be found in the 2014 white paper Using Symantec Endpoint Protection 12.1 to Protect Against Advanced Persistent Threats (APTs): Configuration guidelines for endpoint protection against APTs

 

For specific examples of Symantec's response to APT groups, please consult the latest blogs and articles.