How are apt attacks defended?

1. Use Threat Intelligence: This includes up-to-date information on APT operators; threat intelligence obtained from analyzing malware; known C2 sites; known bad domains, email addresses, malicious email attachments, email subject lines; and malicious links and sites. Threat intelligence is being sold commercially and is enjoyed by industry cybersecurity groups***. Organizations must ensure that intelligence is relevant and timely. Threat intelligence is used to create a "tripwire" to alert you to activity on your network.

2. Establish strong egress rules: Block all outbound traffic from your organization except for web traffic (which must go through a proxy server), and block all data*** sharing and unclassified websites. Block SSH, FTP, Telnet or other ports and protocols from leaving the network. This breaks the communication channel from malware to C2 hosts and stops unauthorized data from exfiltrating the network.

3. Collect robust log analysis: Enterprises should collect and analyze detailed logging of critical networks and hosts to check for anomalous behavior. Logs should be retained for a period of time for investigation. Alerts matching threat intelligence should also be created.

4. Hire a security analyst: The role of the security analyst is to work with threat intelligence, log analysis, and alerts for proactive defense against APTs. The key to this position is experience.

5. Detection of unknown files: generally through the sandbox technology sin malicious programs to simulate the execution of the program through the behavioral analysis and evaluation of the program to determine whether the unknown file is a malicious threat.

6. Monitoring of terminal applications: generally using file reputation and hey whitelisting technology to detect applications and processes on the terminal.

7. Use of big data analysis methods: based on big data analysis methods, through the network forensics, the combination of big data analysis technology and sandbox technology to comprehensively analyze APT attacks.

Why nps?

nps is a lightweight, high-performance, powerful intranet penetration proxy server. It currently supports tcp and udp traffic forwarding, and can support any tcp and udp upper-layer protocols (access to intranet sites, debugging of local payment interfaces, ssh access, remote desktop, intranet dns resolution, etc. ?)

In addition to supporting intranet http proxy, intranet socks5 proxy, p2p, etc., and with a powerful web management terminal.