표적형 사이버 공격의 사례분석과 그 법적 대책에 관한 연구 - APT 공격을 중심으로 -

Cyber attack is the name given by articles and documents describing crimes that occur in a virtual world as opposed to tangible attacks such as war. A targeted cyber attack is when the attacker specifically targets someone or a company or government agency. These attacks are most commonly aimed at civil society organizations, business enterprises and government or military networks. It is easy to fall into the extremes of either believing that targeted cyber attacks rarely happen, or that it happens to you or your company all the time. The truth is that targeted cyber attacks are used to gain leverage in competitive areas, such as software development, or simply personal relationships. Targeted attacks constitute a threat category that refers to computer intrusions staged by threat actors that aggressively pursue and compromise specific targets. Often leveraging social engineering and malware, these attacks seek to maintain a persistent presence within the victim’s network so that the attackers can move laterally throughout the target’s network and extract sensitive information. A successful attack will typically allow the attacker to gain access to the victim’s assets, allowing stealing of sensitive internal data and possibly cause disruption and denial of service in some cases. One example of a targeted cyber-attack is an attack in an industrial espionage case where documents were stolen by penetrating a victim’s database server. Another example can be the actions of a jealous boyfriend spying on his girlfriend’s online activities by hacking into her instant messenger or email account. Targeted attacks remain a high priority threat that is difficult to defend. Increasingly, the results of cyber attacks can be felt in a tangible world victims of such attacks typically suffer financial losses and might also lose credibility. The more competitive advantage you have, the more frequent such attacks are going to be. Preventing these attacks is more of a matter of good risk management rather than simply buying a few products to prevent specific well known attacks. Budgets certainly have their importance in helping prevent targeted attacks against your company. However, it is more important to have good planning from the administration’s part to effectively prevent targeted cyber attacks. By effectively using threat intelligence derived from external and internal sources combined with context-aware data protection and security tools that empower and inform human analysts, organizations are better positioned to detect and mitigate targeted attacks.