What Is Advanced Threat Protection (ATP)?

Advanced Threat Protection (ATP): An overview

Advanced Threat Protection (ATP) is a type of cybersecurity solution capable of mitigating complex attacks, such as sophisticated malware risks.

To understand in detail what this means, you must first understand that the most severe cybersecurity threats that impact the typical organization today are so-called advanced threats. Advanced threats are deliberate attacks by skilled threat actors that target a specific organization, and that often take place over an extended period of time. Because the attackers responsible for advanced threats are determined and sophisticated, detecting and stopping them requires the coordination of multiple capabilities – such as traffic scanning, threat intelligence, and resource isolation – that, when used together, can block or mitigate the impact of sophisticated attacks.

The focus on multi-pronged, coordinated defense techniques is what distinguishes ATP from more traditional cybersecurity strategies. More basic attacks, like breaching an application that has a known vulnerability or stealing data that an organization accidentally exposes to the public, are effectively crimes of opportunity. They are relatively easy to block because the threat actors behind them are looking for low-hanging fruit, and they’ll move onto the next target if they can’t find a simple means of carrying out an attack.

But in the case of advanced threats, attackers focus on breaching a specific organization using complex techniques. If their first exploit attempt fails, they’ll keep trying until they execute a successful attack. They’ll also often work to escalate a breach once they’ve gained an initial entry point inside an organization’s IT estate. And in many cases, advanced threat actors have extensive resources at their disposal, making them all the more capable of carrying out complex, hard-to-detect attacks.

For all of these reasons, basic cybersecurity tools – such as vulnerability scanners that only detect publicly disclosed vulnerabilities – aren’t enough for blocking advanced threats. They often don’t address zero-day vulnerabilities (meaning vulnerabilities for which no remediation is currently available), and they may not catch advanced persistent tactics by threat actors who take deliberate steps to avoid detection. Therefore, to stop the most sophisticated attacks, businesses need ATP solutions tailored for identifying complex threats and the most skilled threat actors.

How Advanced Threat Protection works

Typically, Advanced Threat Protection tools work by leveraging multiple cybersecurity capabilities in combination to identify, assess, and block complex threats.

The exact features of ATP tools can vary, but in most cases, key functionality includes:

• Threat intelligence, which provides insights about the techniques and goals of advanced threat actors.
• Network traffic analysis, to help identify unusual network requests or traffic patterns that could reflect a breach.
• Analysis of authentication and authorization requests, which may also surface anomalies linked to an attack.
• User and Entity Behavior Analytics (UEBA), which assesses requests and actions carried out by both human and non-human users to detect anomalous behavior.

By analyzing data sources like these continuously and on a large scale, ATP software can detect complex attacks that basic scanning software would overlook.

Types of advanced threats

To illustrate the types of threats and attacks that ATP can help to address, here’s a look at four common types of advanced threats.

#1. Advanced Persistent Threats

An Advanced Persistent Threat (APT) is an attack campaign that threat actors carry out over a long period of time. Typically, APTs start with the successful breach of a small part of a business’s IT estate. From there, attackers escalate the attack by compromising additional resources.

Advanced Threat Protection tools can detect an Advanced Persistent Threat by identifying unusual activity within a company’s network or anomalous behavior by users and services. They can also enforce protections like network segmentation, which helps prevent APT campaigns from spreading by restricting attackers’ access to internal networks.

#2. Zero-day exploits

A zero-day exploit is one that takes advantage of an unknown, unpatched vulnerability. Traditional vulnerability scanners can’t identify these risks because they typically only catch known vulnerabilities. However, ATP capabilities like Dynamic Threat Analysis (DTA) can detect zero-day exploits by catching anomalous activity related to zero-day exploit attempts. Likewise, drift prevention can help prevent zero-day vulnerabilities from arising by ensuring that organizations don’t introduce changes that may trigger such vulnerabilities.

#3. Polymorphic malware

Polymorphic malware is malware that mutates frequently, making it hard to detect using conventional malware scanners. Here again, however, ATP capabilities like behavioral analysis and DTA are effective at detecting such risks because they identify unusual activity, rather than relying on signature-based detection of malware.

#4. Fileless attacks

In a fileless attack, threat actors plant malicious software in a computer’s memory rather than on a permanent file system. As a result, traditional malware scanners, which usually only scan file systems, won’t detect the malware. But advanced scanning techniques – such as those that use eBPF to detect risks not visible from an operating system’s “user space” – can identify these types of threats.

#5. Supply chain attacks

In a software supply chain attack, threat actors compromise software that is used by multiple organizations, such as an open source library or module. From there, they can use the compromised software as an entry point to carry out attacks within any environment where the software is deployed. Traditional security tools may not be able to detect supply chain attacks because they can’t scan external, third-party software. However, advanced scanning techniques – including software supply chain scanning and validation – can protect against this risk.

Advanced Threat Protection vs. Advanced Malware Protection (AMP)

As we explained, some Advanced Threat Protection use cases involve deploying advanced techniques to detect sophisticated malware risks, such as polymorphic and fileless malware. In this sense, ATP is similar to Advanced Malware Protection (AMP). That said, ATP can also identify advanced threats that don’t necessarily involve malware – such as attackers who have exploited a vulnerability inside an authentication system to gain entry to an IT estate and launch an Advanced Persistent Threat campaign.

In addition, ATP uses techniques – such as network traffic analysis and threat intelligence – that are typically not employed by AMP tools, which instead leverage methods like sandboxing and behavioral analysis.

Thus, Advanced Malware Protection is one aspect of Advanced Threat Protection, but Advanced Threat Protection includes additional capabilities and techniques that extend beyond addressing sophisticated malware.

Advanced Threat Protection with Aqua

Aqua’s broad range of advanced cybersecurity capabilities – such as Dynamic Threat Analysis and eBPF-based scanning and drift prevention – make detecting and blocking advanced threats a breeze. With Aqua, businesses enjoy the confidence of knowing they’re protected not just against basic threats and risks, but also against the most sophisticated and determined threat actors. By coupling Advanced Threat Protection with Advanced Malware Protection, Aqua provides a layered defense that protects against both general and sophisticated attack strategies.