Solutions

Targeted attacks are cyberattacks directed at specific companies or organizations. While many are aimed at stealing information of high monetary value, others are driven by ideological motives, as seen in attacks by Anonymous, where targets are selected because they conflict with the attackers’ beliefs, principles, or sense of justice. The attack methods used are highly diverse and extremely persistent, with adversaries repeatedly employing different techniques until their objectives are achieved. Typical examples include “Spear Phishing” that exploits social engineering and “Watering-Hole” attacks that deliver malicious programs by luring users to compromised websites.
Because these varied and sophisticated attacks continue until their objectives are achieved, it is impossible to completely prevent all attacks through “Perimeter Defense” measures such as firewalls and IPS alone. Organizations therefore need a multi-layered “Defense-in-Depth” approach that combines a variety of security measures beyond perimeter defenses.
Asgent provides comprehensive Defense-in-Depth strategies by integrating a diverse portfolio of products and services. Our approach ranges from perimeter defense, which blocks suspicious traffic, to proactive countermeasures against unknown threats and specialized CSIRT establishment support. By orchestrating these multiple layers of protection, we deliver a robust security posture capable of thwarting today’s most sophisticated attacks.

1. Countermeasures against C&C Server Communications and Malicious Programs Including Bots and Ransomware
   Since most targeted attacks infect host PCs to establish connectivity with a Command and Control (C&C) server – enabling attackers to hijack systems, laterally spread malware across the network, and exfiltrate sensitive data – it is imperative to implement traffic monitoring for early anomaly detection and proactive blocking of illicit communications based on the latest threat intelligence.
2. Zero-Day Threat Mitigation
   To effectively mitigate zero-day attacks, organizations should implement a framework that ensures safe data utilization by systematically vetting all files – whether received from external sources via email and social media or exchanged internally – through automated sanitization (Content Disarming) or risk assessment within a secure sandbox environment.
3. Rapid Detection of Internal Infiltration
   In recent targeted attacks, attackers often remain undetected for extended periods while gathering information, and the extent of the damage tends to increase in proportion to the length of this dwell time. To minimize actual damage, it is important to continuously monitor traffic within the network, detect suspicious and irregular communications or behavior as early as possible, perform risk analysis and identify infected devices, quickly gain an accurate understanding of the current situation, and take initial response actions as early as possible.