We are evaluating the security of the PCs used by people with access to high-value company documents. At the moment they are kept patched and run a virus checker, but we are concerned about zero-day exploits and APTs.
We've already detected spear-fish emails sent to people high in the organisation.
Is there a way to defend against these attacks short of creating an air gap between the network these documents are on and the internet?
We've already detected spear-fish emails sent to people high in the organisation.
Is there a way to defend against these attacks short of creating an air gap between the network these documents are on and the internet?
Spear-phishing suggests to me that you need to focus on defending your PCs from their users, which unfortunately is not a technical problem, it's a people problem. You can harden your technology all you want, but if your high-access users hand over sensitive information (or their credentials) to your attackers, then that's the real issue, and all the technological hardening in the world can't stop that. To that point, the recent leaking of classified materials from the NSA (Snowden) and the Army (Manning) should prove that to anyone paying even the slightest bit of attention.
Even worse, there's no particularly effective defense against having your users hand over those precious pieces of information. "Security education" is completely worthless for the vast majority of users, and only somewhat useful for the other fraction. The only remaining mitigation available is strict compartmentalization of your information so that everyone only knows what they absolutely need to, but this is extremely difficult and expensive to implement and maintain... and isn't always effective either - it just limits the damage.
As the saying goes, security is a process, which is where you need to focus your efforts. Without trying to write a book:
