Your question can be seen in broader context: How to defend against an APT (advanced persistent threat) style attack (aka targeted attack).
Qucik recap about main characteristics of APT attacks:
As seen so far, most such attacks use one of three attack vectors (with some examples):
- spear phising:
- infected USB:
- strategic web compromises
In practice all of this 3 predominant attack vectors can't be prevented for 100% in any larger company with big enough network and large number of employees. So because prevention eventaully fails we have to build our defense on detection capabilities. But as we all know detecting targeted attacks is hard and such attacks can run unnoticed for years as APT1 Mandinat Report showed us. It is hard mainly because of stealthiness of malware used in these attacks.
Stealthiness of targeted attacks is based on fact that malware used in executing this kind of attack is custom malware - it hasn't been seen in the wild before by AV software, IDS systems don't have signatures for it, etc.
Defense concepts against such attacks still emerges and evolves, some notable examples:
Lockheed martin's approach based on Threat Intelligence & Kill Chains (link1 link2)
RSA's and Center for Internet Security's cyber-risk intelligence approach (link1 link2)