Doesn't social engineering attack mean APT attack? They seem similar in my mind, because both of them focuses human, not technology. Shortly, what is the difference between social engineering attack and APT attack?

  • 2
    Some attackers are more apt than others... – techraf Jul 1 '16 at 10:04
  • 2
    I once read a tweet (author forgotten, the login started with a 'c' IIRC) which stated more or less that 'when a small company is hacked it is called bad security, when a large one is - it is called an APT'. Being a victim of an APT sounds much better than being hacked because security was not there. This does not answer your question as there is no relationship between "APT" and "Social Engineering" (it is one of the ways to gather information prior to or during an attack) – WoJ Jul 1 '16 at 15:25

APT is generally thought of as "Advanced" to the tune that many resources were used in order to attack a target. These resources could be programming (zero day/unseen/sophisticated) threats that are not common among a set of baseline attacks (they used exploit X Y Z). They generally are in the attack/compromise phase for long periods of time, and have indicators of "heavy" sponsorship. (Nation states, organized crime groups... Someone/some group with financial resources/time). The wikipedia entry for APT is very detailed in explaining the differences of what an APT is, and isn't.

Social engineering is one set of attacks that APT groups may use. For example spearphishing: "Targeted phishing attacks" This is when an attack group creates a specific message that a target is likelier to open versus random phishing attack. For example, if you announced a partnership with Acme Corp, and received an email from who appears to be the attorney for Acme Corp, there is a higher likelihood you would open that email. It is targeted specifically to make you open it. It (the phish) has relevant information (targeted). Rarely has it been documented that other means of social engineering (phone calls, in person visits, perimeter style) were used in an APT attack. Long story short, APT is an attack phase/parameter, and social engineering might be one of the vectors used.


Original answer

Social engineering is a set of techniques while APT is a type of attack(er). Let me clarify:

Social engineering means, targeting the human as the weakest link of the system. This includes attack like phishing, calling support to get information or change passwords, talking to people to get entrance to a restricted area, etc.

APT (advanced persistent threat) is a name that is given to a type of attack(er). Someone, but more often a team, with great knowledge, time and money to attack. State sponsored attackers are a good example. They will most often try to persist their attack once they have broken into your system by installing rootkits or backdoors. Their goal is to remain under the radar and gain information and escalate privilege. An APT is characterized by the time between the start of the attack and the time of detection. These guys have often infiltrated months or years before being detected. Even after closing the initial vulnerability the attack can persist through extended knowledge of the system and earlier compromise of other system.APT wiki

Social engineering can also be used by an APT to gain initial access to your network. Therefor these two are not opposites or synonyms. Social engineering is an type of attack vectors and APT is a type of attack.

Edit: Since I had a lot of comment on APT being an attack. The Dutch Wikipedia explains it as an attack while the English Wikipedia explains it as an attacker. In my first explanation I had it both as a type of attack as well as a type of attacker. This was kinda confusing so I removed it.

APT is indeed a threat that goes out from a type of attacker but they are are characterized by the way they attack (therefor type of attack).

English wiki:

APT usually refers to a group, such as a government, with both the capability and the intent to target, persistently and effectively, a specific entity. Wikipedia

Dutch wiki:

Een Advanced Persistent Threat (APT) is een langdurige en doelgerichte cyberaanval... Wikipedia

Translates to: An APT is prolonged and targeted cyber attack...

  • 3
    "APT (advanced persistent threat) is a name that is given to a type of attack" - sorry but I'd disagree, and so would your linked wiki article :) – GreatSeaSpider Jul 1 '16 at 13:12
  • "APT" is not an "attack". It's much broader in scope than a type of attack. Also, "social engineering" is a type of attack, and "phishing" would be the "attack vector". – schroeder Jul 3 '16 at 18:00
  • @schroeder, I disagree that social engineering is a type of attack. Social engineer like phising, baiting, pretexting is a set of concrete techniques to penetrate a system. An attack can consist of multiple of these attack vectors and also contains much more like data extraction, cleaning up your tracks and installing backdoors. Therefor APT which is a type of attacker uses a distinct attack (pattern) and makes use of attack vectors which can be grouped into attack types like social engineering. – Silver Jul 4 '16 at 6:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.