We have seen this attack method grow as part of Advanced Persistent Threats (operation Aurora against Google or the G20 French Finance ministry attacks come to mind) but I have no doubt that even smaller scale attacks may employ this methodology if there is a lot to gain. Our case is: high value individuals within the organization receive malicious messages (e.g. PDFs or other documents with embedded malicious code) crafted specifically to look legitimate to them. Moreover, we are usually talking about less-than-expert users that would have trouble detecting an ill-intended message, let alone analyze one.
I feel it’s a subject that touches upon a number of security areas within an organization and would require a multi-layered approach: User Awareness Training, Detection Techniques, Mitigation measures (DLPs) in place etc.
Thinking that User Awareness and measures against Data Leakages would anyway be part of a comprehensive security program how should an organization address the Targeted Attack detection problem?
Some questions that need to be addressed:
You need to set up these filters and usually this may happen much after the actual attack took place. (There was an earlier question on dealing with APTs, but can this put to wider use?)
There needs to be detection and analysis capability either in-house or out-sourced. Are there any firms offering such a service?
You need to have email filtering tools able to integrate (automatically) disclosed attack patterns in their scanning process.
What to do with intercepted messages? Trying to catch targeted attacks may result in a large number of false positives, making it hard to delete; sending them in a “quarantine” system would perhaps be more appropriate but then (if you leave it to the user to decide) there is no guarantee that he/she will not, in the end, access the malicious email and get infected anyway…
How about complete system segregation for people that handle critical data: I’m thinking of a "layered" approach i.e. not receiving email themselves, but rather through secretaries or other "safe" go-betweens.