According to the report (and I'm never sure how far one can trust leaked documents simply because you don't get the full context) the intrusion was not noticed

According to the report (and I'm never sure how far one can trust leaked documents simply because you don't get the full context) the intrusion was not noticed until the intruders reached one compromised laptop that had non-standard software installed on it (LittleSnitch) that tripped an alarm when the intruders tried to upload a screen shot. Perhaps best practices might include more and more varied trip wire software of this nature? Disclaimer: I'm a civilian. My exposure to infosec begins and ends with being careful about email and USB drives.