Grugq makes a few good points here: Sophisticated hacks employ a kill chain - think of it as what aviation calls a "cascade of failures". There's no single cau

Grugq makes a few good points here: Sophisticated hacks employ a kill chain - think of it as what aviation calls a "cascade of failures". There's no single cause for the awful outcome, but instead a series of events where intercepting any of them could have mitigated the crash or in this case, the hack. For example, sure they got in, but they also remained undetected. If they didn't get in or if they were detected, the whole thing may have been mitigated. I also like how he's breaking away from just labeling the thing 'APT' and instead he describes the entity behind the attack, who they are, where they come from, what motivates them and how they are goal oriented rather than opportunistic. In other words, they didn't pick the target because of a weak password, they picked the target for strategic reasons. And finally the point of how well resourced and experienced these operatives are - or to use his phrase, they're pretty fucking metal. To unpack this a bit, the operatives targeting these kinds of attacks are well funded, experienced, patient, persistent, have large teams and once they've picked you, it's really hard to consider the odds stacked in your favor unless you truly understand what you're up against and have prepared accordingly.