Nearly every organization should assume that it is at risk, but there are ways of countering the tactics used by advanced persistent threats.