Continuing from last week, we’re back to share more security topics as we approach the SSP Security Symposium on 9/23! Today we’re looking at the basics of threat hunting and how data can be utilized to benefit your organization’s cybersecurity. Learn the methods employed by threat hunters and how you can approach threat hunting yourself, and don’t forget to register to hear more about Cybersecurity Data Enrichment from Nathan Sinclair, Manager of the Cyber Defense Team for the City & County of San Francisco Department of Technology!
What is Proactive Threat Hunting?
Threat hunting is the practice of proactively searching for cyber threats that are lurking undetected in a network. Cyber threat hunting digs deep to find malicious actors in your environment that have slipped past your initial endpoint security defenses.
After sneaking in, an attacker can stealthily remain in a network for months as they quietly collect data, look for confidential material, or obtain login credentials that will allow them to move laterally across the environment.
Once an adversary is successful in evading detection and an attack has penetrated an organization’s defenses, many organizations lack the advanced detection capabilities needed to stop the advanced persistent threats from remaining in the network. That’s why threat hunting is an essential component of any defense strategy.
Threat Hunting Methodologies
Threat hunters assume that adversaries are already in the system, and they initiate investigation to find unusual behavior that may indicate the presence of malicious activity. In proactive threat hunting, this initiation of investigation typically falls into three main categories:
1. Hypothesis-driven investigation
Hypothesis-driven investigations are often triggered by a new threat that’s been identified through a large pool of crowdsourced attack data, giving insights into attackers’ latest tactics, techniques, and procedures (TTP). Once a new TTP has been identified, threat hunters will then look to discover if the attacker’s specific behaviors are found in their own environment.
2. Investigation based on known Indicators of Compromise or Indicators of Attack
This approach to threat hunting involves leveraging tactical threat intelligence to catalog known IOCs and IOAsassociated with new threats. These then become triggers that threat hunters use to uncover potential hidden attacks or ongoing malicious activity.
3. Advanced analytics and machine learning investigations
The third approach combines powerful data analysis and machine learning to sift through a massive amount of information in order to detect irregularities that may suggest potential malicious activity. These anomalies become hunting leads that are investigated by skilled analysts to identify stealthy threats.
All three approaches are a human-powered effort that combines threat intelligence resources with advanced security technology to proactively protect an organization’s systems and information.
What’s Required to Start Threat Hunting?
A top threat hunting service takes a three-pronged approach to attack detection. Along with skilled security professionals, it includes two other components necessary for successful hunting: vast data and powerful analytics.
1. Human Capital
Every new generation of security technology is able to detect a greater number of advanced threats — but the most effective detection engine is still the human brain. Automated detection techniques are inherently predictable, and today’s attackers are very aware of this and develop techniques to bypass, evade or hide from automated security tools. Human threat hunters are an absolutely critical component in an effective threat hunting service.
Since proactive hunting depends on human interaction and intervention, success depends on who is hunting through the data. Intrusion analysts must have expertise to identify sophisticated targeted attacks, and they also must have the necessary security resources to respond to any discovery of unusual behavior.
2. A Wealth of Data
The service must also have the ability to gather and store granular system events data in order to provide absolute visibility into all endpoints and network assets. With the use of a scalable cloud infrastructure, a good security service then aggregates and perform real-time analysis on these large data sets.
3. Threat Intelligence
Lastly, a threat hunting solution should be able to cross-references internal organizational data with the latest threat intelligence about external trends and deploys sophisticated tools to effectively analyze and correlate malicious actions.
All of this takes time, resources and dedication — and most organizations aren’t adequately staffed and equipped to mount a continuous 24/7 threat hunting operation. Fortunately, there are managed security solutions that have the right resources — the necessary people, data and analytical tools — to effectively hunt for unusual network activity and hidden threats.
