Analytics

5/31/2018
04:00 PM
Connect Directly
Twitter
LinkedIn
Google+
RSS
E-Mail
50%
50%

Building Blocks for a Threat Hunting Program

Guidance for businesses building threat intelligence strategies while overwhelmed by threats, lack of talent, and a healthy dose of skepticism about the market.

The number and severity of cyberattacks are sending businesses scrambling to figure out their threat intelligence strategies: how to collect threat data, organize it into actionable information, prioritize the most severe threats, and address the biggest problems.

Threat intelligence is among the hottest buzzwords in cybersecurity today, and with good reason. As attacks become more severe, frequent, and complex, businesses struggle to detect and mitigate them with limited resources. New platforms promise artificial intelligence to pick up the slack by processing alerts, freeing up employees for focus on more complex tasks.

In the past, threat intel has meant a tactical feed of malicious IP addresses feeding into the security operations center (SOC) with little context or relation to the business. Now, it means feeds of domains, hashes, and IP address related to malicious activity, with threat intelligence platforms attempting to organize them. These platforms aim to supplement existing tech like SIEMs, IPS systems, and firewalls.

But the infosec community isn't fully sold. A recent study by the Ponemon Institute found 70% of security professionals surveyed think threat intelligence is too overwhelming or intricate to offer usable insight. Only 27% report their organization is "very effective" in using threat data to detect threats; only 31% of board and C-level members receive intelligence on security issues.

Part of the appeal of threat intelligence platforms is they're intended to perform the function of a tier-one SOC analyst, someone who is normally responsible for clicking through alerts generated by firewalls, IDS/IPS, SIEM, and endpoint security tools and gauging their intensity. This ideally gives employees more time to focus on mitigating advanced threats.

The problem is there are precious few people who know what to do with threat intelligence once they have it, and they don't come cheap. Even companies with generous security budgets have to figure out how to hire these employees and keep them on board. Corporate giants struggle with these issues because they lack sufficient resources, says JASK CEO Greg Martin.

"You don't have to have ten years of experience to be a threat hunter, but you have to have the aptitude, you have to know what you're doing to be effective in this space," says Martin. "Only the best companies in the world have true threat-hunting teams internally."

Building a Threat Management Program

"I think a lot of people approach threat hunting in the wrong way," says Alert Logic principal analyst Matt Downing, who shares a few pointers for building a threat management strategy. He, of course, starts with people.

"You have to allocate manpower," he emphasizes, adding that companies should form a team for this if they don't already have one. "You need an experienced staff to go in and look at this … have you seen threats, seen how attackers operate."

The most popular threat hunting skills for security pros include threat intelligence (69%), user and entity behavior analytics (57%), automatic detection (56%), and machine learning and automated analytics (55%), Alert Logic discovered in a recent survey.

Next, he advises reading through publicly reported incidents and asking whether it would happen to your company. Alert Logic does a lot of network inspection, he explains, and specifically focuses on endpoints. No matter how sophisticated and fancy the attacker is, they need to communicate with the target machine, he explains.

When asked about the biggest challenge in threat hunting, Downing says a major obstacle is lack of knowledge about what attacks look like. Threat management challenges include detecting advanced threats (55%) and lack of security expertise (43%).

"Part of it is understanding what people do normally," he continues. "You have to understand what's benign if you're going to understand what's malicious." By taking this approach and looking at the tactics, processes, and tools used in an attack, you get an end-to-end story of detection that can serve as a blueprint for pinpointing future threats.

New Approaches to Threat Hunting

What if you don't have the manpower in-house? In an effort to mitigate challenges for short-staffed companies, JASK launched a service called Special Ops. The idea can be summed up as Threat Hunting-as-a-Service: JASK supplements clients' existing security staff with its "Special Ops" team, which has threat analysts and researchers poached from Palo Alto Networks, Dell SecureWorks, and RSA FirstWatch.

The role of SpecialOps is to detect threats, help analysts identify what they should care about, and provide guidance for next steps. If JASK analysts detect an anomaly, they alert the company. From there, they escalate internally with the team and, if necessary, connect them with law enforcement or a partner like CrowdStrike or Mandiant to pursue an investigation.

"A lot of organizations come to us because they don't have the resources," he explains.

With talent expensive and hard to find, this service puts skilled analysts in one place so companies from enterprises to SMBs have them on-call. Instead of digging through the data themselves, or relying on software, they have a means of leveraging human talent to weed out threats. More than three-quarters (76%) of Alert Logic respondents say not enough time is spent searching for emerging and complex threats in the SOC. 

"We used to kill ourselves looking for the needle in the haystack," Martin notes. "We have a big stack of needles, now we need to find out which is the sharpest."

Related Content:

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance & Technology, where she covered financial ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Government Shutdown Brings Certificate Lapse Woes
Curtis Franklin Jr., Senior Editor at Dark Reading,  1/11/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: On the SS7 network, nobody knows you're a dog.
Current Issue
The Year in Security 2018
This Dark Reading Tech Digest explores the biggest news stories of 2018 that shaped the cybersecurity landscape.
Flash Poll
How Enterprises Are Attacking the Cybersecurity Problem
How Enterprises Are Attacking the Cybersecurity Problem
Data breach fears and the need to comply with regulations such as GDPR are two major drivers increased spending on security products and technologies. But other factors are contributing to the trend as well. Find out more about how enterprises are attacking the cybersecurity problem by reading our report today.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-18812
PUBLISHED: 2019-01-16
The Spotfire Library component of TIBCO Software Inc.'s TIBCO Spotfire Analytics Platform for AWS Marketplace, and TIBCO Spotfire Server contains a vulnerability that might theoretically fail to restrict users with read-only access from modifying files stored in the Spotfire Library, only when the S...
CVE-2018-18813
PUBLISHED: 2019-01-16
The Spotfire web server component of TIBCO Software Inc.'s TIBCO Spotfire Analytics Platform for AWS Marketplace, and TIBCO Spotfire Server contains multiple vulnerabilities that may allow persistent and reflected cross-site scripting attacks. Affected releases are TIBCO Software Inc. TIBCO Spotfire...
CVE-2018-18814
PUBLISHED: 2019-01-16
The TIBCO Spotfire authentication component of TIBCO Software Inc.'s TIBCO Spotfire Analytics Platform for AWS Marketplace, and TIBCO Spotfire Server contains a vulnerability in the handling of the authentication that theoretically may allow an attacker to gain full access to a target account, indep...
CVE-2018-5740
PUBLISHED: 2019-01-16
"deny-answer-aliases" is a little-used feature intended to help recursive server operators protect end users against DNS rebinding attacks, a potential method of circumventing the security model used by client browsers. However, a defect in this feature makes it easy, when the feature is i...
CVE-2018-5741
PUBLISHED: 2019-01-16
To provide fine-grained controls over the ability to use Dynamic DNS (DDNS) to update records in a zone, BIND 9 provides a feature called update-policy. Various rules can be configured to limit the types of updates that can be performed by a client, depending on the key used when sending the update ...