Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Analytics

5/31/2018
04:00 PM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
50%
50%

Building Blocks for a Threat Hunting Program

Guidance for businesses building threat intelligence strategies while overwhelmed by threats, lack of talent, and a healthy dose of skepticism about the market.

The number and severity of cyberattacks are sending businesses scrambling to figure out their threat intelligence strategies: how to collect threat data, organize it into actionable information, prioritize the most severe threats, and address the biggest problems.

Threat intelligence is among the hottest buzzwords in cybersecurity today, and with good reason. As attacks become more severe, frequent, and complex, businesses struggle to detect and mitigate them with limited resources. New platforms promise artificial intelligence to pick up the slack by processing alerts, freeing up employees for focus on more complex tasks.

In the past, threat intel has meant a tactical feed of malicious IP addresses feeding into the security operations center (SOC) with little context or relation to the business. Now, it means feeds of domains, hashes, and IP address related to malicious activity, with threat intelligence platforms attempting to organize them. These platforms aim to supplement existing tech like SIEMs, IPS systems, and firewalls.

But the infosec community isn't fully sold. A recent study by the Ponemon Institute found 70% of security professionals surveyed think threat intelligence is too overwhelming or intricate to offer usable insight. Only 27% report their organization is "very effective" in using threat data to detect threats; only 31% of board and C-level members receive intelligence on security issues.

Part of the appeal of threat intelligence platforms is they're intended to perform the function of a tier-one SOC analyst, someone who is normally responsible for clicking through alerts generated by firewalls, IDS/IPS, SIEM, and endpoint security tools and gauging their intensity. This ideally gives employees more time to focus on mitigating advanced threats.

The problem is there are precious few people who know what to do with threat intelligence once they have it, and they don't come cheap. Even companies with generous security budgets have to figure out how to hire these employees and keep them on board. Corporate giants struggle with these issues because they lack sufficient resources, says JASK CEO Greg Martin.

"You don't have to have ten years of experience to be a threat hunter, but you have to have the aptitude, you have to know what you're doing to be effective in this space," says Martin. "Only the best companies in the world have true threat-hunting teams internally."

Building a Threat Management Program

"I think a lot of people approach threat hunting in the wrong way," says Alert Logic principal analyst Matt Downing, who shares a few pointers for building a threat management strategy. He, of course, starts with people.

"You have to allocate manpower," he emphasizes, adding that companies should form a team for this if they don't already have one. "You need an experienced staff to go in and look at this … have you seen threats, seen how attackers operate."

The most popular threat hunting skills for security pros include threat intelligence (69%), user and entity behavior analytics (57%), automatic detection (56%), and machine learning and automated analytics (55%), Alert Logic discovered in a recent survey.

Next, he advises reading through publicly reported incidents and asking whether it would happen to your company. Alert Logic does a lot of network inspection, he explains, and specifically focuses on endpoints. No matter how sophisticated and fancy the attacker is, they need to communicate with the target machine, he explains.

When asked about the biggest challenge in threat hunting, Downing says a major obstacle is lack of knowledge about what attacks look like. Threat management challenges include detecting advanced threats (55%) and lack of security expertise (43%).

"Part of it is understanding what people do normally," he continues. "You have to understand what's benign if you're going to understand what's malicious." By taking this approach and looking at the tactics, processes, and tools used in an attack, you get an end-to-end story of detection that can serve as a blueprint for pinpointing future threats.

New Approaches to Threat Hunting

What if you don't have the manpower in-house? In an effort to mitigate challenges for short-staffed companies, JASK launched a service called Special Ops. The idea can be summed up as Threat Hunting-as-a-Service: JASK supplements clients' existing security staff with its "Special Ops" team, which has threat analysts and researchers poached from Palo Alto Networks, Dell SecureWorks, and RSA FirstWatch.

The role of SpecialOps is to detect threats, help analysts identify what they should care about, and provide guidance for next steps. If JASK analysts detect an anomaly, they alert the company. From there, they escalate internally with the team and, if necessary, connect them with law enforcement or a partner like CrowdStrike or Mandiant to pursue an investigation.

"A lot of organizations come to us because they don't have the resources," he explains.

With talent expensive and hard to find, this service puts skilled analysts in one place so companies from enterprises to SMBs have them on-call. Instead of digging through the data themselves, or relying on software, they have a means of leveraging human talent to weed out threats. More than three-quarters (76%) of Alert Logic respondents say not enough time is spent searching for emerging and complex threats in the SOC. 

"We used to kill ourselves looking for the needle in the haystack," Martin notes. "We have a big stack of needles, now we need to find out which is the sharpest."

Related Content:

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance & Technology, where she covered financial ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Threaded  |  Newest First  |  Oldest First
Commentary
What the FedEx Logo Taught Me About Cybersecurity
Matt Shea, Head of Federal @ MixMode,  6/4/2021
Edge-DRsplash-10-edge-articles
A View From Inside a Deception
Sara Peters, Senior Editor at Dark Reading,  6/2/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
The State of Cybersecurity Incident Response
In this report learn how enterprises are building their incident response teams and processes, how they research potential compromises, how they respond to new breaches, and what tools and processes they use to remediate problems and improve their cyber defenses for the future.
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-31811
PUBLISHED: 2021-06-12
In Apache PDFBox, a carefully crafted PDF file can trigger an OutOfMemory-Exception while loading the file. This issue affects Apache PDFBox version 2.0.23 and prior 2.0.x versions.
CVE-2021-31812
PUBLISHED: 2021-06-12
In Apache PDFBox, a carefully crafted PDF file can trigger an infinite loop while loading the file. This issue affects Apache PDFBox version 2.0.23 and prior 2.0.x versions.
CVE-2021-32552
PUBLISHED: 2021-06-12
It was discovered that read_file() in apport/hookutils.py would follow symbolic links or open FIFOs. When this function is used by the openjdk-16 package apport hooks, it could expose private data to other local users.
CVE-2021-32553
PUBLISHED: 2021-06-12
It was discovered that read_file() in apport/hookutils.py would follow symbolic links or open FIFOs. When this function is used by the openjdk-17 package apport hooks, it could expose private data to other local users.
CVE-2021-32554
PUBLISHED: 2021-06-12
It was discovered that read_file() in apport/hookutils.py would follow symbolic links or open FIFOs. When this function is used by the xorg package apport hooks, it could expose private data to other local users.