Perimeter

10/12/2018
10:30 AM
Rick Costanzo
Rick Costanzo
Commentary
Connect Directly
LinkedIn
RSS
E-Mail vvv
100%
0%

Threat Hunters & Security Analysts: A Dynamic Duo

Fighting spying with spying, threat hunters bring the proactive mindset of network reconnaissance and repair to the enterprise security team.

Take a look at the job listings on LinkedIn, Indeed, or any of the major sites, and you'll find hundreds of openings for threat hunters, something you wouldn't have seen just a few years ago. Many of these listings are from big banks, global telecoms, and defense contractors, institutions where data security is of primary importance and signaling others will follow.

As the pace, scale and harm-quotient of cyberthreats continue to grow, companies will increasingly shift thinking and resources to finding attackers before they cause problems. Clearly, the typical breach scenario — where internal teams discover an attack has taken place well after the fact, and then go into damage control — is frustrating for security professionals, customers, and shareholders. If you consider that the dollar amount of damage caused by a data breach is typically about commensurate with the cost of bad publicity resulting from the attack, having your CEO making a public mea culpa is neither a good strategy or investment.  

As a result of this changing dynamic, companies are hiring threat hunters to work alongside security analysts to create a continuum of protection — some on the offense, digging for vulnerabilities, others playing defense, protecting assets and patching holes.

Threat Hunter vs. Security Analyst
Threat hunters are, first of all, experienced security analysts. Because the role is to anticipate problems, it's critical for candidates to have a history of dealing with ransomware, phishing schemes, and cryptojacking. Good threat hunters, who are born from security analysts, maintain their education, and keep close watch on cybersecurity information and research, such as the nonprofit, federally funded research and development centers, known as MITRE, which include cybersecurity among its specialties. 

Successful threat hunters also must have a broad knowledge of network topology in order to assemble disparate signals into comprehensive views. Combined with a hacker's curiosity, threat hunters are armed to take educated hunches and explore the internal network, within the perimeter, to look for weaknesses and anomalies.

Threat-hunting teams, like hackers, undertake exploratory missions of their networks. They proactively look for specific malware intrusions as they are produced, maintain a steady eye on their organizations most sensitive data silos, and routinely patrol those areas of the network. They also develop a sixth sense for what is normal behavior at endpoints, the better to question subtle changes.

Threat hunters' analytical and technical expertise is complemented by other skill sets, like persuasive communication. Threat hunters often find themselves explaining the hypothetical to stakeholders who may still be stuck in a mindset of dealing with cyberattacks after they happen. That's in contrast to traditional cybersecurity analysts, who are tilted toward intrusion analysis, digital forensics, damage control, and repair. One role complements the other.

A Brave New World
Threat hunters thrive in places where top management understands the flip side of convenience. For example, cloud-based systems and connected devices are great for employees, contractors, and partners to communicate and share information. But this also creates porosity — or holes. The threat landscape is further complicated by today's more sophisticated breed of hacker who is profit-driven and, in some cases, handsomely paid by hostile governments, a trend we expect to accelerate in the next 24 months as the scale, complexity, and persistence of today's modern cyber threats increases. Organizationally, this means that security operations center teams will place a greater focus on dedicated threat hunting.

Furthermore, as part of the threat hunters' new role in identifying bad actors while they are still in reconnaissance mode, they need to write rules to map and detect TTPs (tactics, techniques, and procedures) that will identify who their adversaries are. From malicious pranksters to nation-sponsored attackers, threat hunters can spot emerging problems by knowing and continually mapping their favored TTPs.

The bottom line: Organizations need to adopt an aggressive, threat-hunting posture to compete with the proliferating threat universe. No longer is it sufficient to rely solely on incident-response teams that are already stretched thin and approaching problems after the fact. Threat hunters fight spying with spying, which will bring the proactive mindset of network reconnaissance and repair to protect an enterprise's vital data assets.

Related Content:

 

Black Hat Europe returns to London Dec. 3-6, 2018, with hands-on technical Trainings, cutting-edge Briefings, Arsenal open-source tool demonstrations, top-tier security solutions, and service providers in the Business Hall. Click for information on the conference and to register.

Rick Costanzo is an executive who has stoked a start-up mentality at some of the world's biggest companies, and a leader bringing new technologies from the theoretical to practical, everyday use. As CEO of RANK Software, Rick helps companies with one of the most critical ... View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
REISEN1955
50%
50%
REISEN1955,
User Rank: Ninja
10/12/2018 | 12:59:55 PM
Threat Hunting - an art with a science
It's not easy.  The skill set is entirely different than standard support and virus remediation.  I am just getting into it and it is like learning Mandarin Chinese - a ton of data exists and you have to be skilled in manipulation, conversion and analysis.  And the results of a 1,000 suspect hits produce  1 or 2 hits so it is alot of patience too.  Invaluable to do though.
New Free Tool Scans for Chrome Extension Safety
Dark Reading Staff 2/21/2019
Making the Case for a Cybersecurity Moon Shot
Adam Shostack, Consultant, Entrepreneur, Technologist, Game Designer,  2/19/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
5 Emerging Cyber Threats to Watch for in 2019
Online attackers are constantly developing new, innovative ways to break into the enterprise. This Dark Reading Tech Digest gives an in-depth look at five emerging attack trends and exploits your security team should look out for, along with helpful recommendations on how you can prevent your organization from falling victim.
Flash Poll
How Enterprises Are Attacking the Cybersecurity Problem
How Enterprises Are Attacking the Cybersecurity Problem
Data breach fears and the need to comply with regulations such as GDPR are two major drivers increased spending on security products and technologies. But other factors are contributing to the trend as well. Find out more about how enterprises are attacking the cybersecurity problem by reading our report today.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-6485
PUBLISHED: 2019-02-22
Citrix NetScaler Gateway 12.1 before build 50.31, 12.0 before build 60.9, 11.1 before build 60.14, 11.0 before build 72.17, and 10.5 before build 69.5 and Application Delivery Controller (ADC) 12.1 before build 50.31, 12.0 before build 60.9, 11.1 before build 60.14, 11.0 before build 72.17, and 10.5...
CVE-2019-9020
PUBLISHED: 2019-02-22
An issue was discovered in PHP before 5.6.40, 7.x before 7.1.26, 7.2.x before 7.2.14, and 7.3.x before 7.3.1. Invalid input to the function xmlrpc_decode() can lead to an invalid memory access (heap out of bounds read or read after free). This is related to xml_elem_parse_buf in ext/xmlrpc/libxmlrpc...
CVE-2019-9021
PUBLISHED: 2019-02-22
An issue was discovered in PHP before 5.6.40, 7.x before 7.1.26, 7.2.x before 7.2.14, and 7.3.x before 7.3.1. A heap-based buffer over-read in PHAR reading functions in the PHAR extension may allow an attacker to read allocated or unallocated memory past the actual data when trying to parse the file...
CVE-2019-9022
PUBLISHED: 2019-02-22
An issue was discovered in PHP 7.x before 7.1.26, 7.2.x before 7.2.14, and 7.3.x before 7.3.2. dns_get_record misparses a DNS response, which can allow a hostile DNS server to cause PHP to misuse memcpy, leading to read operations going past the buffer allocated for DNS data. This affects php_parser...
CVE-2019-9023
PUBLISHED: 2019-02-22
An issue was discovered in PHP before 5.6.40, 7.x before 7.1.26, 7.2.x before 7.2.14, and 7.3.x before 7.3.1. A number of heap-based buffer over-read instances are present in mbstring regular expression functions when supplied with invalid multibyte data. These occur in ext/mbstring/oniguruma/regcom...