Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Threat Intelligence

3/20/2017
02:30 PM
Kyle Wilhoit
Kyle Wilhoit
Commentary
Connect Directly
Twitter
LinkedIn
RSS
E-Mail vvv
50%
50%

Getting Beyond the Buzz & Hype of Threat Hunting

When harnessed properly, threat hunting can be one of the most useful techniques for finding attackers in your network. But it won't happen overnight.

The terms “threat intelligence” and “threat hunting” have become the next big thing in information security over the last few years. While many researchers (including myself) still view these buzzwords unfavorably, the reality is that – when done correctly - the concepts, processes, and strategies are critical to the security of an organization.

According to recent "report card" research from DomainTools, over 40% of survey respondents said their organization currently uses some sort of threat intelligence platform. This demonstrates that the field is growing - and with a heavy focus on threat hunting. The report card examined the maturity of information security departments across the globe, and gauged their success in implementing hunt capabilities in both small and large organizations. 

But What Is Threat Hunting, Really?
It’s important to remember that threat intelligence is merely threat data with contextualized analysis to help analysts understand the threats to their organization. Threat intelligence isn’t as easy as merely paying for an API or web portal to access specific threat data. Performing proper threat analysis requires skilled analysts, vetted information and data, timely information, and multiple data sources.

Often over-used and misunderstood, threat hunting is the process of proactively searching through networks and host data to detect and possibly help eliminate miscreants from networks and hosts. Performing one hunt can be different from another, and hunts vary from analyst to analyst. Many good hunters define their ability to hunt as an art versus a science. Many hunters rely on gut feel in conjunction with proper security analysis platforms, therefore combining the art and science of hunting. Unfortunately, hunting is often seen as hugely beneficial, but difficult to implement.

A-Hunting We Will Go: Threat Hunting Maturity
In our research, we found that threat hunting is emerging as a top tactic among many organizations. Of the respondents, more than one quarter (26%) indicated they spend 26 hours or more per week hunting threats in the network. A large majority (78%) of respondents using hunt capabilities find value in hunting – specifically drilling down on forensic clues from emails, such as domain name, IP address, or email address, which ideally leads to information that makes the organization more secure. Many of these organizations then take the information they find to proactively block on their proxies/egress firewalls and other defensive technology. Some of those same organizations will actually share out indicators of attack (IOA) or indicators of compromise (IOC) to like industries.

It Takes Time to Get it Right
Standing up a threat hunting capability doesn’t need to be difficult, but it needs to be right. The speed of adoption of a hunt program is one of the biggest and most prevalent issues I’ve witnessed within organizations attempting to stand up a hunting program. It takes time to implement and properly run a threat hunt team or capability! One of the most important things an organization should consider at the outset is
the Threat Hunting Maturity Model from SQRRL.

By following this maturity model as a foundation for your own hunt capability, you can work your way through the four levels it takes to grow hunt capability organically – helping reduce the pains commonly associated with a developing hunt program. In addition to the maturity model process, it’s also important for organizations to have proper automation technology in place for when they achieve maturity.

Related Content:

 

Kyle Wilhoit is an internationally recognized security researcher with more than a decade of experience leading research teams to deliver timely and organized threat intelligence to internal and external customers. In his current role as senior security researcher at ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
COVID-19: Latest Security News & Commentary
Dark Reading Staff 7/9/2020
Russian Cyber Gang 'Cosmic Lynx' Focuses on Email Fraud
Kelly Sheridan, Staff Editor, Dark Reading,  7/7/2020
Why Cybersecurity's Silence Matters to Black Lives
Tiffany Ricks, CEO, HacWare,  7/8/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Special Report: Computing's New Normal, a Dark Reading Perspective
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
The Threat from the Internetand What Your Organization Can Do About It
The Threat from the Internetand What Your Organization Can Do About It
This report describes some of the latest attacks and threats emanating from the Internet, as well as advice and tips on how your organization can mitigate those threats before they affect your business. Download it today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-15504
PUBLISHED: 2020-07-10
A SQL injection vulnerability in the user and admin web interfaces of Sophos XG Firewall v18.0 MR1 and older potentially allows an attacker to run arbitrary code remotely. The fix is built into the re-release of XG Firewall v18 MR-1 (named MR-1-Build396) and the v17.5 MR13 release. All other version...
CVE-2020-8190
PUBLISHED: 2020-07-10
Incorrect file permissions in Citrix ADC and Citrix Gateway before versions 13.0-58.30, 12.1-57.18, 12.0-63.21, 11.1-64.14 and 10.5-70.18 allows privilege escalation.
CVE-2020-8191
PUBLISHED: 2020-07-10
Improper input validation in Citrix ADC and Citrix Gateway versions before 13.0-58.30, 12.1-57.18, 12.0-63.21, 11.1-64.14 and 10.5-70.18 and Citrix SDWAN WAN-OP versions before 11.1.1a, 11.0.3d and 10.2.7 allows reflected Cross Site Scripting (XSS).
CVE-2020-8193
PUBLISHED: 2020-07-10
Improper access control in Citrix ADC and Citrix Gateway versions before 13.0-58.30, 12.1-57.18, 12.0-63.21, 11.1-64.14 and 10.5-70.18 and Citrix SDWAN WAN-OP versions before 11.1.1a, 11.0.3d and 10.2.7 allows unauthenticated access to certain URL endpoints.
CVE-2020-8194
PUBLISHED: 2020-07-10
Reflected code injection in Citrix ADC and Citrix Gateway versions before 13.0-58.30, 12.1-57.18, 12.0-63.21, 11.1-64.14 and 10.5-70.18 and Citrix SDWAN WAN-OP versions before 11.1.1a, 11.0.3d and 10.2.7 allows the modification of a file download.