Threat Intelligence

3/20/2017
02:30 PM
Kyle Wilhoit
Kyle Wilhoit
Commentary
Connect Directly
Twitter
LinkedIn
RSS
E-Mail vvv
50%
50%

Getting Beyond the Buzz & Hype of Threat Hunting

When harnessed properly, threat hunting can be one of the most useful techniques for finding attackers in your network. But it won't happen overnight.

The terms “threat intelligence” and “threat hunting” have become the next big thing in information security over the last few years. While many researchers (including myself) still view these buzzwords unfavorably, the reality is that – when done correctly - the concepts, processes, and strategies are critical to the security of an organization.

According to recent "report card" research from DomainTools, over 40% of survey respondents said their organization currently uses some sort of threat intelligence platform. This demonstrates that the field is growing - and with a heavy focus on threat hunting. The report card examined the maturity of information security departments across the globe, and gauged their success in implementing hunt capabilities in both small and large organizations. 

Source: Defensive Approach Diagram from DomainTools Report Card Report
Source: Defensive Approach Diagram from DomainTools Report Card Report

But What Is Threat Hunting, Really?
It’s important to remember that threat intelligence is merely threat data with contextualized analysis to help analysts understand the threats to their organization. Threat intelligence isn’t as easy as merely paying for an API or web portal to access specific threat data. Performing proper threat analysis requires skilled analysts, vetted information and data, timely information, and multiple data sources.

Often over-used and misunderstood, threat hunting is the process of proactively searching through networks and host data to detect and possibly help eliminate miscreants from networks and hosts. Performing one hunt can be different from another, and hunts vary from analyst to analyst. Many good hunters define their ability to hunt as an art versus a science. Many hunters rely on gut feel in conjunction with proper security analysis platforms, therefore combining the art and science of hunting. Unfortunately, hunting is often seen as hugely beneficial, but difficult to implement.

A-Hunting We Will Go: Threat Hunting Maturity
In our research, we found that threat hunting is emerging as a top tactic among many organizations. Of the respondents, more than one quarter (26%) indicated they spend 26 hours or more per week hunting threats in the network. A large majority (78%) of respondents using hunt capabilities find value in hunting – specifically drilling down on forensic clues from emails, such as domain name, IP address, or email address, which ideally leads to information that makes the organization more secure. Many of these organizations then take the information they find to proactively block on their proxies/egress firewalls and other defensive technology. Some of those same organizations will actually share out indicators of attack (IOA) or indicators of compromise (IOC) to like industries.

It Takes Time to Get it Right
Standing up a threat hunting capability doesn’t need to be difficult, but it needs to be right. The speed of adoption of a hunt program is one of the biggest and most prevalent issues I’ve witnessed within organizations attempting to stand up a hunting program. It takes time to implement and properly run a threat hunt team or capability! One of the most important things an organization should consider at the outset is the Threat Hunting Maturity Model from SQRRL.

Source: SQRRL Threat Maturity Model
Source: SQRRL Threat Maturity Model

By following this maturity model as a foundation for your own hunt capability, you can work your way through the four levels it takes to grow hunt capability organically – helping reduce the pains commonly associated with a developing hunt program. In addition to the maturity model process, it’s also important for organizations to have proper automation technology in place for when they achieve maturity.

Related Content:

 

Kyle Wilhoit is an internationally recognized security researcher with more than a decade of experience leading research teams to deliver timely and organized threat intelligence to internal and external customers. In his current role as senior security researcher at ... View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
12 Free, Ready-to-Use Security Tools
Steve Zurier, Freelance Writer,  10/12/2018
Most IT Security Pros Want to Change Jobs
Dark Reading Staff 10/12/2018
6 Security Trends for 2018/2019
Curtis Franklin Jr., Senior Editor at Dark Reading,  10/15/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
Flash Poll
The Risk Management Struggle
The Risk Management Struggle
The majority of organizations are struggling to implement a risk-based approach to security even though risk reduction has become the primary metric for measuring the effectiveness of enterprise security strategies. Read the report and get more details today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-10839
PUBLISHED: 2018-10-16
Qemu emulator <= 3.0.0 built with the NE2000 NIC emulation support is vulnerable to an integer overflow, which could lead to buffer overflow issue. It could occur when receiving packets over the network. A user inside guest could use this flaw to crash the Qemu process resulting in DoS.
CVE-2018-13399
PUBLISHED: 2018-10-16
The Microsoft Windows Installer for Atlassian Fisheye and Crucible before version 4.6.1 allows local attackers to escalate privileges because of weak permissions on the installation directory.
CVE-2018-18381
PUBLISHED: 2018-10-16
Z-BlogPHP 1.5.2.1935 (Zero) has a stored XSS Vulnerability in zb_system/function/c_system_admin.php via the Content-Type header during the uploading of image attachments.
CVE-2018-18382
PUBLISHED: 2018-10-16
Advanced HRM 1.6 allows Remote Code Execution via PHP code in a .php file to the user/update-user-avatar URI, which can be accessed through an "Update Profile" "Change Picture" (aka user/edit-profile) action.
CVE-2018-18374
PUBLISHED: 2018-10-16
XSS exists in the MetInfo 6.1.2 admin/index.php page via the anyid parameter.