This is the first installment in a three-part series on threat hunting. Be sure to read Part 2 and Part 3 for more information.
One of the fundamental problems with cybersecurity is that organizations often do not realize when they are compromised. Traditional incident response methods are typically reactive, forcing security teams to wait for a visible sign of an attack. The problem is that many attacks today are stealthy, targeted and data-focused.
Just stop for a moment to ask yourself: How would you know if you were compromised? The typical answer is that you would not detect a compromise until significant damage has already been caused. Security professionals need a more aggressive approach to proactively hunt for threats on their networks.
Listen to the podcast: The Art of Cyber Threat Hunting
What Is Threat Hunting?
Threat hunting is the act of tracking and eliminating cyber adversaries from your network as early as possible. A key tenant of cybersecurity is that prevention is ideal, but detection is a must. In a digital climate that is changing at an incredibly rapid pace, it is unrealistic to believe that your organization will never be compromised. It is impossible to eliminate every threat to your organization, so you must be able to perform early detection and remediation.
Threat hunting offers many benefits, including:
- Reduction in breaches and breach attempts;
- A smaller attack surface with fewer attack vectors;
- Increase in the speed and accuracy of a response; and
- Measurable improvements in the security of your environment.
Once you understand and accept that you will be or already have been targeted and possibly compromised, you will be able to address security through a more realistic lens.
The next step is outlining what actions you need to take to quickly and proactively defend against malicious activity. This is where threat hunting comes into play. Threat hunting typically involves five steps:
- Planning: Identify critical assets.
- Detection: Search for known and unknown threats.
- Responding: Manage and contain attacks.
- Measuring: Gauge the impact of the attack and the success of your security.
- Preventing: Be proactive and stay prepared for the next threat.
This process allows you to gain further visibility into your network. The identification of hidden connections, covert channels and many other nefarious network activities provides for a much stronger security posture. Without this visibility into your network, you are essentially wearing a blindfold on a battlefield.
Focusing Your Threat Hunting Program
Today’s cyberthreats are constantly increasing in complexity, specificity and impact. These threats are as advanced as they are persistent. While some organizations do perform some type of threat hunting, the areas of focus and the resources being allocated are often misplaced.
Furthermore, these threat hunting programs are often informal and not repeatable. This means that organizations are still acting reactively to threats. The informality of the threat hunting programs also means that there are no metrics being created to document the success or failure of initiatives, so organizations are creating new processes for each threat they face.
When building a threat hunting program, security leaders should focus on four metrics:
- Length of connections;
- Amount of data being transferred;
- Failed and successful access attempts; and
- Number of dropped packets at the firewall.
Attacks that have made recent news were able to breach organizations that were not taking a proactive approach to security. WannaCry, for example, exploited a Windows vulnerability that had been identified over a decade ago. Because the victim organizations had not performed aggressive threat hunting, an erroneous service served as the perfect vector for the attackers. Meanwhile, the EternalRocks malware took advantage of the exact same vulnerability, meaning that many organizations failed to act even after the WannaCry attack.
Modern Attacks Require Enhanced Visibility
Traditional methods of defense revolve around reactive security — waiting for visible signs of a breach and taking appropriate actions in response. Modern attacks are much more advanced and sophisticated. These types of attacks rarely show signs and often go undetected for months or years. Proper threat hunting offers sufficient network visibility to help security professionals detect malicious activity and respond accordingly.
Listen to the podcast: The Art of Cyber Threat Hunting