- By now you already know
that there are no products or security technologies
in the world that can detect and block all security threats
in this continuously evolving threat landscape.
Regardless of the vendor, regardless
of how expensive this technology is.
And this is why many organizations are tasking
their senior analyst in their security operations center
or in their computer security instant response team, to hunt
for threats that may have actually bypassed any
security controls that are in place within the organization.
This is why this concept of threat hunting assist
and threat hunting in short is the act
of basically proactively looking for threats and searching
through the organization to discover, you know
if any of these threats actually could have been
bypassing your security controls, your security products
your security technologies out there, right?
And whenever I mention no products, that means no firewalls
no intrusion prevention systems or IPS.
No data loss prevention systems, no cloud service
that will be perfect, right?
And it will be able to detect and blocked all these threats
that we actually seeing nowadays right.
Now, starting with this hunting process.
One thing that I want to highlight is that, you know
at the end of the day, you know, I cannot sugar coat it,
it actually requires a deep knowledge of
the network and it's often performed by SOC analyst.
So whenever I say SOC, you know
the security operations center analyst that might be in
in a, you know, in an escalation tier, right?
Typically a SOC or a security operation center
is divided into three different tiers.
Tier one where the junior analyst reside a mid-level
to senior analyst, you know, tier tier two.
And then the top tier or
a tier three senior security analyst.
That top tier is where typically threat hunting resides.
However, that all depends on the organization and
how the organization, you know, how big the organization is.
Number one, how is it structure?
Right? And in some cases, actually
large corporations may have a separate team to
perform threat hunting, just dedicated for threat hunting.
You know, even outside of the analyst that traditionally are
in the security operations center.
Now threat hunters assume
that an attacker has already compromised the network, right?
Subsequently they actually need to come
up with some hypothesis of what is actually compromised
how the adversary could have been performing the attack.
What are the tactics, techniques, and procedures?
What we call TTPs that modern attackers use to
bypass those security controls.
This is why many organizations are actually using things
like the MI attack framework to be able to learn
about the tactics and techniques of adversaries.
And in short, the MI attack framework covers those tactics
and techniques that attackers use
in real life attacks, right?
If it is in the minor attack framework
it has happened in the real world.
It's not a hypothesis.
It's not a theory.
These are the tactics
and techniques that attackers are actually
are using to compromise organizations.
Now, threat hunting is not the same as the traditional
SOC incident response activities, right?
Also it is not the same as vulnerability management
which is a process of patching vulnerabilities
assessing your network
and your systems, including cloud-based applications.
In some cases to, you know, remediate some type
of vulnerabilities.
In this case, you know,
what the threat hunting process it does is
that you come up with a hypothesis.
As I mentioned to you before
typically the hypothesis is created using some type
of information, some type of assumption.
And in many cases
that type of information is threat intelligence, right?
Probably you subscribing to a threat intelligence
feed that can potentially give you somewhat of an insights.
What attackers are actually doing in other organizations
and potentially how to detect the indicators of compromise
how to manipulate your systems
to be able to hunt, you know, for those threats.
And so on right.
Now, threat hunting is not a new concept.
Many organizations have performed threat huntings
for a long time.
However, in the last decade
or so many organizations have recognized
that they either have to implement a threat hunting program
or enhance their assisting program to better
defend their organizations, right.
Now, there's no sites fits all threat hunting process.
However, there are several common best practices
among mature organizations
on how to perform this threat hunting process.
First you come up with a hypothesis.
And as I mentioned, you can be based on threat intelligence
some internal anomaly, or by just plain intuition.
Then you use tools and methodologies to investigate you move
into hopefully, you know
revealing those new patterns and tactics
and techniques and procedures that TTPs from the attackers.
And then, you know, hopefully you find the threat
and you are able to remediate a threat
and you refine and enrich, you know
the reporting using different types of analytics.
And of course you get that outcome, right?
And the lessons learned from it
and you feed it back to your incident response process.
So you can actually learn on how in the future
you can catch those threats before it, of course, you know
passes your security controls and your security monitoring.
Now, the last thing that I want to cover is
that you can measure the maturity
of your threat hunting program
within the organization in many ways, but here
I'm showing a high level matrix that can be used to
evaluate the maturity level of your organization
against different high level threat hunting elements.
And as you see here, basically you have a threat hunting
high level elements on the left
and the threat hunting maturity level
across the top, across the, the matrix here from initial
or minimal that you basically are just getting started
with threat hunting or level three
which is an innovative right
or what we call the leading level.
And to the fact that you are, you have a really
good mature process to perform threat intelligence.
And if you look down the list, especially in level three
you see the word automation a lot
because automation is crucial for instant response
for threat hunting, for vulnerability management
and all the security operations within your organization.
So again, you know, this is just a reference
you know, again, you can actually measure the maturity
of your threat hunting program in many different ways
but this one is a very easy way to,
to basically even look at trends.
If your threat hunting process is, you know, maturing enough
and you can actually claim some success in some areas.