This is the first installment in a three-part series on threat hunting. Be sure to read Part 2 and Part 3 for more information.

One of the fundamental problems with cybersecurity is that organizations often do not realize when they are compromised. Traditional incident response methods are typically reactive, forcing security teams to wait for a visible sign of an attack. The problem is that many attacks today are stealthy, targeted and data-focused.

Just stop for a moment to ask yourself: How would you know if you were compromised? The typical answer is that you would not detect a compromise until significant damage has already been caused. Security professionals need a more aggressive approach to proactively hunt for threats on their networks.

Listen to the podcast: The Art of Cyber Threat Hunting

What Is Threat Hunting?

Threat hunting is the act of tracking and eliminating cyber adversaries from your network as early as possible. A key tenant of cybersecurity is that prevention is ideal, but detection is a must. In a digital climate that is changing at an incredibly rapid pace, it is unrealistic to believe that your organization will never be compromised. It is impossible to eliminate every threat to your organization, so you must be able to perform early detection and remediation.

Threat hunting offers many benefits, including:

  • Reduction in breaches and breach attempts;
  • A smaller attack surface with fewer attack vectors;
  • Increase in the speed and accuracy of a response; and
  • Measurable improvements in the security of your environment.

Once you understand and accept that you will be or already have been targeted and possibly compromised, you will be able to address security through a more realistic lens.

The next step is outlining what actions you need to take to quickly and proactively defend against malicious activity. This is where threat hunting comes into play. Threat hunting typically involves five steps:

  1. Planning: Identify critical assets.
  2. Detection: Search for known and unknown threats.
  3. Responding: Manage and contain attacks.
  4. Measuring: Gauge the impact of the attack and the success of your security.
  5. Preventing: Be proactive and stay prepared for the next threat.

This process allows you to gain further visibility into your network. The identification of hidden connections, covert channels and many other nefarious network activities provides for a much stronger security posture. Without this visibility into your network, you are essentially wearing a blindfold on a battlefield.

Focusing Your Threat Hunting Program

Today’s cyberthreats are constantly increasing in complexity, specificity and impact. These threats are as advanced as they are persistent. While some organizations do perform some type of threat hunting, the areas of focus and the resources being allocated are often misplaced.

Furthermore, these threat hunting programs are often informal and not repeatable. This means that organizations are still acting reactively to threats. The informality of the threat hunting programs also means that there are no metrics being created to document the success or failure of initiatives, so organizations are creating new processes for each threat they face.

When building a threat hunting program, security leaders should focus on four metrics:

  1. Length of connections;
  2. Amount of data being transferred;
  3. Failed and successful access attempts; and
  4. Number of dropped packets at the firewall.

Attacks that have made recent news were able to breach organizations that were not taking a proactive approach to security. WannaCry, for example, exploited a Windows vulnerability that had been identified over a decade ago. Because the victim organizations had not performed aggressive threat hunting, an erroneous service served as the perfect vector for the attackers. Meanwhile, the EternalRocks malware took advantage of the exact same vulnerability, meaning that many organizations failed to act even after the WannaCry attack.

Modern Attacks Require Enhanced Visibility

Traditional methods of defense revolve around reactive security — waiting for visible signs of a breach and taking appropriate actions in response. Modern attacks are much more advanced and sophisticated. These types of attacks rarely show signs and often go undetected for months or years. Proper threat hunting offers sufficient network visibility to help security professionals detect malicious activity and respond accordingly.

Listen to the podcast: The Art of Cyber Threat Hunting

More from Risk Management

ICS CERT predictions for 2024: What you need to know

4 min read - As we work through the first quarter of 2024, various sectors are continuously adapting to increasingly complex cybersecurity threats. Sectors like healthcare, finance, energy and transportation are all regularly widening their digital infrastructure, resulting in larger attack surfaces and greater risk exposure.Kaspersky just released their ICS CERT Predictions for this year, outlining the key cybersecurity challenges industrial enterprises will face in the year ahead. The forecasts emphasize the persistent nature of ransomware threats, the increasing prevalence of cosmopolitical hacktivism, insights…

How I got started: Ransomware negotiator

4 min read - Specialized roles in cybersecurity are proliferating, which isn’t surprising given the evolving threat landscape and the devastating impact of ransomware on many businesses.Among these roles, ransomware negotiators are becoming more and more crucial. These negotiators operate on the front lines of cyber defense, engaging directly with cyber criminals to mitigate the impact of ransomware attacks on organizations.Ransomware negotiators possess a unique blend of technical expertise, psychological insight and negotiation skills that allow them to navigate the high-stakes environment of ransomware…

The UK energy sector faces an expanding OT threat landscape

3 min read - Critical infrastructure is under attack in almost every country, but especially in the United Kingdom. The UK was the most attacked country in Europe, which is already the region most impacted by cyber incidents. The energy industry is taking the brunt of those cyberattacks, according to IBM’s X-Force Threat Intelligence Index 2024.The energy sector is a favorite target for threat actors. The complexity of systems and the reliance on legacy OT systems make them easy prey. Because of the critical…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today