This is the first installment in a three-part series on threat hunting. Be sure to read Part 2 and Part 3 for more information.

One of the fundamental problems with cybersecurity is that organizations often do not realize when they are compromised. Traditional incident response methods are typically reactive, forcing security teams to wait for a visible sign of an attack. The problem is that many attacks today are stealthy, targeted and data-focused.

Just stop for a moment to ask yourself: How would you know if you were compromised? The typical answer is that you would not detect a compromise until significant damage has already been caused. Security professionals need a more aggressive approach to proactively hunt for threats on their networks.

Listen to the podcast: The Art of Cyber Threat Hunting

What Is Threat Hunting?

Threat hunting is the act of tracking and eliminating cyber adversaries from your network as early as possible. A key tenant of cybersecurity is that prevention is ideal, but detection is a must. In a digital climate that is changing at an incredibly rapid pace, it is unrealistic to believe that your organization will never be compromised. It is impossible to eliminate every threat to your organization, so you must be able to perform early detection and remediation.

Threat hunting offers many benefits, including:

  • Reduction in breaches and breach attempts;
  • A smaller attack surface with fewer attack vectors;
  • Increase in the speed and accuracy of a response; and
  • Measurable improvements in the security of your environment.

Once you understand and accept that you will be or already have been targeted and possibly compromised, you will be able to address security through a more realistic lens.

The next step is outlining what actions you need to take to quickly and proactively defend against malicious activity. This is where threat hunting comes into play. Threat hunting typically involves five steps:

  1. Planning: Identify critical assets.
  2. Detection: Search for known and unknown threats.
  3. Responding: Manage and contain attacks.
  4. Measuring: Gauge the impact of the attack and the success of your security.
  5. Preventing: Be proactive and stay prepared for the next threat.

This process allows you to gain further visibility into your network. The identification of hidden connections, covert channels and many other nefarious network activities provides for a much stronger security posture. Without this visibility into your network, you are essentially wearing a blindfold on a battlefield.

Focusing Your Threat Hunting Program

Today’s cyberthreats are constantly increasing in complexity, specificity and impact. These threats are as advanced as they are persistent. While some organizations do perform some type of threat hunting, the areas of focus and the resources being allocated are often misplaced.

Furthermore, these threat hunting programs are often informal and not repeatable. This means that organizations are still acting reactively to threats. The informality of the threat hunting programs also means that there are no metrics being created to document the success or failure of initiatives, so organizations are creating new processes for each threat they face.

When building a threat hunting program, security leaders should focus on four metrics:

  1. Length of connections;
  2. Amount of data being transferred;
  3. Failed and successful access attempts; and
  4. Number of dropped packets at the firewall.

Attacks that have made recent news were able to breach organizations that were not taking a proactive approach to security. WannaCry, for example, exploited a Windows vulnerability that had been identified over a decade ago. Because the victim organizations had not performed aggressive threat hunting, an erroneous service served as the perfect vector for the attackers. Meanwhile, the EternalRocks malware took advantage of the exact same vulnerability, meaning that many organizations failed to act even after the WannaCry attack.

Modern Attacks Require Enhanced Visibility

Traditional methods of defense revolve around reactive security — waiting for visible signs of a breach and taking appropriate actions in response. Modern attacks are much more advanced and sophisticated. These types of attacks rarely show signs and often go undetected for months or years. Proper threat hunting offers sufficient network visibility to help security professionals detect malicious activity and respond accordingly.

Listen to the podcast: The Art of Cyber Threat Hunting

More from Data Protection

Data Privacy: How the Growing Field of Regulations Impacts Businesses

The proposed rules over artificial intelligence (AI) in the European Union (EU) are a harbinger of things to come. Data privacy laws are becoming more complex and growing in number and relevance. So, businesses that seek to become — and stay — compliant must find a solution that can do more than just respond to current challenges. Take a look at upcoming trends when it comes to data privacy regulations and how to follow them. Today's AI Solutions On April…

Defensive Driving: The Need for EV Cybersecurity Roadmaps

As the U.S. looks to bolster electric vehicle (EV) adoption, a new challenge is on the horizon: cybersecurity. Given the interconnected nature of these vehicles and their reliance on local power grids, they’re not just an alternative option for getting from Point A to Point B. They also offer a new path for network compromise that could put drivers, companies and infrastructure at risk. To help address this issue, the Office of the National Cyber Director (ONCD) recently hosted a…

Why Quantum Computing Capabilities Are Creating Security Vulnerabilities Today

Quantum computing capabilities are already impacting your organization. While data encryption and operational disruption have long troubled Chief Information Security Officers (CISOs), the threat posed by emerging quantum computing capabilities is far more profound and immediate. Indeed, quantum computing poses an existential risk to the classical encryption protocols that enable virtually all digital transactions. Over the next several years, widespread data encryption mechanisms, such as public-key cryptography (PKC), could become vulnerable. Any classically encrypted communication could be wiretapped and is…

How the CCPA is Shaping Other State’s Data Privacy

Privacy laws are nothing new when it comes to modern-day business. However, since the global digitization of data and the sharing economy took off, companies have struggled to keep up with an ever-changing legal landscape while still fulfilling their obligations to protect user data. The challenge is that there is no one-size-fits-all solution regarding data privacy's legal requirements. Depending on the location and jurisdiction, data privacy laws can vary significantly in terms of scope and enforcement. But while the laws…