The prevalence of cybercrime and the constant threat of intrusion into company networks has created a new role in many large enterprises – that of the threat hunter.
Threat hunting is becoming an integral part of defensive activities in larger enterprises or those that have been heavily targeted in the past, according to a new SANS Survey. But these findings also show that threat hunting is still an immature practice, relying mostly on human intuition to conduct searches.
SANS defines threat hunting as a focused and iterative approach to search out, identify and understand adversaries that have entered the defender’s networks. Hunting needs to be proactive to be effective, however 43% of respondents say their hunts are triggered by an event or perhaps by a hunch, and 5% of respondents could not define exactly what triggers their hunts. The remainder are either monitoring continuously, which is what is recommended, or on a regular schedule, such as once a week.
“Threat Hunting is new to most organizations and demonstrates that it has had a positive effect on reducing attacker dwell time for those organizations that conduct hunts regularly,” says the survey’s author, Rob Lee, SANS fellow and curriculum lead author for the SANS Incident Response and Forensics training courses.
In the survey, 60% of those who hunt for threats reported measurable improvements in their InfoSec programs based on their hunting efforts, and 91% report improvements in speed and accuracy of response.
The staffing and skills that are required for this task remain problematic for organizations trying to fill threat hunting positions, with only 31% of organizations designating a program for threat hunting with assigned staff. Log analysis, knowledge of the network, threat analysis, incident response and forensics are all sought-after skills for developing threat hunting programs.
Skills—and tools—also need to mature to improve data searching, connect the dots between information sources, investigate and conduct the searches, according to respondants.
“The survey benefits our industry by showing that most organizations are new to hunting efforts,” Lee concludes. “It is also a gut check for those organizations not yet starting to incorporate hunting into their security operations.”
Results will be discussed at the SANS Threat Hunting and Incident Response Summit, April 18-19 in New Orleans.
Following the summit, the full results of the survey will be shared during a two-part webcast aired live Wednesday, April 26 and Thursday, April 27 at 1 PM EDT. The webcasts, hosted by SANS, are sponsored by Anomali, DomainTools, Malwarebytes, Rapid7 and ThreatConnect. Register to attend the webcasts at www.sans.org/u/rhk and www.sans.org/u/rhp.
Anyone attending the webcasts receive early access to the associated whitepaper, which will be posted and available at www.sans.org/reading-room/whitepapers/analyst after the live webcasts.
What is Threat Hunting?
Threat hunting is becoming an integral part of defensive activities in larger enterprises or those that have been heavily targeted in the past. SANS defines threat hunting as a focused and iterative approach to search out, identify and understand adversaries that have entered the defender’s networks. Hunting needs to be proactive to be effective, however 43% of respondents say their hunts are triggered by an event or perhaps by a hunch, and 5% of respondents could not define exactly what triggers their hunts.The staffing and skills that are required for this task remain problematic for organizations trying to fill threat hunting positions, with only 31% of organizations designating a program for threat hunting with assigned staff. Skills—and tools—also need to mature to improve data searching, connect the dots between information sources, investigate and conduct the searches, according to respondants.
