Cyber Threat Hunting

Let’s Define Cyber Threat Hunting

For companies that are ready to take on a more proactive approach to cyber security – one that attempts to stop attacks before they get too deep – adding threat hunting to their security program is the next logical step.

After solidifying their endpoint security and incident response strategies to mitigate the known malware attacks that are inevitable today, organizations can then start to go on the offensive. They are ready to dig deep and find what hasn’t yet been detected – and that’s exactly the purpose of threat hunting.

Threat hunting is an aggressive tactic that works from the premise of “assumption of breach;” that attackers are already inside an organization’s network and are covertly monitoring and moving throughout it. This may seem far fetched, but in reality, attackers may be inside a network for days, weeks and even months on end, preparing and executing attacks such as advanced persistent threats, without any automated defense detecting their presence. Threat hunting stops these attacks by seeking out covert indicators of compromise (IOCs) so they can be mitigated before any attacks achieve their objectives.

The Key Elements of Threat Hunting

The goal of threat hunting is to monitor everyday activities and traffic across the network and investigate possible anomalies to find any yet-to-be-discovered malicious activities that could lead to a full blown breach. To achieve this level of early detection, threat hunting incorporates four equally important components:

• Methodology. To be successful at threat hunting, companies must commit to a proactive, full-time approach that is ongoing and ever-evolving. A reactive, ad hoc, “when we have time” perspective will be self-defeating and net only minimal results.
  
  
• Technology. Most companies already have comprehensive endpoint security solutions with automated detection in place. Threat hunting works in addition to these and adds advanced technologies to find anomalies, unusual patterns, and other traces of attackers that shouldn’t be in systems and files. New cloud-native endpoint protection platform (EPP)s that leverage big data analytics can capture and analyze large volumes of unfiltered endpoint data, while behavioral analytics and artificial intelligence can provide extensive, high-speed visibility into malicious behaviors that seem normal on the outset.
  
  
• Highly skilled, dedicated personnel. Threat hunters, or cybersecurity threat analysts, are a breed of their own. These experts not only know how to use the security technology mentioned, but they also combine a relentless aspiration to go on the offensive with intuitive problem-solving forensic capabilities to uncover and mitigate hidden threats.
  
  
• Threat intelligence. Having access to evidence-based global intelligence from experts around the world further enhances and expedites the hunt for already existing IOCs. Hunters are aided by information such as attack classifications for malware and threat group identification, as well as advanced threat indicators that can help zero in on malicious IOCs.
  
  

Research from the 2018 Threat Hunting Report from Crowd Research Partners confirms the importance of these threat hunting capabilities. When asked to rank the most important capability the survey found:

69% chose threat intelligence

57% chose behavior analytics

56% chose automatic detection

54% chose machine learning and automated analytics

A Profile of a Prolific Threat Hunter

Threat hunters look for attackers that get in under the radar, through vulnerabilities a company may not even know exists. These attackers spend considerable amounts of time planning and performing reconnaissance, only acting when they know they can successfully penetrate the network without notice. They also plant and build malware that has yet to been recognized, or use techniques that don’t rely on malware at all, to set themselves up with a persistent base from which to attack.

So what does it take to outsmart even the smartest attackers?

Cyber threat hunters are relentless and able to find even the most minute trace of what cyber attackers leave behind.

Threat hunters use their highly tuned skills to zero in on the slight changes that occur as the attackers make their moves inside a system or file.

The best threat hunters rely on their instincts to sniff out the most nefarious attacker’s stealth moves.

VMware Security Products and Solutions