Analytics

5/31/2018
04:00 PM
Connect Directly
Twitter
LinkedIn
Google+
RSS
E-Mail
50%
50%

Building Blocks for a Threat Hunting Program

Guidance for businesses building threat intelligence strategies while overwhelmed by threats, lack of talent, and a healthy dose of skepticism about the market.

The number and severity of cyberattacks are sending businesses scrambling to figure out their threat intelligence strategies: how to collect threat data, organize it into actionable information, prioritize the most severe threats, and address the biggest problems.

Threat intelligence is among the hottest buzzwords in cybersecurity today, and with good reason. As attacks become more severe, frequent, and complex, businesses struggle to detect and mitigate them with limited resources. New platforms promise artificial intelligence to pick up the slack by processing alerts, freeing up employees for focus on more complex tasks.

In the past, threat intel has meant a tactical feed of malicious IP addresses feeding into the security operations center (SOC) with little context or relation to the business. Now, it means feeds of domains, hashes, and IP address related to malicious activity, with threat intelligence platforms attempting to organize them. These platforms aim to supplement existing tech like SIEMs, IPS systems, and firewalls.

But the infosec community isn't fully sold. A recent study by the Ponemon Institute found 70% of security professionals surveyed think threat intelligence is too overwhelming or intricate to offer usable insight. Only 27% report their organization is "very effective" in using threat data to detect threats; only 31% of board and C-level members receive intelligence on security issues.

Part of the appeal of threat intelligence platforms is they're intended to perform the function of a tier-one SOC analyst, someone who is normally responsible for clicking through alerts generated by firewalls, IDS/IPS, SIEM, and endpoint security tools and gauging their intensity. This ideally gives employees more time to focus on mitigating advanced threats.

The problem is there are precious few people who know what to do with threat intelligence once they have it, and they don't come cheap. Even companies with generous security budgets have to figure out how to hire these employees and keep them on board. Corporate giants struggle with these issues because they lack sufficient resources, says JASK CEO Greg Martin.

"You don't have to have ten years of experience to be a threat hunter, but you have to have the aptitude, you have to know what you're doing to be effective in this space," says Martin. "Only the best companies in the world have true threat-hunting teams internally."

Building a Threat Management Program

"I think a lot of people approach threat hunting in the wrong way," says Alert Logic principal analyst Matt Downing, who shares a few pointers for building a threat management strategy. He, of course, starts with people.

"You have to allocate manpower," he emphasizes, adding that companies should form a team for this if they don't already have one. "You need an experienced staff to go in and look at this … have you seen threats, seen how attackers operate."

The most popular threat hunting skills for security pros include threat intelligence (69%), user and entity behavior analytics (57%), automatic detection (56%), and machine learning and automated analytics (55%), Alert Logic discovered in a recent survey.

Next, he advises reading through publicly reported incidents and asking whether it would happen to your company. Alert Logic does a lot of network inspection, he explains, and specifically focuses on endpoints. No matter how sophisticated and fancy the attacker is, they need to communicate with the target machine, he explains.

When asked about the biggest challenge in threat hunting, Downing says a major obstacle is lack of knowledge about what attacks look like. Threat management challenges include detecting advanced threats (55%) and lack of security expertise (43%).

"Part of it is understanding what people do normally," he continues. "You have to understand what's benign if you're going to understand what's malicious." By taking this approach and looking at the tactics, processes, and tools used in an attack, you get an end-to-end story of detection that can serve as a blueprint for pinpointing future threats.

New Approaches to Threat Hunting

What if you don't have the manpower in-house? In an effort to mitigate challenges for short-staffed companies, JASK launched a service called Special Ops. The idea can be summed up as Threat Hunting-as-a-Service: JASK supplements clients' existing security staff with its "Special Ops" team, which has threat analysts and researchers poached from Palo Alto Networks, Dell SecureWorks, and RSA FirstWatch.

The role of SpecialOps is to detect threats, help analysts identify what they should care about, and provide guidance for next steps. If JASK analysts detect an anomaly, they alert the company. From there, they escalate internally with the team and, if necessary, connect them with law enforcement or a partner like CrowdStrike or Mandiant to pursue an investigation.

"A lot of organizations come to us because they don't have the resources," he explains.

With talent expensive and hard to find, this service puts skilled analysts in one place so companies from enterprises to SMBs have them on-call. Instead of digging through the data themselves, or relying on software, they have a means of leveraging human talent to weed out threats. More than three-quarters (76%) of Alert Logic respondents say not enough time is spent searching for emerging and complex threats in the SOC. 

"We used to kill ourselves looking for the needle in the haystack," Martin notes. "We have a big stack of needles, now we need to find out which is the sharpest."

Related Content:

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance & Technology, where she covered financial ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
The Year in Security 2018
This Dark Reading Tech Digest explores the biggest news stories of 2018 that shaped the cybersecurity landscape.
Flash Poll
How Enterprises Are Attacking the Cybersecurity Problem
How Enterprises Are Attacking the Cybersecurity Problem
Data breach fears and the need to comply with regulations such as GDPR are two major drivers increased spending on security products and technologies. But other factors are contributing to the trend as well. Find out more about how enterprises are attacking the cybersecurity problem by reading our report today.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-6691
PUBLISHED: 2019-01-23
phpwind 9.0.2.170426 UTF8 allows SQL Injection via the admin.php?m=backup&c=backup&a=doback tabledb[] parameter, related to the "--backup database" option.
CVE-2018-19019
PUBLISHED: 2019-01-22
A type confusion vulnerability exists when processing project files in CX-Supervisor (Versions 3.42 and prior). An attacker could use a specially crafted project file to exploit and execute code under the privileges of the application.
CVE-2019-6260
PUBLISHED: 2019-01-22
The ASPEED ast2400 and ast2500 Baseband Management Controller (BMC) hardware and firmware implement Advanced High-performance Bus (AHB) bridges, which allow arbitrary read and write access to the BMC's physical address space from the host (or from the network in unusual cases where the BMC console u...
CVE-2018-19011
PUBLISHED: 2019-01-22
CX-Supervisor (Versions 3.42 and prior) can execute code that has been injected into a project file. An attacker could exploit this to execute code under the privileges of the application.
CVE-2018-19013
PUBLISHED: 2019-01-22
An attacker could inject commands to delete files and/or delete the contents of a file on CX-Supervisor (Versions 3.42 and prior) through a specially crafted project file.