Bethesda, Md. – Threat hunting is becoming an integral part of defensive activities in larger enterprises or those that have been heavily targeted in the past, according to a new SANS Survey. Yet, findings also show that threat hunting is still an immature practice that relies mostly on human intuition to conduct the searches.
SANS defines threat hunting as a focused and iterative approach to search out, identify and understand adversaries that have entered the defender's networks. Hunting should be proactive, yet 43% of respondents say their hunts are triggered by an event or a hunch, and 5% of respondents don't know what triggers their hunts. The remainder are either monitoring continuously (which SANS recommends) or on a regular schedule, such as once a week.
"Threat Hunting is new to most organizations and demonstrates that it has had a positive effect on reducing attacker dwell time for those organizations that conduct hunts regularly," says the survey's author, Rob Lee, SANS fellow and curriculum lead author for the SANS Incident Response and Forensics training courses.
In the survey, 60% of those who hunt for threats reported measurable improvements in their InfoSec programs based on their hunting efforts, and 91% report improvements in speed and accuracy of response.
Staffing and skills remain problematic for organizations trying to fill threat hunting positions, with only 31% of organizations designating a program for threat hunting with assigned staff. Log analysis, knowledge of the network, threat analysis, incident response and forensics are all sought-after skills for developing threat hunting programs.
Skills--and tools--also need to mature to improve data search, connect the dots between information sources, investigate and conduct the searches, according to responses.
"The survey benefits our industry by showing that most organizations are new to hunting efforts," Lee concludes. "It is also a gut check for those organizations not yet starting to incorporate hunting into their security operations."
Results will be discussed at the SANS Threat Hunting and Incident Response Summit, April 18-19 in New Orleans. Link here: www.sans.org/threat-hunting-and-incident-response-summit-2017
Following the summit, full results of the survey will be shared during a two-part webcast aired live Wednesday, April 26 and Thursday, April 27 at 1 PM EDT. The webcasts, hosted by SANS, are sponsored by Anomali, DomainTools, Malwarebytes, Rapid7, Sqrrl and ThreatConnect. Register to attend the webcasts at www.sans.org/webcasts/103767 and www.sans.org/webcasts/103772.
Those who attend the webcasts receive early access to the associated whitepaper, which will be posted and available at www.sans.org/reading-room/whitepapers/analyst after the live webcasts.
TWEET THIS!
Hunting for threats: Results of SANS Survey released 4/26 and 4/27 | www.sans.org/webcasts/103767 and www.sans.org/webcasts/103772
Ready, aim, fire: SANS Threat Hunting Survey results revealed 4/26 and 27 | www.sans.org/webcasts/103767 and www.sans.org/webcasts/103772
Continuous threat hunting improves security and response; SANS survey released 4/26 and 27 | www.sans.org/webcasts/103767 and www.sans.org/webcasts/103772
About SANS Institute
The SANS Institute was established in 1989 as a cooperative research and education organization. Today, SANS is the most trusted and, by far, the largest provider of cyber security training and certification to professionals in government and commercial institutions world-wide. Renowned SANS instructors teach more than 60 courses at in-person and virtual cyber security training events and on demand. GIAC, an affiliate of the SANS Institute, validates practitioner skills through more than 35 hands-on, technical certifications in cyber security. The SANS Technology Institute, a regionally accredited independent subsidiary, offers a master’s degree, graduate certificates, and an undergraduate certificate in cyber security. SANS Security Awareness, a division of SANS, provides organizations with a complete and comprehensive security awareness solution, enabling them to easily and effectively manage their ‘human’ cybersecurity risk. SANS also delivers a wide variety of free resources to the InfoSec community including consensus projects, research reports, webcasts, podcasts, and newsletters; it also operates the Internet's early warning system–the Internet Storm Center. At the heart of SANS are the many security practitioners, representing varied global organizations from corporations to universities, working together to support and educate the global information security community. (https://www.sans.org)