Bethesda, Md. – Most organizations are involved in threat hunting to some extent, according to results of a new survey to be released by SANS Institute during a two-part webcast on April 14 and April 15.
"Every hour of every day you are either hunting or being hunted," says Eric Cole, PhD, SANS Analyst and network security expert. "The only question you have to ask is which side do you want to be on?"
Nearly 86% of organizations responding to the survey want to be doing the hunting, albeit informally, as more than 40% do not have a formal threat hunting program in place.
"The question is no longer whether or not you are going to have a breach, but how quickly you will detect the adversary to control the overall impact," Cole continues. "Building a hunting program can help your organization reduce the amount of damage from an attack."
Results indicate that hunting is providing benefits. In this survey, 52% who have implemented threat-hunting programs have found previously undetected threats, 74% have reduced attack surfaces, and 59% enhanced speed and accuracy of response by using threat hunting.
Responses indicate that organizations want to realize more benefits from threat hunting and to formalize their programs, with 88% of those respondents who do threat hunting saying their threat-hunting programs need to be improved.
Full results will be shared during a two-part webcast at 1 PM EDT on both Thursday, April 14 and Friday, April 15, sponsored by Carbon Black, DomainTools, Endgame, Hewlett Packard Enterprise, Malwarebytes, and Sqrrl, and hosted by SANS. Register to attend the April 14 webcast, which focuses on what threat hunting is, pitfalls to gaining actionable results and how threat hunting is currently being used at www.sans.org/webcasts/101097 and the April 15 webcast on threat-hunting methodologies and tools at www.sans.org/webcasts/101092.
Those who register for the webcast will also receive access to the published results paper developed by SANS Analyst and network security expert, Eric Cole, PhD.
Tune in for #THREATHUNTING Update - Part 1, APR 14: www.sans.org/u/d50 AND Part 2, APR 15: www.sans.org/u/d5p #infosec
#THREATHUNTING Survey Results Revealed: 4/14 www.sans.org/u/d50 AND 4/15 www.sans.org/u/d5p #infosec #databreach
What R Orgs Doing to Detect Hidden Threats?? Find Out: Pt 1, 4/14: www.sans.org/u/d50 AND Pt 2, 4/15: www.sans.org/u/d5p #infosec
About SANS Institute
The SANS Institute was established in 1989 as a cooperative research and education organization. Today, SANS is the most trusted and, by far, the largest provider of cyber security training and certification to professionals in government and commercial institutions world-wide. Renowned SANS instructors teach more than 60 courses at in-person and virtual cyber security training events and on demand. GIAC, an affiliate of the SANS Institute, validates practitioner skills through more than 35 hands-on, technical certifications in cyber security. The SANS Technology Institute, a regionally accredited independent subsidiary, offers a master’s degree, graduate certificates, and an undergraduate certificate in cyber security. SANS Security Awareness, a division of SANS, provides organizations with a complete and comprehensive security awareness solution, enabling them to easily and effectively manage their ‘human’ cybersecurity risk. SANS also delivers a wide variety of free resources to the InfoSec community including consensus projects, research reports, webcasts, podcasts, and newsletters; it also operates the Internet's early warning system–the Internet Storm Center. At the heart of SANS are the many security practitioners, representing varied global organizations from corporations to universities, working together to support and educate the global information security community. (https://www.sans.org)