'Threat Hunting' On The Rise

Rather than simply waiting for the inevitable data breach to happen, many organizations say they have begun more actively scouting around for and chasing down bad actors and malicious activity on their networks.

Unlike the usual security approaches, threat hunting -- as some of the industry have taken to calling the trend -- combines the use of threat intelligence, analytics, and security tools with old-fashioned human smarts.

Eighty six percent of respondents in a recent SANS Institute survey of 494 IT professionals said their organizations were engaged in such activity. About 75% said they had reduced their attack surface as a result of more aggressive threat-hunting while 59% credited the approach for enhancing incident response speed and accuracy.

All of this despite the fact that four in 10 did not have a formal threat-hunting program in place, and fewer still had any kind of repeatable process for hunting down threats.

The survey results suggest that while organizations are benefiting from a more aggressive stance, many are still trying to figure out what a formal threat-hunting program needs to look like and how to attract the skills needed to make it work.

“Threat hunting plays a critical role in early detection of an adversary, as well as faster removal and repair of vulnerabilities uncovered during the hunt,” the SANS report noted.  But the results also show that “threat hunting is still in its infancy in terms of formal processes and methods,” it said.

Ben Johnson, co-founder and chief security strategist at security vendor Carbon Black, says what separates threat hunting from the usual security practices is its emphasis on human skills.

Threat hunting, Johnson says, is about “using humans to find bad versus having an alert fire from a piece of technology.”

The concept is not new, he says. “[But it] is only now hitting the main stream because it’s a sexy buzzword and organizations are tired of the long dwell times of the bad guys.”

The emphasis is on the application of the human mind to seek out activity that hasn’t been flagged yet by various detection technologies. “It’s a more open-ended action where hunches, gut-feelings, and general security and risk-based experience drive individuals to places and activity they should analyze,” he says. 

While tools are important, threat hunting is not specific to any technology nor is it dependent on them. Rather it is about knowing when, where, and what signs to look for. “You might not know who’s going to rob a bank or when, but if you see what appears to be a getaway car sitting outside, that might tip you off to go look for a person with malicious intent inside the bank,” Johnson says.

Gain insight into the latest threats and emerging best practices for managing them. Attend the Security Track at Interop Las Vegas, May 2-6. Register now!

For the most part, the industry has yet to coalesce around a clear definition for threat hunting, notes Tim Helming, director of product management at DomainTools. “But fundamentally, it's about not waiting to observe the effects of an attack.”

Instead, it’s a strategy that begins with the assumption that the organization has been breached, and working backward from there to either detect the source -- or to make sure there isn’t an attack. “If you start from that assumption, you are more likely to find the evidence you're looking for. Threat-hunting teams bring specific expertise to doing that,” he says.

Getting there fully will take some time for the many organizations that say they are engaged in threat hunting. The SANS survey showed that while organizations see the benefit in taking a more aggressive approach to finding threats on their network, few have allocated the necessary resources to make it happen. A majority of the respondents in the survey still rely heavily on known indicators of compromise and manual analysis, for instance, and did not have the level of automation needed to enable a truly robust threat-hunting capability.

Related stories: