Download as PDF, PPTX
Uploaded byProtectWise
Building a Threat Hunting Practice in the Cloud
The document discusses building a threat hunting practice in the cloud, emphasizing the importance of being proactive in identifying unknown threats rather than just reacting to known ones. It outlines components necessary for effective threat hunting, including data collection, context, and analytics capabilities offered by cloud technology. Best practices for threat hunting and a call to action for continuous learning and collaboration are highlighted.
More Related Content
Similar to Building a Threat Hunting Practice in the Cloud
Building a Threat Hunting Practice in the Cloud
- 1. BUILDING A THREAT HUNTINGPRACTICE IN THE CLOUD March 22, 2017
- 2. 2 James Condon Director ofThreat Research and Analysis ProtectWise Tom Hegel Senior Threat Researcher ProtectWise TODAY’S SPEAKERS
- 3. 3 • Threat Hunting101 • Requirements for Effective Threat Hunting • How the Cloud Can Help • Threat Hunting Best Practices • Questions • Next Steps TODAY’S AGENDA
- 4. 4 THREAT HUNTING 101 Followinganomalous behavior when or where it occurs to confirm whether it was an actual, active attack. Detection Catch and respond to known threats. vs. Hunting Identify detection gaps and unknown threats. Prevent future incidents.
- 5. 5 WHY HUNT FORTHREATS? Be More Proactive Catch What is Unknown and New Increased Team Skill, More Fun
- 6.
- 7. Maturity Capability Best practice detection and blocking(AV, Firewall, SIEMs, etc.) Advanced detection with limited response capability Detection and response automation, correlation across tools Hunting, long-term data collection, retrospective forensic capabilities 7 HOW MATURE IS YOUR TEAM?
- 8. 8 BEFORE YOU BEGIN MasterDetection and Response Correlate Activity Between Tools Automate As Much As Possible Detect on Quality Over Quantity
- 9. 9 REQUIREMENTS FOR EFFECTIVETHREAT HUNTING SearchIndexExtractStoreCapture Collect the Right Data Understand the Landscape
- 10.
- 11. HOW THE CLOUDCAN HELP 11 What do you get? ● Comprehensive context ● Continuous analysis ● Pervasive visibility Insight & Intelligence What does it give you? ● Unlimited storage ● Advanced analytics capabilities ● Unified haystack Scale & Power
- 12. 12 DETECTION VS. HUNTINGLOOPS Hunting is Proactive 1. Hypothesize 2. Test 3. Identify 4. Formalize Detection is Reactive 1. Activity observed 2. Engagement 3. Learn 4. Activity resolved 5. Tune Detection
- 13. ● Foster aninvestigative mindset ● Develop and pursue leads ● Gather evidence ● Keep asking questions ● Avoid confirmation bias ● Avoid tunnel vision 13 THREAT HUNTING BEST PRACTICES
- 14. 14 THE REALITY OFHUNTING AT SCALE ● Not always about an APT ● Embrace the analyst mindset ● Expand your knowledge ● Share and grow together ● Look beyond InfoSec rockstars
- 15. Differences between malicious &legitimate HTTP requests • Small number of headers • Headers out of order • Unusual or small User-Agents 15 MALICIOUS HTTP REQUEST EXAMPLES
- 16. QUICK RECAP 16 A greatthreat hunting practice... • … acts proactively (hunting), not reactively (detection). • … collects the right data, and know your landscape • … relies on the cloud for scalability and power you need. • … follows best practices, they make you more effective. • … is realistic about outcomes and results.
- 17.
- 18. 18 NEXT STEPS • We’llbe sending you a copy of our whitepaper “A Comprehensive Start-Up Guide for Proactive Threat Hunting Across Time.” • Questions? Email sales@protectwise.com
- 19.