In an era when organizations realize that it's only a matter of time before they're breached, if they haven't been breached already, a new approach to security has emerged. Called threat hunting, it's based on the assumption that the periphery will be compromised and the only way to either prevent or minimize the damage is to look for the adversary inside the network.
Threat hunting also assumes that manual threat detection hinders a security team's productivity.
For example, one standard approach for detecting attacks entails looking for indicators of compromise. Common IOCs include virus signatures, malignant IP addresses, MD5 hashes of malware files and URLs or domain names linked to botnet command-and-control servers. If any of these are observed on either a network or operating system, a breach has most likely occurred. While basic IOC updates such as signatures and hashes can be routinely fed into an antivirus platform, others require manually building parsing rules into various systems in order to detect an indicator and issue an alert. This leads to organizations constantly trying to catch up with their adversaries. A company’s detection capabilities are only as good as its ability to build IOC-based alert mechanisms.
“It can easily take me an hour to write one simple parsing rule in our SIEM,” a senior security architect in a large pharmaceutical company recently told us. “Only to find out two weeks later that one of the folks in IT changed the configuration of the firewall, breaking the rule and making me re-do the whole work to make the rule operational again. In order to cover our entire international organization we have to maintain over 5,000 rules.”
Building and training an in-house hunting team requires highly talented security analysts and is often ineffective. New automated hunting technologies that use machine learning and big-data analytics address these issues.
Lital is a Marketing Team Leader, Storyteller, Technology Marketing Expert. She joined Cybereason as the first marketing hire and built a full marketing department. Specializing in brand building, product marketing, communication and content. Passionate about building ROI-driven marketing teams.
Combining the Cybereason operations-centric EDR with Nuspire’s top-notch security operations team enables defenders to combat sophisticated and persistent threats to our mutual customer’s organizations...
The Cybereason MalOp (malicious operation) detection engine allowed a single Lenovo analyst to manage up to 200,000 endpoints, almost three times their current network needs...
