| 1 |
In information security, threat hunting is the process of proactively searching for threats against computer systems in order to protect them. This is in contrast to traditional threat management measures, such as firewalls, intrusion detection systems (IDS), malware sandbox (computer security) and SIEM systems, which typically involve an investigation of evidence-based data after there has been a warning of a potential threat. Threat analyst Lesley Carhart stated that there is no consensus amongst practitioners what threat hunting actually entails. |
| 2 |
Overview: Recently, the world has seen a rise in the number and severity of cyber attacks, data breaches, malware infections, and online fraud incidents. According to cyber security and ai company SonicWall, the number of ransomware attacks grew by 105% globally. Major corporations around the world have fallen victim to high-profile data breaches, with the average cost of a data breach now estimated at $4.24 million, according to IBM. |
| 3 |
Cyber threat hunting Methodologies: Threat hunting has traditionally been a manual process, in which a security analyst sifts through various data information using their own knowledge and familiarity with the network to create hypotheses about potential threats, such as, but not limited to, lateral movement by threat actors. To be even more effective and efficient, however, threat hunting can be partially automated, or machine-assisted, as well. In this case, the analyst uses software that leverages machine learning and user and entity behavior analytics (UEBA) to inform the analyst of potential risks. The analyst then investigates these potential risks, tracking suspicious behavior in the network. Thus, hunting is an iterative process, meaning that it must be continuously carried out in a loop, beginning with a hypothesis. |
Комментарии