sans

Threat Hunters Strike Back: Results of SANS Survey Release

SANS Survey Release

Hunting still maturing and mostly ad-hoc, but those who hunt report improvements in security and response

BETHESDA, Md., April 17, 2017 /PRNewswire-USNewswire/ — Threat hunting is becoming an integral part of defensive activities in larger enterprises or those that have been heavily targeted in the past, according to a new SANS Survey. Yet, findings also show that threat hunting is still an immature practice that relies mostly on human intuition to conduct the searches.

SANS defines threat hunting as a focused and iterative approach to search out, identify and understand adversaries that have entered the defender's networks. Hunting should be proactive, yet 43% of respondents say their hunts are triggered by an event or a hunch, and 5% of respondents don't know what triggers their hunts. The remainder are either monitoring continuously (which SANS recommends) or on a regular schedule, such as once a week.

“Threat Hunting is new to most organizations and demonstrates that it has had a positive effect on reducing attacker dwell time for those organizations that conduct hunts regularly,” says the survey's author, Rob Lee, SANS fellow and curriculum lead author for the SANS Incident Response and Forensics training courses.

In the survey, 60% of those who hunt for threats reported measurable improvements in their InfoSec programs based on their hunting efforts, and 91% report improvements in speed and accuracy of response.

Staffing and skills remain problematic for organizations trying to fill threat hunting positions, with only 31% of organizations designating a program for threat hunting with assigned staff. Log analysis, knowledge of the network, threat analysis, incident response and forensics are all sought-after skills for developing threat hunting programs.

Skills—and tools—also need to mature to improve data search, connect the dots between information sources, investigate and conduct the searches, according to responses.

“The survey benefits our industry by showing that most organizations are new to hunting efforts,” Lee concludes. “It is also a gut check for those organizations not yet starting to incorporate hunting into their security operations.”

Results will be discussed at the SANS Threat Hunting and Incident Response Summit, April 18-19 in New Orleans. Link here: www.sans.org/u/rhu

Following the summit, full results of the survey will be shared during a two-part webcast aired live Wednesday, April 26 and Thursday, April 27 at 1 PM EDT. The webcasts, hosted by SANS, are sponsored by Anomali, DomainTools, Malwarebytes, Rapid7, Sqrrl and ThreatConnect. Register to attend the webcasts at www.sans.org/u/rhk and www.sans.org/u/rhp.

Those who attend the webcasts receive early access to the associated whitepaper, which will be posted and available at www.sans.org/reading-room/whitepapers/analyst after the live webcasts.

About SANS Institute

The SANS Institute was established in 1989 as a cooperative research and education organization. SANS is the most trusted and, by far, the largest provider of training and certification to professionals at governments and commercial institutions world-wide. Renowned SANS instructors teach over 50 different courses at more than 200 live cyber security training events as well as online. GIAC, an affiliate of the SANS Institute, validates employee qualifications via 30 hands-on, technical certifications in information security. The SANS Technology Institute, a regionally accredited independent subsidiary, offers master's degrees in cyber security. SANS offers a myriad of free resources to the InfoSec community including consensus projects, research reports, and newsletters; it also operates the Internet's early warning system–the Internet Storm Center. At the heart of SANS are the many security practitioners, representing varied global organizations from corporations to universities, working together to help the entire information security community. (www.SANS.org)

CloudBuzz

The latest in curated technology related news collected from many of the leading news distribution, industry research and technology vendor firms on the planet.

Here you will find recent news sources from companies such as Reuters, Marketwired, IDC, Gartner or directly from cloud vendors such as Google, Microsoft or Amazon.

CONTRIBUTORS

How Big Data Can Empower Native Ads

How Big Data Can Empower Native Ads

Empower Native Ads The realm of big data is expanding an astonishing rate, and its presence can be felt across ...
The Five Rules of Security and Compliance in the Public Cloud Era

The Five Rules of Security and Compliance in the Public Cloud Era

Security and Compliance  With technology at the heart of businesses today, IT systems and data are being targeted by criminals, ...
Cyber Security Tips For Digital Collaboration

Cyber Security Tips For Digital Collaboration

Cyber Security Tips October is National Cyber Security Awareness Month – a joint effort by the Department of Homeland Security ...
10 Ways The Enterprise Can Prevent Data Leaks In The Cloud

10 Ways The Enterprise Can Prevent Data Leaks In The Cloud

Prevent Data Leaks In The Cloud More companies are turning to the cloud for storage. In fact, over 60 percent ...
What is shadow IT?

How to Make the Move to the Cloud Securely

Move to the Cloud Securely The 2016 Enterprise Cloud Computing Survey from IDG offers multiple interesting insights concerning the state ...
Cloud-Based or On-Premise ERP Deployment? Find Out

Cloud-Based or On-Premise ERP Deployment? Find Out

ERP Deployment You know how ERP deployment can improve processes within your supply chain, and the things to keep in ...
Bryan Doerr

Cyber-Threats and the Need for Secure Industrial Control Systems

Secure Industrial Control Systems (ICS) Industrial Control Systems (ICS) tend to be “out of sight, out of mind.” These systems ...
What You Need To Know About Choosing A Cloud Service Provider

What You Need To Know About Choosing A Cloud Service Provider

Selecting The Right Cloud Services Provider How to find the right partner for cloud adoption on an enterprise scale The ...
The Rise Of BI Data And How To Use It Effectively

The Rise Of BI Data And How To Use It Effectively

The Rise of BI Data Every few years, a new concept or technological development is introduced that drastically improves the ...
Imminent IoT Eye-Tracking Technologies To Transform The Connected World

Imminent IoT Eye-Tracking Technologies To Transform The Connected World

IoT Eye Tracking Smelling may be the first of the perceptible senses, but the eye is the fastest moving organ ...

NEWS

email as a service

Google Data Analysis, Artificial Intelligence and Predicting Vaccine Scares

Social media trends can predict tipping points in vaccine scares Analyzing trends on Twitter and Google can help predict vaccine ...
Deloitte TMT Predictions: Machine Learning Deployments, On-Demand Content and Live Events Will Continue to Drive Growth

Deloitte TMT Predictions: Machine Learning Deployments, On-Demand Content and Live Events Will Continue to Drive Growth

NEW YORK, Dec. 12, 2017 /PRNewswire/ -- Deloitte forecasts double digital growth in machine learning deployments for the enterprise, an increasing worldwide ...
Hackers shut down infrastructure safety system in attack: FireEye

Hackers shut down infrastructure safety system in attack: FireEye

Hackers shut down infrastructure safety system (Reuters) - Hackers likely working for a nation-state recently penetrated the safety system of ...