(4) Proactive and Focused Threat Hunting Flashcards
What are the main steps to proactive threat hunting?
Establish a hypothesis
profiling threat actors and activities
Threat hunting tactics
Reducing the attack surface area
Bundling critical assets into groups and protection zones
Understanding, assessing, and addressing attack vectors or the means by which an attack can be conducted
During proactive threat hunting, what does reducing the attack surface area do for the org?
Reducing the attack surface area allows resources to be focused on the remaining surface area, which makes protecting the org easier
During the threat hunting process, what does bundling critical assets into groups and protection zones do for the org?
Bundling critical assets into groups and protection zones helps with managing the attack surface area, threat hunting, and response activities, since each asset doesn’t need to be assessed on its own or managed as specific item
During proactive threat hunting, what do we need to remember about understanding, assessing, and addressing attack vectors or the means by which an attack can be conducted?
We need to make sure that this process has to be based on analysis of threat actors and their techniques as well as the surface area that threat actors can focus on
During proactive threat hunting, what is involved in the integrated intelligence step?
This process brings multiple intelligence sources together to give a more complete picture of threats
During the proactive threat hunting process, what is to be remembered about improving detection capabilities
Detection capabilities must be improved nonstop as new threats will beat old protective measures
Threat hunting needs to be focused, what do we need to remember about configurations?
Configurations and misconfigurations can lead to compromise or it can appear as if an attacker has changed the settings
When focusing threat hunting, what do we need to remember about isolated networks?
Threat hunting in isolated networks are easier because traffic should be understood, but they should be understood by having centrally managed tools and capabilities involved to protect and understand the traffic that goes through these networks
When it comes to focused threat hunting, what needs to be remembered about business critical assets?
Business critical assets and processes are focused on because they are very important. Threat hunters focus on these because the organizational risk profile. It is important to make sure that business critical assets remain secure
