Threat hunting still maturing and mostly ad-hoc

Threat hunting is becoming an integral part of defensive activities in larger enterprises or those that have been heavily targeted in the past, according to a new SANS survey. Yet, findings also show that threat hunting is still an immature practice that relies mostly on human intuition to conduct the searches.

SANS defines threat hunting as a focused and iterative approach to search out, identify and understand adversaries that have entered the defender’s networks. Hunting should be proactive, yet 43% of respondents say their hunts are triggered by an event or a hunch, and 5% of respondents don’t know what triggers their hunts. The remainder are either monitoring continuously or on a regular schedule, such as once a week.

“Threat hunting is new to most organizations and demonstrates that it has had a positive effect on reducing attacker dwell time for those organizations that conduct hunts regularly,” says the survey’s author, SANS fellow Rob Lee.

In the survey, 60% of those who hunt for threats reported measurable improvements in their InfoSec programs based on their hunting efforts, and 91% report improvements in speed and accuracy of response.

Staffing and skills remain problematic for organizations trying to fill threat hunting positions, with only 31% of organizations designating a program for threat hunting with assigned staff. Log analysis, knowledge of the network, threat analysis, incident response and forensics are all sought-after skills for developing threat hunting programs.

Skills—and tools—also need to mature to improve data search, connect the dots between information sources, investigate and conduct the searches, according to responses.

“The survey benefits our industry by showing that most organizations are new to hunting efforts,” Lee concludes. “It is also a gut check for those organizations not yet starting to incorporate hunting into their security operations.”