Threat Hunters Strike Back: Results of SANS Survey Released

BETHESDA, Md., April 17, 2017 /PRNewswire-USNewswire/ -- Threat hunting is becoming an integral part of defensive activities in larger enterprises or those that have been heavily targeted in the past, according to a new SANS Survey. Yet, findings also show that threat hunting is still an immature practice that relies mostly on human intuition to conduct the searches.

SANS defines threat hunting as a focused and iterative approach to search out, identify and understand adversaries that have entered the defender's networks. Hunting should be proactive, yet 43% of respondents say their hunts are triggered by an event or a hunch, and 5% of respondents don't know what triggers their hunts. The remainder are either monitoring continuously (which SANS recommends) or on a regular schedule, such as once a week.

"Threat Hunting is new to most organizations and demonstrates that it has had a positive effect on reducing attacker dwell time for those organizations that conduct hunts regularly," says the survey's author, Rob Lee, SANS fellow and curriculum lead author for the SANS Incident Response and Forensics training courses.

In the survey, 60% of those who hunt for threats reported measurable improvements in their InfoSec programs based on their hunting efforts, and 91% report improvements in speed and accuracy of response.

Staffing and skills remain problematic for organizations trying to fill threat hunting positions, with only 31% of organizations designating a program for threat hunting with assigned staff. Log analysis, knowledge of the network, threat analysis, incident response and forensics are all sought-after skills for developing threat hunting programs.

Skills—and tools—also need to mature to improve data search, connect the dots between information sources, investigate and conduct the searches, according to responses.

"The survey benefits our industry by showing that most organizations are new to hunting efforts," Lee concludes. "It is also a gut check for those organizations not yet starting to incorporate hunting into their security operations."

Results will be discussed at the SANS Threat Hunting and Incident Response Summit, April 18-19 in New Orleans. Link here: www.sans.org/u/rhu

Following the summit, full results of the survey will be shared during a two-part webcast aired live Wednesday, April 26 and Thursday, April 27 at 1 PM EDT. The webcasts, hosted by SANS, are sponsored by Anomali, DomainTools, Malwarebytes, Rapid7, Sqrrl and ThreatConnect. Register to attend the webcasts at www.sans.org/u/rhk and www.sans.org/u/rhp.  

Those who attend the webcasts receive early access to the associated whitepaper, which will be posted and available at www.sans.org/reading-room/whitepapers/analyst after the live webcasts.

TWEET THIS!

Hunting for threats: Results of SANS Survey released 4/26 and 4/27 |
www.sans.org/u/rhJ and www.sans.org/u/rhO

Ready, aim, fire: SANS Threat Hunting Survey results revealed 4/26 and 27 | 
www.sans.org/u/rhJ and www.sans.org/u/rhO

Continuous threat hunting improves security and response; SANS survey released 4/26 and 27 |
www.sans.org/u/rhJ and www.sans.org/u/rhO   

About SANS Institute
The SANS Institute was established in 1989 as a cooperative research and education organization. SANS is the most trusted and, by far, the largest provider of training and certification to professionals at governments and commercial institutions world-wide. Renowned SANS instructors teach over 50 different courses at more than 200 live cyber security training events as well as online. GIAC, an affiliate of the SANS Institute, validates employee qualifications via 30 hands-on, technical certifications in information security. The SANS Technology Institute, a regionally accredited independent subsidiary, offers master's degrees in cyber security. SANS offers a myriad of free resources to the InfoSec community including consensus projects, research reports, and newsletters; it also operates the Internet's early warning system--the Internet Storm Center. At the heart of SANS are the many security practitioners, representing varied global organizations from corporations to universities, working together to help the entire information security community. (www.SANS.org)

SOURCE SANS Institute

Related Links

http://www.sans.org