Module eight, network security assessment, techniques and tools.
Our first topic of discussion is going to be threat hunting, which simply stated is
finding things that have made their way past your initial lines of defense
or initial security and found their way under the network.
So proactive, an iterative approach of finding and isolating cyber threats that
have entered a network by evading the current security systems.
It's a five step process that starts off by forming a hypothesis,
which is making assumptions using tactics, techniques, and procedures.
Collecting and processing, collecting and analyzing data using threat intelligence.
We're going to look at various sources of threat intelligence.
Trigger. Based on the hypothesis,
threat detection tools trigger the detection of an anomaly.
That leads to investigation, investigating
malicious files activities to eliminate the identified threats,
and then finally, response, generate a report for future detection.
Types of threat hunting.
Just really quickly, you have data driven,
you have intel driven, entity driven, TTP driven, and hybrid hunting.
We're not going to really break apart
these too much right now, but there are five different categories or types of
threat hunting, and you can read up more on those if you like.
We're just doing the basic concepts and the overview.
The threat hunting also has a maturity model.
We've mentioned maturity models before, and they deal with whether or not we
proceed in a chaotic or ad hoc fashion or a formal methodical measured and improved
type of scenario, which is typically the higher levels of the maturity model.
Just really quickly, the levels, we have a five level model.
Level zero is initial.
Low data collection primarily depends on automated monitoring systems and alerts.
Okay, level one is Minimal, follows the latest threat reports,
moderate to high level routine data collection.
Level two adopts data analysis procedures
created by users, high to very high level routine data collection.
Level three creates custom analysis
procedures, high to very high level routine data collection.
Finally, level four, leading, automates existing data analysis
procedures, high to very high level routine data collection.
Some threat hunting considerations.
First off, intelligence fusion is an approach to integrate security with
threat intelligence and other cyber intelligence sources.
More often than not, you're going to be pulling these from multiple sources.
The intelligence fusion is the combination of all the sources.
Threat feeds, real time feeds collected from real time attacks.
They include indicators of compromise,
IOAs, special threats, vulnerabilities, and existing risks.
Advisors and bulletins.
Informative blogs or websites that provide
information about the latest security threats and attacks.
Then maneuvering is a technique used in cyber warfare based on knowledge of some
recent attacks and the nature of those attacks.
We're pulling this information from the
field, from various sources, from personal experience.
Again, the whole fusion is compiling everything into one package.