Uncovering the Unknown: Proactive, Covert Identification of Evasive Threats

Many companies consider threat hunting valuable, but believe they do not have the in-house resources—expertise, tools, or time—to threat hunt properly.

Unfortunately, these three barriers are deeply interrelated and each one reinforces the others, creating a feedback loop that's tough to break. It looks like this:

1. Security organizations have too many non-integrated point tools that fire alerts, but don't provide the needed context to investigate them.
2. Analysts spend all their time responding to alerts by manually gathering and correlating data from many sources, only for most alerts to end up being false positives, creating discouragement and burnout, and leaving no time for analysts to learn and practice the threat hunting process.
3. Because the security team spends more time practicing alert triage and manual data gathering, they spend less time training on new skills like threat hunting. Security teams that don't have the opportunity to practice new skills end up more and more dependent on tools that fire off alerts.
4. The organization continues to be overwhelmed and hires more analysts to investigate the flood of alerts, or purchases more point tools.
5. Rinse and repeat.

This is a bad cycle, but what incentive do organizations have to make the investment in threat hunting?

How Threat Hunting Can Save Businesses Money

According to Radware's 2018-2019 Global Application and Network Security Report the average cost of a cyber-attack is $1.1 million. Further, the regulatory fines for breaches can reach into the hundreds of millions of dollars.

With the average attack dwell time sitting at around 56 days, according to the FireEye MTrends 2020 report, proactively seeking threats already inside the walls is a clear need. Given these numbers, can your organization afford to skip threat hunting and rely solely on preventative security tools?

Reduce the Frequency and Severity of Successful Data Breaches

Threat hunting helps lower the risk of incurring a costly breach by reducing the frequency and severity of breaches, decreasing attack surface, increasing response speed and accuracy. It checks whether all security tools and policies are working as expected and discovers whether they're letting things through the cracks. The end result is an improved security posture and a greatly reduced risk of a security breach.

Proactive threat hunting allows analysts to unearth previously undetected and potentially unknown threats within an organization. By definition this provides additional security and visibility into an organization's security posture by shining a light on potential security problems that traditional security toolkits may be ill equipped to handle.

Once a new threat is uncovered, the traditional toolkit can often be updated or reconfigured to provide coverage for these newly discovered risks. This closes off potential avenues of attack.

Network Detection & Response Is The Key To Simpler Threat Hunting

ExtraHop Reveal(x) provides a simplified and streamlined threat hunting experience, allowing analysts to rapidly track down and identify malicious behavior. By leveraging full L2-L7 analysis and mapping the interactions between devices on your network, it simplifies the process of finding threats.

ExtraHop Reveal(x) maps device interactions based on protocol, allowing analysts to examine these patterns rapidly:

Finding Threats Other Tools Miss

Advanced threat actors typically design their tools to remove trace evidence—be it logs or file fragments from victim machines. These actions make it harder to identify and stop advanced threats.

Extrahop Reveal(x) sits out of band, monitoring all network traffic in real time and extracting valuable metrics and payload information for long term storage. It doesn't matter what threat actors try to delete, your organization already has a robust transactional record for any investigation.

How Does NDR Make Threat Hunting Simpler?

Ultimately, network detection and response tools provide faster access to richer, more contextualized data, from flows to transactions to packets, in a single UI. Analysts spend less time manually gathering data and less time responding to false alerts, so they can spend more time developing and testing hypotheses.

When evaluating ExtraHop Reveal(x)'s (or any other tool's) threat hunting capabilities, ask yourself these questions:

• How is your organization approaching threat hunting today?
• What are the barriers to creating or expanding your threat hunting capabilities?
• How do you leverage network data in your threat hunting activities?

Want to test out how Reveal(x) gives the context and analysis to make threat hunting simpler? Try our demo, which allows you to explore every feature and workflow using example data.