Discovering U.S. Government Threat Hunting Processes And Improvements

Description

<p><strong>INTRODUCTION:</strong> Cyber Threat Hunting (TH) is the activity of looking for potential</p>
<p>compromises that other cyber defenses may have missed. These compromises cost organiza-</p>
<p>tions an estimated $10M each and an effective Threat Hunt can reduce this cost. TH is a</p>
<p>new discipline and processes have not yet been standardized. Most TH teams operate with</p>
<p>no defined process. This is a problem as repeatable processes are important for a mature</p>
<p>TH team.</p>
<p><strong>OBJECTIVES:</strong> This thesis offers a Threat Hunt process as well as lessons learned</p>
<p>derived from government TH practice.</p>
<p><strong>METHODS:</strong> To achieve this I conducted 12 interviews, 1 hour in length, with govern-</p>
<p>ment threat hunters. The transcripts of these interviews were analyzed with process and</p>
<p>thematic coding. The coding was validated with a second reviewer.</p>
<p><strong>RESULTS:</strong> I present a novel TH process depicting the process followed by government</p>
<p>threat hunters. Common challenges and suggested solutions brought up by threat hunters</p>
<p>were also enumerated and described. The most common problems were minimal automation</p>
<p>and missing measures of TH expertise. Challenges with open questions were also identified.</p>
<p>Open questions include: determining how to identify the best data to collect, how to create</p>
<p>a specific but not rigid process and how to measure and compare the effectiveness of TH pro-</p>
<p>cesses. Finally, subjects also provided features that indicate expertise to TH team members</p>
<p>and recommendations on how to best integrate newer members into a TH team.</p>
<p><strong>CONCLUSION:</strong> This thesis offers a first look at government TH processes. In the short</p>
<p>term, the process recommendations provided in this thesis can be implemented and tested.</p>
<p>In the long term, experiments in this sensitive context remain an open challenge.</p>

Links & Downloads

1. 10.25394/pgs.22677418.v1

Tags

System and network security

Threat Hunting

Cyberspace Operations

Additional Fields

Identifer	oai:union.ndltd.org:purdue.edu/oai:figshare.com:article/22677418
Date	24 April 2023
Creators	William Pierce Maxam III (15339184)
Source Sets	Purdue University
Detected Language	English
Type	Text, Thesis
Rights	CC BY 4.0
Relation	https://figshare.com/articles/thesis/Discovering_U_S_Government_Threat_Hunting_Processes_And_Improvements/22677418