The cyber threat hunter role is becoming increasingly important in the modern enterprise, as companies strive to stay ahead of the latest threats and implement rapid response to mitigate potential damage resulting from cyber attacks. Here’s a look at what cyber threat hunters do, the responsibilities of the role, skills and qualifications, and more.

The video clip below is taken from our webinar, The Real World of Cyber Threat Hunting, and will help you understand the basics of threat hunting. Watch the full webinar here.

Definition of a Cyber Threat Hunter

Cyber threat hunters are information security professionals who proactively and iteratively detect, isolate, and neutralize advanced threats that evade automated security solutions. Cyber threat hunters constitute an integral part of the rapidly growing cyber threat intelligence industry. Their employment gives companies a competitive edge as opposed to using traditional rule or signature-based detection methods.

Responsibilities of a Cyber Threat Hunter

Security experts use the 80/20 principle to assess cyber threats. Eighty percent (80%) of cyber threats are unsophisticated and can be mitigated with good security hygiene, while the remaining twenty percent (20%) tend to be more advanced threats. Still, about half of these advanced attacks can be successfully addressed with different blocking and tackling techniques.

The other half of advanced attacks constitutes the top 10% of cyber threats. These highly advanced threats cannot be detected solely with programmatic solutions. Cyber threat hunters aim to sniff out these highly advanced cyber threats. Their job is to track and neutralize adversaries who cannot be caught with other methods. The threats they hunt for can be posed by either an insider, such as an employee of the organization, or an outsider, such as an organized crime group.

However, it’s not the job of the cyber threat hunter to address incidents that have already happened, although they may work together with insider response teams. Instead, they search for cyber threats hiding in the noise before the attack could happen. Once potential threats are identified, cyber threat hunters gather as much information on the behavior, goals, and methods of the adversaries as possible. They also organize and analyze the collected data to determine trends in the security environment of the organization, make predictions for the future, and eliminate current vulnerabilities.

Cyber Threat Hunter Tools and Techniques

Instead of trying to infiltrate the environment from the outside as it happens during penetration testing, cyber threat hunters work with the assumption that adversaries are already in the system. They carefully analyze the whole environment, use behavioral analysis and a hypothesis-driven approach to find unusual behavior that may indicate the presence of malicious activity.

Cyber threat hunters work with a plethora of software and tools to track down adversaries and identify suspicious activities. A few of the most common tools and solutions leveraged by cyber threat hunters include:

● Security Monitoring Tools - Cyber threat hunters work with all kinds of security monitoring solutions such as firewalls, antivirus software, network security monitoring, data loss prevention, network intrusion detection, insider threat detection, and other security tools. Besides monitoring the network at the organizational-level, they also examine endpoint data. They gather event logs from as many places as possible, as their work requires a sufficient amount of security data.
● SIEM Solutions - Security Information and Event Management (SIEM) solutions gather internal structured data within the environment and provide a real-time analysis of security alerts from within the network. Basically, they turn raw security data into meaningful analysis. SIEM tools don’t only help manage the huge amount of data logs hunter work with, but also make it possible to find correlations which can reveal hidden security threats.
● Analytics Tools - Cyber threat hunters work with two kinds of analytics tools: statistical and intelligence analysis software. Statistical analysis tools, such as SAS programs, use mathematical patterns instead of pre-defined rules to find odd behavior and anomalies in the data. Intelligence analytics software visualizes relational data and provide security professionals with interactive graphs, charts, and other data illustrations. They make it possible to discover hidden connections and correlations between different entities and properties in the environment.