The Cyber Defense eMagazine November Edition for 2023

A threat hunting program enables faster incident response times. It’s also much easier and cheaper to
go threat hunting than to clean up after a security breach. Here’s how to create one for a business.
1. Establish a Baseline
Before they can establish a threat hunting program, business owners must gain a solid understanding of
what’s typical within their work environment. For example, they should understand the usual employee
behavior, activities and network operations that take place within the company. Establishing a baseline
for what is and isn’t normal is the first step toward identifying outliers.
2. Identify Important Assets
What does the enterprise offer to hackers? What are its most valuable assets a threat actor would want
to target? These will differ from one company to another, but they often include aspects like money or
client data. Identifying them helps establish why a threat hunting program is necessary and what it should
focus on.
3. Define Success
The next important step is to define exactly what the program should achieve. What key performance
indicators (KPIs) can the business use to measure its success?
An example of a KPI is the number of vulnerabilities — specifically those that could’ve installed malware
on the network — the team remediates within a specific timeframe. KPIs should tie directly to the main
goal of finding and blocking threats, and should help set the cybersecurity team up for success.
4. Select a Threat Hunting Strategy
Not every threat hunting program looks the same. A few common strategies include:
• Using the MITRE framework to decide where to start
• Building a minefield under the assumption that a threat actor is already within a network
• Blocking access entirely by building a wall, ensuring anything related to execution and initial
access is blocked
Different strategies address unique needs, so it’s crucial to find the right one for each business.
Cyber Defense eMagazine – November 2023 Edition 112
Copyright © 2023, Cyber Defense Magazine. All rights reserved worldwide.