Abstract:Cybersecurity is a major challenge for large organizations. Traditional cybersecurity defense is reactive. Cybersecurity operations centers keep out adversaries and incident response teams clean up after break-ins. Recently a proactive stage has been introduced: Cyber Threat Hunting (TH) looks for potential compromises missed by other cyber defenses. TH is mandated for federal executive agencies and government contractors. As threat hunting is a new cybersecurity discipline, most TH teams operate without a defined process. The practices and challenges of TH have not yet been documented. To address this gap, this paper describes the first interview study of threat hunt practitioners. We obtained access and interviewed 11 threat hunters associated with the U.S. government's Department of Homeland Security. Hour-long interviews were conducted. We analyzed the transcripts with process and thematic <a class="link-external link-http" href="http://coding.We" rel="external noopener nofollow">this http URL</a> describe the diversity among their processes, show that their processes differ from the TH processes reported in the literature, and unify our subjects' descriptions into a single TH <a class="link-external link-http" href="http://process.We" rel="external noopener nofollow">this http URL</a> enumerate common TH challenges and solutions according to the subjects. The two most common challenges were difficulty in assessing a Threat Hunter's expertise, and developing and maintaining automation. We conclude with recommendations for TH teams (improve planning, focus on automation, and apprentice new members) and highlight directions for future work (finding a TH process that balances flexibility and formalism, and identifying assessments for TH team performance).

Threat Intelligence: Planning and Direction

Text Classification and Threat Intelligence Generation for Industrial Control System Security

Overview of the Technologies of Threat Intelligence Sensing, Sharing and Analysis in Cyber Space

Cyberthreat-Intelligence Information Sharing: Enhancing Collaborative Security.

Threat Actor Type Inference and Characterization within Cyber Threat Intelligence

Cyber Threat Intelligence Model: An Evaluation of Taxonomies, Sharing Standards, and Ontologies within Cyber Threat Intelligence

Towards Automated Threat Intelligence Fusion

A Cyber Threat Intelligence Management Platform for Industrial Environments

A Threat-Intelligence Driven Methodology to Incorporate Uncertainty in Cyber Risk Analysis and Enhance Decision Making

An Interview Study on Third-Party Cyber Threat Hunting Processes in the U.S. Department of Homeland Security

Integrating Intelligence and Information Sharing in Theater Security Cooperation

Review of Public-Private Partnership of U. S. Cyber Threat Intelligence and Its Enlightenment

Enabling Efficient Cyber Threat Hunting with Cyber Threat Intelligence

Integration of Cyber Threat Intelligence into Security Onion and Malcolm for the use case of industrial networks

The cyber security threat stops in the boardroom

Cyber-All-Intel: An AI for Security related Threat Intelligence

Threat-Informed Cyber Resilience Index: A Probabilistic Quantitative Approach to Measure Defence Effectiveness Against Cyber Attacks

The industrial control system cyber defence triage process

Insight into Insiders and IT: A Survey of Insider Threat Taxonomies, Analysis, Modeling, and Countermeasures

ThreatKG: An AI-Powered System for Automated Open-Source Cyber Threat Intelligence Gathering and Management

A System for Efficiently Hunting for Cyber Threats in Computer Systems Using Threat Intelligence