You're reading from The Foundations of Threat Hunting Organize and design effective cyber threat hunts to meet business needs

Product type Paperback

Published in Jun 2022

Publisher Packt

ISBN-13 9781803242996

Length 246 pages

Edition 1st Edition

Concepts

Threat Hunting

Authors (3):

William Copeland

Chad Maurice

Jeremiah Ginn

View More author details

Table of Contents (19) Chapters

Preface

1. Part 1: Preparation – Why and How to Start the Hunting Process

2. Chapter 1: An Introduction to Threat Hunting FREE CHAPTER

3. Chapter 2: Requirements and Motivations

4. Chapter 3: Team Construct

5. Chapter 4: Communication Breakdown

6. Chapter 5: Methodologies

7. Chapter 6: Threat Intelligence

8. Chapter 7: Planning

9. Part 2: Execution – Conducting a Hunt

10. Chapter 8: Defending the Defenders

11. Chapter 9: Hardware and Toolsets

12. Chapter 10: Data Analysis

13. Chapter 11: Documentation

14. Part 3: Recovery – Post-Hunt Activity

15. Chapter 12: Deliverables

16. Chapter 13: Post-Hunt Activity and Maturing a Team

17. Other Books You May Enjoy

Appendix

Internal team communication

Internal team communication tends to be the easiest, by far, for people to understand the requirements for and adhere to. The first step is to identify communication needs for the team, such as applications that provide day-to-day continuity, have the ability to store files, and have encrypted communication with authentication. No team wants to be in the position where their hunt failed due to an adversary monitoring the hunt team's communication in real time.

Chat programs such as Slack, Microsoft Teams, and Rocket.Chat work well for day-to-day communications. If someone stepped out for a moment or if you have teams spread out and working remotely, even if it's within one customer complex, everyone can remain on the same page on the most up-to-date status of the hunt. Additionally, chat programs provide an amazing source of historical context for things that happened earlier in a shift or even the previous week.

Important Note

If anything...

The rest of the chapter is locked

Authors (6)

Maurice

Chad Maurice is a life-long cyber security enthusiast with a background in both offensive and defensive teams. He has led Red Teams in physical and network security tests as well as overseen planning and daily management for numerous Incident Response and Threat Hunting teams that provided defenses for Enterprise networks spanning around the globe. He has earned a Master's degree in Information Systems Security/Information Assurance from Capella University in 2011. Additionally, Chad has achieved an array of industry certifications ranging from OSCP to CISSP. Currently, he is an engineer at a Fortune 100 company enhancing defensive capabilities for all of their business assets.

See other products by Maurice

Chad Maurice

See other products by Chad Maurice

Copeland

William Copeland is a renowned leader and technician within the cyber defense community. He has endeavored the last two decades to clear the path for the operators under his leadership to become more efficient and effective cyber defenders. He earned a Bachelor's degree in Information Technology from Western Governors University in 2018. Additionally, William has accomplished the following certifications: Security+, Linux+, Project+, Network+, GCFA, GPEN, GNFA, GREM, GDAT, GCDA, GSEC, GCIA, GCIH, SSAP, GCFE, and GCTI. Currently, he is a senior leader within a cyber hunting organization providing planning, coordination, integration, and execution of defensive teams that track and eradicate adversaries on customer networks.

See other products by Copeland

Jeremiah Ginn

Jeremiah Ginn is a husband, father, teacher, engineer, architect, author, advocate, and lives a life focused on investing in those that cross his path. Today, he has 3 biological and 6 adopted children, 3 grandchildren, and lives in Northwest Arkansas. A service-disabled veteran, he proudly served in the US Army. He serves today as a Military Veteran Advocate, and a Champion for Children's Adoptive and Foster Care programs across multiple non-profit organizations. Jeremiah leads software-defined networking evangelism efforts across many global customers in their efforts to automate network infrastructure. His technology career has covered 25 years in technology consulting with almost all Fortune 500 companies. His market leadership is in SD-WAN, SASE, NFV, Multi-Tenant Cloud Edge Compute, and Network Infrastructure Architecture and has touched more than 3,000 organizations directly. He is a Scrum Master, Developer, Author, Public Speaker, Educator, and Technology Evangelist. He is an IEEE member as well as a MEF Forum member. Jeremiah has contributed to the development of SDN, SD-WAN, and SASE solutions at AT&T as well as the MEF Forum's SASE W117 working group on SASE Service Attributes and Service Framework.

See other products by Jeremiah Ginn

William Copeland

See other products by William Copeland

Jeremy Thompson

Jeremy Thompson is a tenacious leader and technical expert who has dedicated the last two decades to the profession of cyber security. His background has broadened him from managing infrastructure in support of a large-scale network to directing operations for an organization conducting threat hunts on IT and OT networks around the globe. He earned a Master's degree in Information Systems Management from the University of Nebraska at Omaha in 2014. Additionally, Jeremy has achieved the following certifications: CCNA – Cyber Operations, GSEC, GCFA, GDAT, GFNA, and CISSP. Currently, he is an Incident Response and Operations Manager for CyberDefenses Inc out of Austin, TX.

See other products by Jeremy Thompson

You're reading from The Foundations of Threat Hunting Organize and design effective cyber threat hunts to meet business needs

Table of Contents (19) Chapters

Internal team communication

Unlock this book and the full library FREE for 7 days

Authors (6)

Personalised recommendations for you