You're reading from The Foundations of Threat Hunting Organize and design effective cyber threat hunts to meet business needs

Product type Paperback

Published in Jun 2022

Publisher Packt

ISBN-13 9781803242996

Length 246 pages

Edition 1st Edition

Concepts

Threat Hunting

Authors (3):

William Copeland

Chad Maurice

Jeremiah Ginn

View More author details

Table of Contents (19) Chapters

Preface

1. Part 1: Preparation – Why and How to Start the Hunting Process

2. Chapter 1: An Introduction to Threat Hunting FREE CHAPTER

3. Chapter 2: Requirements and Motivations

4. Chapter 3: Team Construct

5. Chapter 4: Communication Breakdown

6. Chapter 5: Methodologies

7. Chapter 6: Threat Intelligence

8. Chapter 7: Planning

9. Part 2: Execution – Conducting a Hunt

10. Chapter 8: Defending the Defenders

11. Chapter 9: Hardware and Toolsets

12. Chapter 10: Data Analysis

13. Chapter 11: Documentation

14. Part 3: Recovery – Post-Hunt Activity

15. Chapter 12: Deliverables

16. Chapter 13: Post-Hunt Activity and Maturing a Team

17. Other Books You May Enjoy

Appendix

Chapter 3: Team Construct

When constructing the line-up of a team, the goal is normally to have an effective hunt team that can tackle a specific objective with very little flailing. A team's construct will be unique in each organization and situation. Just as no two threat hunts are exactly the same, no two teams will be exactly the same. They will, however, have some shared fundamental concepts.

Assembling a highly effective hunt team takes time for both the organization and the individuals concerned. Certifications, degrees, and experience are all nice to have; however, they will all mean very little if the people behind them do not have the proper drive or mindset. Always start with personnel that is driven to unravel the puzzles they find in cybersecurity, and go from there. You can build people up into the positions that are needed if they have the proper mindset.

In this chapter, we are going to cover the following topics:

Roles performed within a team

The rest of the chapter is locked

Authors (6)

Maurice

Chad Maurice is a life-long cyber security enthusiast with a background in both offensive and defensive teams. He has led Red Teams in physical and network security tests as well as overseen planning and daily management for numerous Incident Response and Threat Hunting teams that provided defenses for Enterprise networks spanning around the globe. He has earned a Master's degree in Information Systems Security/Information Assurance from Capella University in 2011. Additionally, Chad has achieved an array of industry certifications ranging from OSCP to CISSP. Currently, he is an engineer at a Fortune 100 company enhancing defensive capabilities for all of their business assets.

See other products by Maurice

Chad Maurice

See other products by Chad Maurice

Copeland

William Copeland is a renowned leader and technician within the cyber defense community. He has endeavored the last two decades to clear the path for the operators under his leadership to become more efficient and effective cyber defenders. He earned a Bachelor's degree in Information Technology from Western Governors University in 2018. Additionally, William has accomplished the following certifications: Security+, Linux+, Project+, Network+, GCFA, GPEN, GNFA, GREM, GDAT, GCDA, GSEC, GCIA, GCIH, SSAP, GCFE, and GCTI. Currently, he is a senior leader within a cyber hunting organization providing planning, coordination, integration, and execution of defensive teams that track and eradicate adversaries on customer networks.

See other products by Copeland

Jeremiah Ginn

Jeremiah Ginn is a husband, father, teacher, engineer, architect, author, advocate, and lives a life focused on investing in those that cross his path. Today, he has 3 biological and 6 adopted children, 3 grandchildren, and lives in Northwest Arkansas. A service-disabled veteran, he proudly served in the US Army. He serves today as a Military Veteran Advocate, and a Champion for Children's Adoptive and Foster Care programs across multiple non-profit organizations. Jeremiah leads software-defined networking evangelism efforts across many global customers in their efforts to automate network infrastructure. His technology career has covered 25 years in technology consulting with almost all Fortune 500 companies. His market leadership is in SD-WAN, SASE, NFV, Multi-Tenant Cloud Edge Compute, and Network Infrastructure Architecture and has touched more than 3,000 organizations directly. He is a Scrum Master, Developer, Author, Public Speaker, Educator, and Technology Evangelist. He is an IEEE member as well as a MEF Forum member. Jeremiah has contributed to the development of SDN, SD-WAN, and SASE solutions at AT&T as well as the MEF Forum's SASE W117 working group on SASE Service Attributes and Service Framework.

See other products by Jeremiah Ginn

William Copeland

See other products by William Copeland

Jeremy Thompson

Jeremy Thompson is a tenacious leader and technical expert who has dedicated the last two decades to the profession of cyber security. His background has broadened him from managing infrastructure in support of a large-scale network to directing operations for an organization conducting threat hunts on IT and OT networks around the globe. He earned a Master's degree in Information Systems Management from the University of Nebraska at Omaha in 2014. Additionally, Jeremy has achieved the following certifications: CCNA – Cyber Operations, GSEC, GCFA, GDAT, GFNA, and CISSP. Currently, he is an Incident Response and Operations Manager for CyberDefenses Inc out of Austin, TX.

See other products by Jeremy Thompson

You're reading from The Foundations of Threat Hunting Organize and design effective cyber threat hunts to meet business needs

Table of Contents (19) Chapters

Chapter 3: Team Construct

Unlock this book and the full library FREE for 7 days

Authors (6)

Personalised recommendations for you