Scenario B – external threat hunt
The team has been formed and with the Cyber Security Framework and ongoing discussions completed, the team has decided on which methodology to use. Because of the lack of ongoing security controls and a comprehensive policy, they have chosen the Lockheed Martin Cyber Kill Chain as the easiest to adapt by Cyber Security Intelligence (CSI) for the client.
CSI, the system administrators, and the security team review the CSF and start annotating where data would be located to provide visibility into each of the sections of the Lockheed Martin Cyber Kill Chain. Here is an abbreviated list, and the sample CMF as it applies to CSI's client:
- Reconnaissance: Web servers, DNS logs, and proxy logs
- Weaponization: Darknet intel on the vendors that the client uses
- Delivery: The email logs and proxy logs to be downloaded
- Exploitation: The endpoint logs, antivirus logs, and software logs for the systems that are critical to the business...
