Threat Hunting in the Cloud

CHAPTER 1Introduction to Threat Hunting

What's in This Chapter

• The rise of cybercrime
• What is threat hunting?
• Key cyberthreats and threat actors
• Why is threat hunting relevant to all organizations?
• Does an organization's size matter?
• Threat modeling
• Threat hunting maturity model
• Human elements of threat hunting
• How do you make the board of directors cyber-smart?
• Threat hunting team structure
• The threat hunter's role

The Rise of Cybercrime

“If you protect your paper clips and diamonds with equal vigor…you'll soon have more paper clips and fewer diamonds.”

—Attributed to Dean Rusk, U.S. Secretary of State 1961–1969

This quote was first mentioned decades ago in the context of the cold war. However, it still resonates today, especially with the rise of cybercrime we are currently experiencing. Modern cybercrime is a sophisticated business with complex supply-chain activities and multiple threat actors working together in synergy. The threat actors are practicing division of labor, where one team is deployed to penetrate defenses and another team is subsequently employed to exploit the data breach. This level of sophistication is possible due to the staggering rewards cybercriminals and organized crime syndicates are achieving.

In 2009, the cost of cybercrime to the global economy was USD 1 trillion according to McAfee, the Silicon Valley based cybersecurity vendor, in a presentation to the World Economic Forum (WEF) in Davos, Switzerland. McAfee has since announced ...