Threat Hunting

Question 1

Threat Hunting

Answer 1

A cybersecurity technique designed to detect presence of threat that have not been discovered by a normal security monitoring.
Potentially less disruptive than penetration testing.

Question 2

Establishing a Hypothesis

Answer 2

A hypothesis is derived from the threat modeling and is based on potential events with higher likelihood and higher impact.

Question 3

Profiling Threat Actors and Activities

Answer 3

Involves the creating of scenario that show how a prospective attacker might attempt an intrusion and what their objectives might be

Question 4

Threat Hunting

Answer 4

Relies on the usage of the tools developed for regular security monitoring and incident response:
Analyze network traffic
Analyze the executable process list
Analyze other infected host
Identify how the malicious process was executed

Question 5

Threat Hunting

Answer 5

Consumes a lot of resources and time to conduct, but can yield a lot of benefits:
Improve detection capabilities 
Integrate intelligence
Reduces attack surface
Block attack vectors
Identify critical assets