Put Threat Intelligence to Work
DS: Anyone who has spent time in the enterprise trenches can relate to the saying, ‘swimming in data, drowning for wisdom” There’s no shortage of threat intelligence, and effective cybersecurity operators need to put it all to work
EK: Humans are simply not capable of looking at so many different locations. We need tools to help automate and aggregate the information so we can correlate it across different areas and sources. When we are able to put all that information on one screen, we are better able to make sense of it all.
JO: Cyber threat intelligence is both a process and a product. So what we call intelligence for your organization is going to be different for another organization. We have indicators of compromise that could be a domain, hash value, or IP. So all of these intelligence feeds need to be put to work because there’s no one size fits all solution.
Develop Threat Hunting Abilities
EK: You need to allocate a set amount of time each day to do threat hunting. The idea of doing this activity on a continuous basis is what really makes it an effective habit.
JO: I would suggest employing threat hunting playbooks such as the free Threat Hunter playbook developed by Roberto Rodriguez as a way to codify this practice into a daily habit. Ask yourself: “What are the top things going back to cyber threat intelligence? What are the top things most likely to attack you? See if you can create a playbook for that and go hunting. If you’re a SOC analyst, work with your manager and see if you can get at least an hour a day to do this.
Mitigation & Remediation: Don’t Skip Either
EK: Too many security teams focus their energies on treating a symptom rather than curing the disease. When you find a problem and you mitigated the problem, by say, closing a firewall rule, you cannot stop there as you haven’t actually found the source of the problem. Otherwise, you’re just going to be duct taping the problem. You need to understand if data left the environment, why it happened, and what was the intent of the malicious actors who are trying to get inside your network.
JO: I see mitigation and remediation as a difficult yet necessary part of the security lifecycle. We’re all working so hard and investing so much effort mitigating an incident that it’s only natural that many of us will just need to take a break when we’ve finally finished mitigating and then we’ve forgotten to document the lessons learned.
Consider Each Day as a Learning Opportunity
DS: The more you learn, the more you realize you don’t even know. Of course, effective cybersecurity operators need to find time for the pursuit of knowledge. And that’s half the battle.
EK: Podcasts are a great way to stay current with the latest information and strategies. First of all, the SANS podcast has amazing content and is released all the time, as well as our very own Security Architecture podcast which is also released quite frequently. I also suggest engaging in conversations on LinkedIn and using the site to ask and answer questions as well as joining some of the discussions that are happening on newer platforms such as Clubhouse.
JO: My daily reads include the Internet Storm Center and I would recommend the SANS News Bites newsletter which provides a twice-weekly summary of the key news stories happening around the industry. Though I am hesitant to admit it, if you follow the right people in InfoSec, Twitter is a great resource where you’ll find some really good blog posts and discussions. Follow the wrong people and it’s going to be a dumpster fire.
Watch the entire webinar and gain detailed insights for effective cybersecurity operators from David, Jorge, and Evgeniy.