Menu Search

Cyber ​Threat Hunting

7Safe Cyber Threat Hunting

Why Choose 7Safe for Cyber Threat Hunting?

“1) An organisation cannot prevent all attacks; 2) an organization’s network is going to be compromised; and 3) 100% security does not exist.” (Cole, 2016)

7Safe is a member of CREST and we apply and adhere to the rigorous CREST standards. We have adopted the 3-Phase CREST model for Cyber Security Incident Response (CSIR) and we are a registered Cyber Security Incident response provider on the CREST website, see here

Related Case Studies Related Insight

 

 

What is Cyber Threat Hunting?

Find threats before they do you harm

Cyber Threat Hunting is the process by which infrastructure in an organisation is proactively 'hunted' for evidence of ‘threats’ which have gone undetected by other means – indicating that an organisation has already been compromised.

7Safe tailors threat hunts to each organisation depending on their infrastructure, existing policies and procedures, and priorities with regards to Cyber Security.

Within an organisation’s Cyber Security portfolio, Cyber Threat Hunting would most appropriately fit in between Penetration Testing and Risk and Compliance.

Why proactively hunt for threats?

Every organisation is subject to cyber-attacks. Defence in depth is part of the answer to reducing exposure and mitigating impact. However, identifying threats and responding to them in a timely manner is continuing to prove challenging. Cyber Threat Hunting is a proactive alternative to relying on traditional rule or signature-based alerting security solutions (like anti-virus and intrusion detection systems) or human-based monitoring.

We provide front line consultancy combined with expert knowledge transfer to teach your team the practical steps needed to plan and conduct threat hunting operations throughout the enterprise.

What benefits will Cyber Threat Hunting deliver?

There are several benefits that a Threat Hunt will bring to an organisation of any size. These benefits are unique to a Cyber Threat Hunt since they detect threats in areas which might be considered outside the scope of existing Cyber Security controls or appliances, using skilled Threat Hunters deploying a mix of automatic tools and manual examination techniques. Existing controls or appliances might include policies and procedures or automated security tools like Network Intrusion Detection Systems or Firewalls.

Specifically, Cyber Threat Hunting delivers:

  • Assurance that existing Cyber Security controls are effective at protecting an organisation from breach or attack
  • Recommendations for improvements to existing Cyber Security controls or the introduction of new ones based on clear facts which help to support any investment from Cyber Security budgets
  • Protection against adversaries in all shapes and forms be it malware, insider threats, specific malicious actors, improper configuration or insecure design. Cyber Threat Hunting is particularly useful in its ability to protect against insider threats and data leakage by identifying non-conformance to soft Cyber Security Policies supposedly adhered to by employees.

“Without expert help, no organisation regardless of size can be confident that malware is not present in its systems. It is unusual for us not to find evidence of malware when we carry out our standard checks on OS, apps, and network and cloud services. When you know what you are looking for and have the right methodology and tools for threat hunting, you can mitigate risks of this kind by isolating and removing the threat. After digital forensic analysis, we can report accurately on the damage, helping our clients to properly risk assess the situation with all the facts.”

 Steve Shepherd MBE, 7Safe's Cyber Threat Hunting Service Lead

  • How does Cyber Threat Hunting fit into a complete Cyber Security Strategy?

    No two Threat Hunts are the same and it is for this reason that Cyber Threat Hunting should be part of a continuous Cyber Security Strategy, with regular Hunts to ensure an organisation is aware of what is happening in their infrastructure. Cyber Threat Hunting compliments and bolsters existing components of a Cyber Security Strategy:

    • Penetration Testing is the evaluation of an application or infrastructure from the outside-in, exploiting known vulnerabilities in application or system design and implementation. Cyber Threat Hunting looks inside an infrastructure for signs that a breach or attack has already occurred, perhaps (though not exclusively) through exploitation of previously identified vulnerabilities in a Penetration Test
    • Security Operations Centres (SOCs) or general security monitoring practices or tools such as SEIMs (Security, Information & Event Management) monitor an organisation’s infrastructure for evidence of malicious activity in near-real time. Threat Hunting compliments an organisation’s live-monitoring of security events by proactively reaching out to systems on a network and examining data that might have dropped off the timeline of a SOC capability or that might have been considered out-of-scope
    • End-user Security Policies are the policies and procedures which staff at any organisation are required to adhere to in order to keep the organisation safe; policies such as taking company information home on a USB stick or not accessing personal email or file sharing services while on a company computer. There are always ways to get around soft-policies like this. Cyber Threat Hunting is able to take a set of requirements from any given policy and proactively query the data to identify possible non-compliance and insider threats. Whether a user has acted maliciously or not, it is every organisation’s responsibility to protect itself and its customer’s data by assuring the compliance of its staff
  • What will a Cyber Threat Hunt uncover?

    The findings of a Cyber Threat Hunt will depend on the scope of the Hunt which will be agreed at the start. Organisations will be asked what they wish the priorities of the Hunt to be such as active external threats, suspicious user activity, insecure software, data leakage or a whole host of other options.

    Some of the insight that 7Safe might deliver with a Threat Hunt includes:

    • Data being exfiltrated from an organisation using third party file sharing applications
    • Personal data being stored in insecure locations
    • Out-of-date or unpatched software running on critical systems
    • Administrator rights being abused
    • Sensitive data being regularly copied to removable media devices beyond the scope of security controls
    • Unknown or unauthorised programs being run on user systems
    • Unusual file access activity being recorded by file shares
    • Privilege escalation within normal user accounts indicating malware or rogue insider activity
    • Detection of unusual network traffic from core systems.
  • How is a Cyber Threat Hunt conducted?

    The Threat Hunting process begins with a workshop to understand an organisation’s infrastructure in order to be effective in identifying the most appropriate data to examine. Following this initial consultation, experienced Threat Hunters are deployed to the organisation’s premises to collect the appropriate data and detect any threats. A threat report tailored to the organisation details all findings in an easy-to-understand manner, for easy digestion and sharing amongst appropriate Cyber Security staff. Deep technical findings can also be delivered as appendices to aid in the implementation of remedial action.

     

     

                     

​Speak to an expert

If you would like to speak to our team about finding potential threats in your systems, please call +44 (0)17 63 285 510 or get in touch by email.

​Or if you would like to read more about our CREST accredited incident response services see Why Choose 7Safe for CSIR or our CSIR Operating Model .

Alternatively, complete the enquiry form below and a member of our team will get back to you.

About You

Your Requirements 

Please try to include as much information as possible on your requirements. Not sure on details? Not a problem, our team can go through this with you when they get in touch.