Boom.
You've just been attacked.
The bad guys in your system and you're hemorrhaging data.
Now, this was not an isolated incident.
There was a time that led up to this, and there was a time that happened after.
The time that led up to it, going back and preceding this, we call left of boom.
And the time after it when we trying to discover, that's the time that we call right of boom.
So in this first phase, we're basically doing the bad guy is doing reconnaissance.
He's looking at your systems.
He's probing them.
He's trying to figure out where the weak spots are, where the good data is,
and the time after boom is when we want to be doing recovery.
The problem is we don't always know when boom occurred at the time it occurred.
There's a lag between boom and alarm.
This is when we find out.
When the attack has occurred, which is not the same as when it actually occurred.
Now, if we look at these kinds of of intervals, what could we do about this?
Well, there's a time here you can see that is the mean time to identify what the problem is,
according to Ponemon Institute's survey in 2022.
The mean time to identify is on the order of 200 days.
That's how long it takes to figure out that the bad guy is already in your system,
and further still, there's this notion of meantime to contain, and the meantime to contain is on the order of 70 days.
You put those two together, you're at about 270 days total between when boom occurred
and when now, we finally got everything recovered.
There clearly would be some advantage if we could go back in time and discover the boom
and bring the interval between the alarm and the boom closer together,
or even go back before boom and start to realize during the reconnaissance phase that something is amiss.
Something is happening in this phase, and this timeline in this area is when we could be doing what we call threat hunting.
I could do a hunt and we'll talk about what that involves after the hunt is when we start doing the investigation.
And the investigation is reactive.
The hunt is proactive.
That's the big difference here.
So as much as possible, it would be nice if we could go back and anticipate some of these things.
Now, how does this work?
Well, it turns out we're going to take if we're doing threat hunting, we're basically going to develop a hypothesis.
You have someone that's acting as an investigator,
but they're investigating things that maybe have not fully happened yet or in the process of happening.
So no alarms have gone off.
What are we going to use?
What we're going to use things like indicators of compromise.
That's information that we can gather from our systems that tell us that someone has done something here that has breached.
Maybe it's a small hole here, a small hole there.
There are other things like indicators of attack that may be in here as well.
It says someone is knocking on the door.
They might not have fully gotten in, but they did some things that we should be concerned about.
Other sources of information would be security, intelligence, threat feeds.
So intel feeds that tell us that there are certain types of vulnerabilities
that are being exploited on the Internet these days
and certain things that are happening maybe in a particular sector or in a particular geography.
This is security intelligence.
We like to use that kind of information and leverage it to our best ability as well.
Then we could do some vulnerability scans on our environment and that would tell us what the bad guy is also seeing.
And that is that there are vulnerabilities here.
There are systems that are weak here.
This is the soft underbelly.
This is what the bad guys doing.
Why wouldn't we do the same thing?
Then an intelligent threat hunter who has some experience and some insight into this
is going to use basically their experience and a little bit of intuition to connect the dots
and say these things that seemed isolated, in fact, are not.
They're all grouped together.
We connect the dots and we realize before the boom has occurred that in fact,
this is the setup that's about to result in a data breach.
Or it could be in this range of time when some things maybe we've already been attacked.
But the alarm hasn't gone off.
But we're going to see the telltale signs, and those are the things that we're looking for.
Now, what would an experienced threat hunter use in terms of the tools to gather all of this information?
Well, they would use some tools like an XDR, extended detection and response capability.
And I've talked about this in a previous video.
Another thing that we'd use is a security information, an event management system,
something that goes out and gathers information from all of my sources of security telemetry,
all of the logs, all of the flow data, all of the different sources that might give me security intelligence
in these two, in fact, can be related and feeding to each other.
And then another related technology that often relates to these as well is a user behavior analytics capability.
And the UBA would look for anomalous user activities.
Here's a user that's performing differently than what their peer group is doing, and therefore they're drawing suspicion.
And then we would ultimately want to take all of those technologies and infuse them with artificial intelligence
so that we can get to the point, find the source, get to our investigation faster, and do the reporting,
and hopefully uncover this issue before the boom, and if not at least very soon after the boom,
because what we're trying to do is avoid two numbers.
There's one number, 270 and another number 4 million.
What do those mean?
270 is roughly the number of days between boom and containment, according to the Ponemon Institute.
Also, according to that same survey, 4 million is the average cost of a data breach.
That's what we're trying to avoid.