Alexis Wales's guest appearances

Alexis Wales

ITSPmagazine

Julie Smith

Alison Levine

Sam Houston

Robert Lee

Andrew Smith

Robin Smith

Kathleen Smith

Omar Khawaja

Adam Levin

David Cross

Stephanie Lucas

Jeffrey Smith

Joel Makower

Caleb Barlow

Brian Kelly

OwlTail

Lauren Proehl

Neil R. Wyler

Threat hunting has become a hot topic throughout the cybersecurity community and a common activity within many information security programs. What is the goal of a hunt, and what real value does it bring to the business? That's precisely what we get into during today's episode.The act of threat hunting sounds really cool, and it definitely seems like it would be a lot of fun. With all its allure, it's no wonder many InfoSec professionals want to hunt. What makes it so appealing? Perhaps—unlike a formal penetration test where there are pre-defined boundaries and rules—a hunt is a bit more like the Wild West where there are no rules, no boundaries, no holds barred. It is a free-for-all with no guidelines to follow. Or is it?The trigger for this conversation came from a tweet from @tazwake that crossed my feed. It prompted me to consider the role of threat hunting within a security program and how the InfoSec organization, and the business can justify the investment. If it's all loosey-goosey in its definition, action, and results, how can it be successfully measured and quantified?As we dig into this during the conversation, there are many burning questions that we attempt to address this top-level query:How do you scope the hunt; how do you ensure that the scope is relevant?How do you capture and document what you find; what do you do with those findings?How do you learn from a hunt to make the next ones better? Do you just rerun the same hunt over and over and over?Is there even a thing as "a hunt," or is it really an ongoing activity with no start/stop/finish?The truth is, none of the answers to the above question matter if we can't connect it back to the business. Did the hunt reduce exposure, did it reduce risk, did it help boost the security posture—examples which should link back to the top and bottom lines in the business. This may seem harder than it sounds. It may just be. Let's see what our guests have to say."Don't be afraid of threat hunting. It sounds fancy and shiny. But in reality, it is just leveraging a lot of things that we've been doing for a very long time—having expert threat hunters that are knowledgeable across a broad range of security is great, but your entry-level analysts can show value in a threat hunt as well."—Neil R. Wyler"I've always said that it's not about how many threat hunts that you do, it's the actionable impact that you have from your threat hunts."—Lauren Proehl"We have a very large organization at DHS, the Cybersecurity Infrastructure Security Agency (CISA) and we've had to describe very technical events and activities in non-technical ways because our communications go vertically, they go horizontally, they go every direction you can imagine."—Alexis WalesGuest(s)Alexis Wales, Deputy Associate Director, Threat Hunting, Cybersecurity and Infrastructure Security Agency (CISA),  U.S. Department of Homeland SecurityLauren Proehl, Manager, Threat Hunting Operations and Research (THOR) for a Fortune 200 (@jotunvillur on Twitter)Neil R. Wyler (Grifter), Threat Hunting and Incident Response Specialist, RSA Security (@Grifter801 on Twitter)This Episode's Sponsors:Nintex: https://itspm.ag/itspntwebImperva: https://itspm.ag/imperva277117988Resources:The Twitter post that triggered the inspiration for this episode: https://twitter.com/tazwake/status/1322267503284944897Related Podcast: Day In The Life Of A Cyber Threat Intelligence Analyst | A Conversation With Remi Cohen, Charity Wright, And Jason Passwaters: https://itsprad.io/the-academy-357MITRE ATT&amp;CK: https://attack.mitre.orgDFIR and Threat Hunting Blog: https://findingbad.blogspot.comThreat hunting focused conference: https://www.sans.org/event/threat-hunting-and-incident-response-summit-2020Whitepaper on developing a hypothesis to hunt - Generating Hypotheses for Successful Threat Hunting: https://sans.org/reading-room/whitepapers/threats/generating-hypotheses-successful-threat-hunting-37172Some Twitter accounts to follow:Nicole Beckwith - https://twitter.com/NicoleBeckwithDavid J Bianco - https://twitter.com/DavidJBiancoJack Crook - https://twitter.com/jackcrGrifter - https://twitter.com/Grifter801Yonathan Klijnsma - https://twitter.com/ydklijnsmaRyan Kovar - https://twitter.com/meansecRobert M Lee - https://twitter.com/RobertMLeeRob T Lee - https://twitter.com/robtleeKatie Nickels - https://twitter.com/likethecoinsMichael Rea - https://twitter.com/ComradeCookieTo see and hear more Redefining Security content on ITSPmagazine, visit:https://www.itspmagazine.com/redefining-securityAre you interested in sponsoring an ITSPmagazine Channel?https://www.itspmagazine.com/podcast-series-sponsorships

Threat hunting has become a hot topic throughout the cybersecurity community and a common activity within many information security programs. What is the goal of a hunt, and what real value does it bring to the business? That's precisely what we get into during today's episode.The act of threat hunting sounds really cool, and it definitely seems like it would be a lot of fun. With all its allure, it's no wonder many InfoSec professionals want to hunt.  What makes it so appealing? Perhaps—unlike a formal penetration test where there are pre-defined boundaries and rules—a hunt is a bit more like the Wild West where there are no rules, no boundaries, no holds barred. It is a free-for-all with no guidelines to follow. Or is it?The trigger for this conversation came from a <a href="https://twitter.com/tazwake/status/1322267503284944897" rel="nofollow" target="_blank">tweet from @tazwake</a> that crossed my feed. It prompted me to consider the role of threat hunting within a security program and how the InfoSec organization, and the business can justify the investment. If it's all loosey-goosey in its definition, action, and results, how can it be successfully measured and quantified?As we dig into this during the conversation, there are many burning questions that we attempt to address this top-level query:<ul><li>How do you scope the hunt; how do you ensure that the scope is relevant?</li><li>How do you capture and document what you find; what do you do with those findings?</li><li>How do you learn from a hunt to make the next ones better? Do you just rerun the same hunt over and over and over?</li><li>Is there even a thing as "a hunt," or is it really an ongoing activity with no start/stop/finish?</li></ul>The truth is, none of the answers to the above question matter if we can't connect it back to the business. Did the hunt reduce exposure, did it reduce risk, did it help boost the security posture—examples which should link back to the top and bottom lines in the business. This may seem harder than it sounds. It may just be. Let's see what our guests have to say."Don't be afraid of threat hunting. It sounds fancy and shiny. But in reality, it is just leveraging a lot of things that we've been doing for a very long time—having expert threat hunters that are knowledgeable across a broad range of security is great, but your entry-level analysts can show value in a threat hunt as well."—Neil R. Wyler"I've always said that it's not about how many threat hunts that you do, it's the actionable impact that you have from your threat hunts."—Lauren Proehl"We have a very large organization at DHS, the Cybersecurity Infrastructure Security Agency (CISA) and we've had to describe very technical events and activities in non-technical ways because our communications go vertically, they go horizontally, they go every direction you can imagine."—Alexis WalesGuest(s)<a href="https://www.linkedin.com/in/alexis-wales-74b245118/" rel="nofollow" target="_blank">Alexis Wales</a>, Deputy Associate Director, Threat Hunting, Cybersecurity and Infrastructure Security Agency (CISA),  <a href="https://www.linkedin.com/company/us-department-of-homeland-security/" rel="nofollow" target="_blank">U.S. Department of Homeland Security</a><a href="https://www.linkedin.com/in/laurenproehl/" rel="nofollow" target="_blank">Lauren Proehl</a>, Manager, Threat Hunting Operations and Research (THOR) for a Fortune 200 (<a href="https://twitter.com/jotunvillur" rel="nofollow" target="_blank">@jotunvillur</a> on Twitter)<a href="https://www.linkedin.com/in/neilwyler/" rel="nofollow" target="_blank">Neil R. Wyler (Grifter)</a>, Threat Hunting and Incident Response Specialist, RSA Security (<a href="https://twitter.com/Grifter801" rel="nofollow" target="_blank">@Grifter801</a> on Twitter)This Episode's Sponsors:Nintex: <a href="https://itspm.ag/itspntweb" rel="nofollow" target="_blank">https://itspm.ag/itspntweb</a>Imperva: <a href="https://itspm.ag/imperva277117988" rel="nofollow" target="_blank">https://itspm.ag/imperva277117988</a>Resources:The Twitter post that triggered the inspiration for this episode: <a href="https://twitter.com/tazwake/status/1322267503284944897?s=21" rel="nofollow" target="_blank">https://twitter.com/tazwake/status/1322267503284944897</a>Related Podcast: Day In The Life Of A Cyber Threat Intelligence Analyst | A Conversation With Remi Cohen, Charity Wright, And Jason Passwaters: <a href="https://itsprad.io/the-academy-357" rel="nofollow" target="_blank">https://itsprad.io/the-academy-357</a>MITRE ATT&amp;CK: <a href="https://t.co/Pnr7TKth0u?amp=1" rel="nofollow" target="_blank">https://attack.mitre.org</a>DFIR and Threat Hunting Blog: <a href="https://t.co/gxFxzYv9TL?amp=1" rel="nofollow" target="_blank">https://findingbad.blogspot.com</a>Threat hunting focused conference: <a href="https://www.sans.org/event/threat-hunting-and-incident-response-summit-2020" rel="nofollow" target="_blank">https://www.sans.org/event/threat-hunting-and-incident-response-summit-2020</a>Whitepaper on developing a hypothesis to hunt - Generating Hypotheses for Successful Threat Hunting: <a href="https://t.co/bHhycfvrFU?amp=1" rel="nofollow" target="_blank">https://sans.org/reading-room/whitepapers/threats/generating-hypotheses-successful-threat-hunting-37172</a>Some Twitter accounts to follow:Nicole Beckwith - <a href="https://twitter.com/NicoleBeckwith" rel="nofollow" target="_blank">https://twitter.com/NicoleBeckwith</a>David J Bianco - <a href="https://twitter.com/DavidJBianco" rel="nofollow" target="_blank">https://twitter.com/DavidJBianco</a>Jack Crook - <a href="https://twitter.com/jackcr" rel="nofollow" target="_blank">https://twitter.com/jackcr</a>Grifter - <a href="https://twitter.com/Grifter801" rel="nofollow" target="_blank">https://twitter.com/Grifter801</a>Yonathan Klijnsma - <a href="https://twitter.com/ydklijnsma" rel="nofollow" target="_blank">https://twitter.com/ydklijnsma</a>Ryan Kovar - <a href="https://twitter.com/meansec" rel="nofollow" target="_blank">https://twitter.com/meansec</a>Robert M Lee - <a href="https://twitter.com/RobertMLee" rel="nofollow" target="_blank">https://twitter.com/RobertMLee</a>Rob T Lee - <a href="https://twitter.com/robtlee" rel="nofollow" target="_blank">https://twitter.com/robtlee</a>Katie Nickels - <a href="https://twitter.com/likethecoins" rel="nofollow" target="_blank">https://twitter.com/likethecoins</a>Michael Rea - <a href="https://twitter.com/ComradeCookie" rel="nofollow" target="_blank">https://twitter.com/ComradeCookie</a>To see and hear more Redefining Security content on ITSPmagazine, visit:<a href="https://www.itspmagazine.com/redefining-security" rel="nofollow" target="_blank">https://www.itspmagazine.com/redefining-security</a>Are you interested in sponsoring an ITSPmagazine Channel?<a href="https://www.itspmagazine.com/podcast-series-sponsorships" rel="nofollow" target="_blank">https://www.itspmagazine.com/podcast-series-sponsorships</a>

Turning Hunts Into Value: The Role Of Threat Hunting In SecOps And Business | With Alexis Wales, Lauren Proehl, And  Neil R. Wyler (Grifter)