Intelligence-Led Cyber Security: Threat Hunting

The developing and changing digital world has also brought significant changes to attacks in the field of cyber security. In particular, the rapid rise of artificial intelligence in the IT sector and the growing power of computer systems, together with the increase in the number and capabilities of actors able to carry out potential cyber attacks, have made cyber attacks more sophisticated and complex.

About 70% of organisations believe that the use of artificial intelligence is necessary to prevent cyber attacks and/or minimise their damage. The cyber threat situation in question can be described as:

• Shortcomings in the number and qualifications of experts working in cyber security (cyber skill shortages),
• Long dwell time (the average time taken to deal with cyber attacks or threats is about 191 days, which is far too long for security in IT systems to be ensured effectively),
• Cyber attacks and threats becoming multidimensional and complicated,
• The continuing increase in the number and capabilities of threat actors,
• Inadequate in-house and external training in cyber security,
• The large number of tools and vendors used to secure IT systems (too many tools from different vendors),

and so on.

In today’s IT world, where risks and threats grow more complex and diverse every day, securing IT systems has become just as difficult and complex. Preventive and protective measures can now fall short against current and future cyber attacks. The most effective way to cope with this situation undoubtedly lies in being, or being able to be, proactive.

The most important thing organisations need in order to fortify themselves from both internal and external threats/attackers is information about cyber attacks and potential actors, in other words, intelligence.

Security Operation Center (SOC)

It can be said that today’s Security Operation Centers (SOCs) focus on two main goals. The first is to identify the weak points of systems and remedy them before they are exploited (fix before exploitation), and, through the monitoring activities carried out in the security centre (monitoring network and logs), to detect and analyse abnormal activity and take the necessary measures against events that constitute threats or attacks. The other important function is to conduct a forensic investigation after a cyber attack has taken place and to initiate and pursue legal proceedings against the attackers.

It is assessed that existing systems may prove inadequate against possible cyber attacks in the near future. Coping with this requires new-generation security strategies and security policies. The concept that emerges here is cyber intelligence and analytics. As a natural consequence, intelligence and proactive methods are needed alongside the traditional protect and defence aspects of cyber security. In other words, integrating in particular the proactive side of cyber threat hunting into existing security systems and security policies is of great importance.

Known and Unknown Cyber Threats (Known/Unknown Threats)

Cyber threat hunting makes an important contribution to protecting systems against hidden, unknown and emerging cyber attacks. According to the threat hunting survey conducted by SANS in 2017, about 97% of cyber security experts/leaders say that threat hunting improves the speed and accuracy of the response to threats.

According to research by IBM, unknown and undetected threats account for about 20% of all threats. The damage this group does to systems, in inverse proportion to its share, is 80%. Even if the cyber security analysts working in SOCs and other security officers carry out their duties flawlessly, threats that cannot be detected with current capabilities are seen to persist. Although undetectable threats are few in number, they constitute the group that does the most damage to systems and organisations.

The capability that will give us the most effective and flexible room for manoeuvre against this negative picture is to develop an intelligence-led cyber security system and strategies. In other words, an intelligence-led cognitive SOC can give us the capability we need. Another important point that comes to the fore here is the collection, rapid analysis, evaluation, inclusion in decision-making and effective use of data on likely threats, potential actors, possible attacks and the techniques and methods of attackers. In order to acquire this capability and make systems more prepared and secure for the future, it is assessed that the necessary investment must be made in intelligence and intelligence-led threat hunting. Making this investment only in the technical field will not be enough on its own; it is also of great importance to give employees the necessary perspective and understanding of the subject and to plan the required training in advance. In addition, it is undoubtedly of great importance that this capability be supported by artificial intelligence and self-learning algorithms.