Q
Evaluate Weigh the pros and cons of technologies, products and projects you are considering.

What role does machine learning play in the threat hunting process?

Fidelis Cybersecurity president and CEO Nick Lantuh discusses threat hunting best practices, including machine learning's role in corporate data protection.

With sophisticated data breaches on the rise, a new report from Fidelis Cybersecurity suggests a key to solving the issue is threat hunting and detection. Of the 582 security professionals surveyed for the report, "The State of Threat Detection Report 2018," 63% said they do not currently employ threat hunting or do not know if they do.

In this article, Fidelis president and CEO Nick Lantuh explains why more organizations should embrace the threat hunting process as part of their cybersecurity strategy and shares threat hunting best practices. Lantuh also explains why machine learning has become an important component of the threat hunting process.

Editor's note: The following has been edited for clarity and length.

Nick Lantuh, FidelisNick Lantuh

What are some threat hunting best practices? What role does machine learning play in the threat hunting process?

Nick Lantuh: Threat hunting has already become crucial for the very advanced and sophisticated organizations. The ability to collect, mine [and] extract your metadata is going to become a core pillar of an organization's security strategy.

Organizations need to make sure that threat hunters are not just confined to one area -- they should span across multiple disciplines. You can't just have threat hunters in your incident response environment. They're part of our incident response teams, product management team, threat research team, development team, data sciences team. We have them really spread across the company.

Organizations need to make sure that threat hunters are not just confined to one area -- they should span across multiple disciplines.

But threat hunting is not a skill set that is readily available. When you really look at the amount of true threat hunters that are out there, it's a very, very limited set.

Machine learning is an important component of threat hunting because that's part of taking steps down the path to automate and make things easier, especially when you're dealing with and confronted with very large data sets that are never-ending and expanding. It's a way for machines to assist humans in doing this.

But, at the end of the day, the human aspect of the threat hunting process will really never go away because there are just certain complexities and nuances that machines just simply can't model and make into an equation.

When it comes to threat hunting best practices, it goes back to having full visibility. It goes back to having the ability to monitor all your ports and all your protocols -- the ability to collect all of the traffic and all the endpoint activity because, without it, there are blind spots.

I'd say that paramount to proper threat hunting processes is first having a platform that has the ability to collect all of that, to aggregate it, to orchestrate and to automate it -- to be able to provide that automated type of platform. Then, it's cultivating and having the right kind of people.

At the end of the day, it's not just about technology; it's about a combination of technology, processes and great people that put eyeballs on the problem.

This was last published in December 2018

Dig Deeper on Cybersecurity strategy

Have a question for an expert?

Please add a title for your question

Get answers from a TechTarget expert on whatever's puzzling you.

You will be able to add details on the next page.

Join the conversation

1 comment

Send me notifications when other members comment.

Please create a username to comment.

What are some of the benefits and challenges of the threat hunting process?
Cancel

-ADS BY GOOGLE

SearchCompliance

SearchHealthIT

SearchCloudComputing

SearchMobileComputing

SearchDataCenter

Close