How TXHunter Can Help Fill the Cybersecurity Labor Shortage
The Cybersecurity Workforce Shortage
As we now fast approach into the 2nd Quarter of 2019, Cyberattacks keep happening and are getting more sophisticated and more covert. Not a day goes by where you don’t see in the headlines some restaurant chain, hotel group, an airline, etc. being hacked into, and having their confidential information and data stolen. But, what is even scarier now is that the variants of the threat vectors are even becoming much more difficult to detect in the initial stages.
It has come to the point now where a business or a corporation does not know that they have even become a victim until it is too late to do anything about it. In fact, even some of the most regarded Antispyware/Antimalware/Antivirus cannot even pick up on these new threats.
Compounding this problem, even more, is the severe lack of highly trained and skilled Cybersecurity professionals in the workforce. Because of this, IT Security teams from just about every organization imaginable is having a hard time trying to keep up in fighting off these new Cyberattacks for the sheer reason that they just do not the manpower to keep up.
Just consider some of these statistics:
*45% of organizations report that they do not have an adequate IT Security staff in order to ensure 24 X 7 X 365 monitoring;
*54% of business entities claim that they do not have an adequate Cybersecurity skillset for their size;
*57% of entities even claim that they do not have enough Cybersecurity workers to fully man their Security Operations Centers (SOCs).
(SOURCE: 1).
It should be noted that the Cybersecurity workforce shortage is a global trend that is occurring not just here in the United States, but on a global basis as well. This is illustrated in the diagram below:
(SOURCE: 2).
According to the (ISC)^2 Cybersecurity Workforce Study 2018:
*63% of the respondents claim that their IT Security teams simply do not have enough expertise;
*Because of this, 59% of the respondents believe that they at either a moderate or extreme risk of being hit by a Cyberattack;
*60% of the respondents feel that budgeting for Cybersecurity is a very low priority with their C-Suite;
*70% of these respondents firmly believe that their budgets for Cybersecurity will either remain at the same level or even get slashed.
The Security Weak Spots
Because of this severe labor shortage, business entities have been impacted in the following key areas:
- Threat Hunting:
Either organization lacks the skillset in order to conduct effective Threat Hunting exercises, or they are just too busy putting out fires and thus cannot adopt a proactive mindset.
- Too many Alerts and Warnings:
Because of the lack of workers, the CISO has become way too dependent upon implementing automated tools. This has resulted in:
- An onslaught of Warnings and Alerts coming from too many differing tools. As a result, the IT Security staff is overloaded in parsing out what is for real and what is a false alarm.
- The attack surface has become greatly increased, thus exposing the business or corporation to a much higher risk of being attacked.
- A lack of Computer Forensics:
Because of the massive influx of information and data that is coming in, IT Security teams in many business entities simply cannot reach the next level of figuring out what has gone wrong and how to fix it. In other words, there is also a severe lack of Forensics based skillsets.
- A haphazard Security Incident Lifecycle Management Process:
Ideally, this kind of approach would make use of formal, documented procedures and even a Case Management System. But organizations still rely on a disjointed approach which involves disparate and informal processes.
The Impacts on Threat Hunting
As mentioned in the last section, of the major impacts of the Cybersecurity job shortage has been on the Threat Hunting exercises that most organizations want to conduct. But even before the CISO and his or her team, engages in this kind of activity, they first need to have a crystal-clear understanding of what they are wanting to achieve by Threat Hunting. This is an area that some organizations do not have a good grasp as of yet, thus this further exacerbates their recruiting efforts to find high caliber Cybersecurity professionals.
Therefore, it is important to understand what the different aspects of Threat Hunting are, which are as follows, in order to find the right kinds of skillsets:
- Threat Detection:
This makes use of various techniques and specialized algorithms (especially from Artificial Intelligence and Machine Learning) to find and unearth any Cyberthreats that could be lurking from within the IT Infrastructure. One common that is utilized here is finding correlations in the Indicators of Compromise to various information/data sources (such as those that are collected from various intelligence feeds). Detection is very often confused with Hunting.
- Threat Hunting:
In this scenario, the IT Security staff formulates a specific hypothesis that a Security breach has already occurred, and from there, testing the hypothesis in order to determine if the breach is still in existence. Conducting this kind of exercise requires the deepest of the workings ay given IT Infrastructure.
- Threat Modeling:
This is a process that tries to get into the mindset of a Cyber attacker, in an effort to assess the threat landscape and determining the appropriate countermeasures to mitigate those risks.
Another issue that is compounding the problem of finding an excellent Threat Hunter is that many businesses and corporations are still heavily dependent upon using traditional Security Models. They still rely upon signature-based profiles that have already been established, and only going after those Malware threats which have already proven their nefarious existence.
But effective and proactive Threat Hunting requires that an individual go beyond what has already been established and to probe beyond this in order to fully scope out the IT Infrastructure. In other words, you need to well beyond what is simply coming in and coming out. In these instances, the use of advanced detection tools, such as that of TriagingX can come into play, in order to help fill the void of where a professional Threat Hunter is required, but for some reason or another, cannot be found.
TXHUNTER
TXHunter provides an easy and convenient tool for conducting endpoint threat incident investigations remotely. Instead of sending your IT security staff to collect evidence remotely, or deploying endpoint agents across your entire network, TXHunter can perform a rapid and thorough investigation on its own.
There is no need to create a hypothesis to start the Threat Hunting process. You only need to “tell” TXHunter which endpoint(s) you want to investigate, download the disposable run-time agent to gather the information and data, and then just wait for the analysis complete.
1) Includes Built-in Intelligence and Automated Analysis Mechanism:
TXHunter provides a straight and clear answer as to whether an endpoint has been infected or hacked into, the severity level of that attack; and all supporting data that was used to reach these decision thresholds. TXHunter’s intelligent engine learns from every new discovery found during a Threat Hunting investigation.
2) Focus on Behaviors, Not Just the IOC’s Themselves:
The cyber attacker of today is getting much more sophisticated at avoiding detection via known Indicators of Compromise (IOCs). Thus, many of the IOC’s that are commonly collected today are historic and brittle. The threat hunting tools should focus instead on attacker techniques and anomalies. TXHunter focuses on collecting and analyzing the system behaviors as well as the tactics, techniques, and procedures (TTPs) of the cyber attacker.
3) Collection of comprehensive datasets:
Following are the types of data collected by TXHunter:
- File system Meta-data
- Windows prefetch data
- Event logs
- Scheduled task data
- Registry data
- Artifacts of interactive sessions such as Web History
- Memory data
- Alternative persistence mechanisms
- Network Connections
- Windows Firewall Rules
- Kernel related data such as GDT, IDT, SSDT, Shadow SSDT, Hidden Process, Exports
4) Empowering Tier 1 / Tier 2 Security Engineers:
Effective Threat Hunting requires core technical skills, knowledge of the key areas and professional expertise of highly-trained threat hunting specialists coupled with a qualitative methodology. According to the SANS Threat Hunting Survey, threat hunting tools driven by trained analysts can help increase the scalability and accuracy of Threat Hunting operations.
- Tier 1 Security Operations focus on reviewing alerts, running vulnerability scans and assessments and managing security tools
- Tier 2 Security Operations focus on review tickets, identifying the scope of the attack and ultimately driving contain & recovery
- Tier 3 Security Operations focus on identifying advanced threats such as APT and Stealth threats, Penetration Testing and optimizing defenses.
One of the goals for TXHunter is to enable engineers with skills in Tiers 1 and 2 to be able to run advanced endpoint hunting and to provide prompt and efficient access to key data for Tier 3 Operations.
Sources