Principle C2: Threat hunting

Description

The organisation proactively seeks to detect, within networks and information systems, adverse activity affecting, or with the potential to affect, the operation of essential functions even when the activity evades standard security prevent / detect solutions (or when standard solutions are not deployable).

Indicators of good practice (IGP) achievement levels can be viewed via the Data Security Protection Toolkit.

As documented in the introduction to this framework, independent assessors are expected to use their professional judgement when assessing organisations against the Cyber Assessment Framework (CAF).

The approach and documentation list described below provides guidance on how to conduct testing and should be adapted as appropriate in order to assess whether the organisation's outcomes are effectively achieved.

Suggested approach to testing – Partially Achieved

1. Resources for threat hunting – Obtain evidence that the organisation has identified the personnel who will undertake threat hunting, the circumstances required for a threat hunt to be initiated and the means of accessing relevant systems for threat hunts. At the ‘partially achieved’ level, the organisation only needs to be able to make these resources available for threat hunting on an occasional basis. (PA#1)

2. Threat hunt frequency - Verify that the organisation has performed threat hunts in response to specific triggers such as threat intelligence, indicators of compromise, supplier notifications, security incidents or information received from reputable external sources. At the ‘partially achieved’ level, the organisation does not need to have a regular threat hunting schedule. (PA#2)

3. Pre-determined and documented threat hunting methods – Verify that threat hunts follow documented and repeatable approaches. Review a sample of completed threat hunts and verify that personnel followed the documented methodology in practice. (PA#3), (A#3)

4. Documenting threat hunts and post-hunt analysis – Obtain and inspect records of completed threat hunts. Verify that the organisation documents the stages of each threat hunt in sufficient detail to support review and escalation. (PA#4)

Additional approach to testing – Achieved

1. Deploying threat hunting as part of business as usual – Obtain evidence that the organisation has identified the resources necessary to undertake regular threat hunting activities. Review schedules and records of completed threat hunts to confirm that threat hunting is performed as part of business-as-usual activities. (A#1)

2. Threat hunt frequency matching risks – Obtain evidence that the organisation can justify the frequency of its threat hunting activities against the risk or criticality of the systems involved. (A#2)

3. Turning threat hunts into automated detections and alerting – Obtain evidence that the organisation reviews the outcomes of completed threat hunts to identify opportunities to improve its monitoring and detection capabilities. This may include creating new alerts for behaviours identified during the hunt, tuning existing alert rules, and adding missing log sources or fields where the hunt showed that useful data was not available (A#4)

4. Driving improvements through threat hunting – Confirm that the organisation uses the outcomes of threat hunting activities to improve both its threat hunting capability and wider security posture. This may include updating threat hunting playbooks, refining hypotheses and search methodologies, enhancing triage and escalation processes, addressing identified vulnerabilities or control weaknesses, updating user and system behaviour baselines, adjusting the scope or frequency of future threat hunts, or identifying training and supplier assurance requirements. (A#5)

5. Justified confidence in the threat hunting process – Verify that threat hunting procedures are reviewed and updated in response to changes in risk, threats or the operating environment. (A#6)

6. Leveraging automation – Obtain evidence that the organisation uses automation for specific threat hunt activities to make them more consistent, timely and effective. Verify that automated workflows and outputs are sufficiently tested to ensure they do not introduce excessive false positives or overlook significant threats. (A#7)

7. Focusing on tactics, techniques and procedures – Verify that threat hunts are primarily designed to identify attacker tactics, techniques and procedures that could affect systems supporting the organisation’s essential function(s), rather than relying solely on searches for atomic indicators of compromise such as IP addresses, domain names, URLs or file hashes. (A#8)

Suggested documentation list - Partially achieved

Suggested documentation includes:

• threat hunting roles and responsibilities
• threat hunting triggers and approval requirements
• records of threat hunts undertaken
• playbooks or procedures for threat hunting
• threat hunt findings, conclusions and escalations

Additional documentation list – Achieved

Additional documentation includes:

• threat hunting schedules
• risk assessments or threat models used to determine threat hunt frequency and priorities
• records showing the refinement of monitoring rules and alerting logic resulting from threat hunts
• updates to threat hunting procedures informed by previous threat hunts
• wider security updates informed by previous threat hunts
• evidence of periodic reviews of threat hunting processes, priorities and methodologies against organisational risks and threats
• evidence of automated activities within threat hunts
• evidence of threat hunts being mapped to relevant attacker tactics, techniques and procedures