Splunk’s David Bianco on Differentiating Threat Hunting and Red Teaming

In our latest episode of the Future of Threat Intelligence podcast, David Bianco, Staff Security Strategist at Splunk, shares his insights on the evolving landscape of threat hunting. He introduces the PEAK threat hunting framework, emphasizing its role in enhancing security measures. 

 

David also discusses the critical differences between threat hunting and red teaming, highlighting how both approaches can complement each other. He also divesinto the essential skills needed for building an effective threat hunting team and offers actionable advice on measuring the success of threat hunting programs. 

 

Topics discussed:

• The PEAK threat hunting framework, designed to enhance proactive cybersecurity measures and improve threat detection capabilities.  
• The distinction between threat hunting and red teaming and their complementary roles in strengthening security defenses.  
• Hypothesis-based threat hunting and the importance of formulating and testing hypotheses to identify potential threats.  
• Baseline threat hunting as a method to understand normal activity, aiding in the detection of anomalies.  
• Key skills for an effective threat hunting team, including knowledge of threat actors, technology stacks, and data analytics expertise.  
• How metrics for measuring threat hunting success are essential for demonstrating impact and driving continuous improvement in security programs.  

 

Key Takeaways: 

• Adopt the PEAK threat hunting framework to structure your threat hunting initiatives and enhance your cybersecurity posture effectively.  
• Differentiate between threat hunting and red teaming to understand their unique roles and how they can complement each other in security.  
• Formulate clear hypotheses for threat hunting activities to guide your investigations and improve the chances of identifying real threats.  
• Conduct baseline threat hunting to establish normal activity patterns, making it easier to detect anomalies and suspicious behavior.  
• Build a diverse threat hunting team by incorporating members with expertise in threat intelligence, data analytics, and incident response.  
• Implement actionable metrics to measure the success of your threat hunting program and demonstrate its impact on overall security.  
• Start small with your threat hunting efforts, focusing on manageable projects that can scale as you gain experience and success.  
• Encourage collaboration between threat hunters and other security teams to share knowledge and improve overall detection capabilities.  
• Continuously educate your team on the evolving threat landscape to stay ahead of potential risks and enhance threat hunting effectiveness.  
• Utilize existing data analytics tools to analyze collected data during threat hunting, enabling informed conclusions about threat actor activities.