Hunting: More Than a Buzzword. Applying Scientific Research Method to Hunting

No ratings

Presented at BSidesNova 2019 by

Alan Stacilauskas

The word hunting has become a buzzword within the IT security community used by vendors, executives, and analysts alike. But what is hunting? Is it running IPs, domains, and hashes through a SIEM, trying to detect “abnormal” behavior, or staring at endless logs?Applying the Scientific Research Method to hunting standardizes the entire process: making observations, forming theories, gathering data, testing predictions, and interpreting results. And, most importantly, provides a concrete answer to the question “How do I hunt?”By defining each step of the Scientific Research Method and providing examples of how they can be applied to hunting, this process will now have context and applicability to any organization.Now the question “How do I hunt?” has been answered. However there are still questions that also need consideration for a hunt to be useful:When I start hunting?Why should I hunt?Who should hunt?How do I show value?By answering these questions an organization will have a successful hunt.