Improving Cognitive and Collaborative Support for Security Threat Hunters

点击翻译按钮获取中文摘要

Threat hunters, a relatively new security analyst position, play a critical role in ensuring the security of critical Canadian corporate and government agency systems and data. Threat hunters monitor how data, systems, and networks are accessed to be aware of possible threats and incidents that may occur before systems or data sources are compromised. Often working in teams, threat hunters generate hypotheses and proactively analyze massive amounts of system and network data to detect and isolate the anomalous system and human behaviours that may indicate an impending threat. However, the current tools used by threat hunters have been developed without a good understanding of their cognitive and collaborative needs. Through this collaborative project, we will develop an understanding of the different types of threat hunter personas (their capabilities, motivations, goals, and collaboration strategies). Using these insights, we will design, develop and evaluate novel tools for threat hunters to more effectively visualize and analyze information on possible threats, and share their insights with other threat hunters and key stakeholders. These insights and tool prototypes will enable Micro Focus, our partner organization, to improve the tools and techniques they use to support threat hunting.