Improving Cognitive and Collaborative Support for Security Threat Hunters

改善对安全威胁猎人的认知和协作支持

• 批准号: 571669-2021
• 负责人: Storey, MargaretAnneMA
• 金额: $ 2.19万
• 依托单位: University of Victoria
• 依托单位国家: 加拿大
• 项目类别: Alliance Grants
• 财政年份: 2022
• 资助国家: 加拿大
• 起止时间: 2022-01-01 至 2023-12-31
• 项目状态: 已结题
• 来源: https://www.nserc-crsng.gc.ca/ase-oro/Details-Detailles_eng.asp?id=749750
• 关键词: Improving; Cognitive; Collaborative; Support; Security

Threat hunters, a relatively new security analyst position, play a critical role in ensuring the security of critical Canadian corporate and government agency systems and data. Threat hunters monitor how data, systems, and networks are accessed to be aware of possible threats and incidents that may occur before systems or data sources are compromised. Often working in teams, threat hunters generate hypotheses and proactively analyze massive amounts of system and network data to detect and isolate the anomalous system and human behaviours that may indicate an impending threat. However, the current tools used by threat hunters have been developed without a good understanding of their cognitive and collaborative needs. Through this collaborative project, we will develop an understanding of the different types of threat hunter personas (their capabilities, motivations, goals, and collaboration strategies). Using these insights, we will design, develop and evaluate novel tools for threat hunters to more effectively visualize and analyze information on possible threats, and share their insights with other threat hunters and key stakeholders. These insights and tool prototypes will enable Micro Focus, our partner organization, to improve the tools and techniques they use to support threat hunting.

威胁猎人是一个相对较新的安全分析师职位，在确保加拿大企业和政府机构关键系统和数据的安全方面发挥着关键作用。威胁搜寻者监视访问数据、系统和网络的方式，以便在系统或数据源遭到破坏之前了解可能发生的威胁和事件。威胁猎人通常在团队中工作，生成假设并主动分析大量系统和网络数据，以检测和隔离可能表明即将发生威胁的异常系统和人类行为。然而，目前威胁猎人使用的工具是在没有很好地理解他们的认知和协作需求的情况下开发的。通过这个协作项目，我们将了解不同类型的威胁猎人角色（他们的能力、动机、目标和协作策略）。利用这些见解，我们将为威胁猎人设计、开发和评估新的工具，以更有效地可视化和分析有关可能威胁的信息，并与其他威胁猎人和关键利益相关者分享他们的见解。这些见解和工具原型将使我们的合作伙伴组织Micro Focus能够改进他们用于支持威胁搜索的工具和技术。