Threat Hunting Series: Common Mistakes and Major Challenges

Our series on threat hunting explores what they are and what they do. According to a recent study by the University of Victoria, this week's post highlights two common mistakes made by threat hunters and three major challenges they face. As a result, these errors and challenges cost time and attention, increasing risk.

This discussion is part of our ongoing "Rise of the Threat Hunter" series. For more information about the series, see the introduction here or read last week's article, Threat Hunting - A Day in the Life of a Threat Hunter.

Two Common Threat Hunting Mistakes

You've seen the headlines. High-profile data breaches and cyberattacks are everywhere. It makes sense that threat hunters make two common mistakes: overestimating the severity of an anomaly and misclassifying an effective action as suspicious or malicious.

Overestimating Threat Severity

When there's any deviation or irregularity in a dataset, threat hunters investigate the anomaly. However, not all anomalies are equal. What might seem like a data breach to a threat hunter could be nothing more than a minor security vulnerability.

Overestimating the severity of a threat can cause unnecessary alarm, especially in large organizations, diverting resources from critical tasks. Focusing too much on minor anomalies can lead to alert fatigue, making it harder to identify real threats. This insensitivity wastes valuable time and resources. Threat hunters may spend hours on issues that are not problems, rather than proactively hunting for threats and developing security measures.

False Positives

It can also be difficult for threat hunters to distinguish between benign errors and malicious actors. Remember, internal threats aren't just about malicious users—they also include those who are careless with their credentials.

The difficulty of false positives is compounded by the massive amount of data that threat hunters must analyze. False positives not only waste time but also lead to a lack of trust in threat detection systems. Repeated false alarms cause hesitation in decision-making and slower response times. Investigating false positives often requires comprehensive log analysis and interdepartmental collaboration, which strains resources and reduces efficiency. Over time, this can lead to alert fatigue, making it easier to overlook real threats. Improving detection accuracy and reducing false positives are crucial for effective threat hunting.

Understanding these common mistakes is the first step toward improving threat hunting practices. However, beyond these pitfalls, threat hunters face broader systemic challenges that impact their ability to effectively detect and respond to threats.

The Three Major Challenges

The common mistakes that threat hunters make—overestimating threat severity and dealing with false positives—are often rooted in deeper issues. Tool problems, lack of focus time, and organizational barriers create an environment where these mistakes are more likely to occur. By overcoming these three major challenges, we can increase the effectiveness of threat hunting and reduce errors.

Tool Problems

Threat hunters rely on many different tools. Generally speaking, these tools can be categorized as technical or non-technical. Technical tools help with actual threat hunting, while non-technical tools mainly support note-taking, presentations, reporting, etc.

When asked about the disadvantages of their current tools, threat hunters mentioned a lack of compatibility between tools, low performance, and ineffective visualizations. These issues can cause wasted time in linking missed threats and results from disconnected tools.

Focus Time

Threat hunters constantly juggle different types of tasks. Switching between clients and moving between management and hunting tasks can be distracting.

Speaking of clients, threat hunters often work with several internal and external stakeholders. As you might imagine, communication and information sharing between these stakeholders can be challenging without a standard transfer protocol.

Organizational Barriers

Considering the importance of threat hunting, you might be surprised to learn that some internal resistance can occur. There are the usual suspects like resource allocation that all teams deal with. However, there are often cultural issues as well. Not all teams in an organization prioritize security. And sometimes teams prefer not to share information about threats.

Overcoming Threat Hunting Challenges

To succeed, threat hunters need support from all teams and the organization as a whole. Is there a way to help threat hunters avoid common mistakes and overcome their challenges? Ironically, the solution lies within the first challenge: teamwork. Survey participants said that the right tools can make a big difference. An integrated set of tools can help threat hunters detect anomalies more effectively and prioritize threats, saving time, increasing security, and building trust between threat hunters and the larger organizations they serve.

Stay tuned for the next post in this series to learn more about different threat hunter personalities.

Learn More About OpenText Cyber Security

Ready to empower your threat hunting team with products, services, and training to protect your most valuable and sensitive information? To proactively identify, prioritize, and investigate anomalous and malicious behavior, explore our modern complementary security solutions portfolio that provides 360-degree visibility across endpoints and network traffic for threat hunters and security analysts. View our cyber security portfolio.

Source: The Top Three Challenges of Threat Hunting - OpenText Blogs