COURSE 6 – CYBER THREAT INTELLIGENCE

Module 6: Threat Hunting

IBM CYBERSECURITY ANALYST PROFESSIONAL CERTIFICATE

Complete Coursera Study Guide

Enroll in Coursera IBM Cybersecurity Analyst Professional Certificate Here

TABLE OF CONTENT

INTRODUCTION – Threat Hunting

Welcome to an illuminating module dedicated to the art and science of threat hunting within Security Operation Centers (SOCs). Throughout this course, you will embark on a journey to uncover the methodologies and techniques employed in proactive threat hunting, a crucial practice in modern cybersecurity.

By delving into the intricacies of threat intelligence, data analysis, and proactive detection strategies, participants will gain invaluable insights into identifying and neutralizing threats before they escalate. Get ready to explore the dynamic landscape of threat hunting and discover how it serves as a cornerstone in fortifying organizational defenses against evolving cyber threats within SOC environments.

Learning Objectives

  • Investigate cybersecurity threats using QRadar Analyst Workflow
  • Describe the structure of a cyber threat hunting team
  • Apply the cyber threat hunting concepts to an industry example
  • Explain the primary goal of SOC cyber threat hunting
  • Explain why SOCs need to perform threat hunting
  • Discuss global cyber trends and challenges

THREAT HUNTING OVERVIEW KNOWLEDGE CHECK

1. Cyber threats pose many challenges to organizations today. Which three (3) of these are among those cited? (Select 3)

  • There is a cybersecurity skills shortage (CORRECT)
  • Almost half of the breaches are caused by malicious or criminal acts (CORRECT)
  • It takes an average of 191 days to even detect an attack has occurred (CORRECT)
  • There are too few cybersecurity tools available from too few vendors

Partially correct!

2. What percent of security leaders reported that threat hunting increased the speed and accuracy of response in detection of advanced threats?

  • 10%
  • 27%
  • 91% (CORRECT)
  • 100%

3. While 80% of the threats are known and detected, the 20% that remains unknown account for what percent of the damage?

  • 20%
  • 40%
  • 80% (CORRECT)
  • 100%

4. True or False. The skill set of a cyber threat hunter is very different from that of a cybersecurity analyst and many threat hunters a have backrounds doing intelligence work.

  • True (CORRECT)
  • False

5. Your enemy uses a cyber kill chain to plan and execute his attack against your organization. Which three (3) of these are steps in a cyber kill chain? (Select 3)

  • Delivery (CORRECT)
  • Reconnaissance (CORRECT)
  • Negotiation
  • Weaponization (CORRECT)

Partially correct!

6. True or False. A cyber threat hunting team generally sits at the center of the SOC Command Center.

  • True
  • False (CORRECT)

7. There is value brought by each of the IBM i2 EIA use cases. Which one of these delivers net new discovery of correlating low level alerts and offenses?

  • VIP Protection
  • Fraud Investigations
  • Insider Threat
  • Cyber Threat Hunting (CORRECT)

THREAT HUNTING GRADED ASSESSMENT

1. What is one thing that makes cybersecurity threats so challenging to deal with?

  • There is a big shortage in cyber security skills and many job openings unfilled (CORRECT)
  • Most organizations are faced with too few attacks to study effectively or dedicate full-time specialists to investigate
  • The large majority of “breaches” are inadvertent mistakes by employees which distracts from investigating the few that are from real cyber criminals
  • ‘There are too few cybersecurity tools available from too few vendors

2. The level 3 and 4 cybersecurity analysts working in a Security Operations Center (SOC) combat cyber crime by performing which type of activity?

  • Cyber forensic investigations (CORRECT)
  • Cyber data mining
  • Cyber threat hunting
  • Penetration testing

3. True or False. If you have no better place to start hunting threats, start with a view of your own organization then work your way up to an industry view and then a regional view, a national view and finally a global view of the threat landscape.

  • True
  • False (CORRECT)

4. Your enemy uses a cyber kill chain to plan and execute his attack against your organization. Which three (3) of these are steps in a cyber kill chain?

  • Recovery
  • Exploitation (CORRECT)
  • Installation (CORRECT)
  • Delivery (CORRECT)

Partially correct!

5. True or False. A cyber threat hunting team generally sits outside the SOC command center.

  • True (CORRECT)
  • False

6. There is value brought by each of the IBM i2 EIA use cases. Which one of these identifies net new money chain transfers?

  • Fraud Investigations (CORRECT)
  • VIP Protection
  • Insider Threat
  • Cyber Threat Hunting

CONCLUSION – Threat Hunting

In conclusion, this module has provided participants with a comprehensive understanding of threat hunting and its indispensable role within Security Operation Centers (SOCs). Through meticulous exploration of proactive detection strategies, threat intelligence utilization, and data analysis techniques, participants have gained the knowledge and skills necessary to identify and neutralize potential threats before they manifest into significant security incidents.

Equipped with this expertise, participants are poised to bolster the resilience of organizational defenses, ensuring proactive mitigation of evolving cyber threats within SOC environments. As they continue to apply the principles and practices learned in this module, participants will play a crucial role in safeguarding organizational assets and maintaining a vigilant stance against emerging cyber risks.

Previous Week
Next Course

Subscribe to our site

Get new content delivered directly to your inbox.

Quiztudy Top Courses

Popular in Coursera

Liking our content? Then, don’t forget to ad us to your BOOKMARKS so you can find us easily!

Subscribe