Assessment Objective

Determine if:

• a cyber threat-hunting capability is established to search for indicators of compromise in organizational systems.
• a cyber threat-hunting capability is maintained to search for indicators of compromise in organizational systems.
• a cyber threat-hunting capability is established to detect, track, and disrupt threats that evade existing safeguards.
• a cyber threat-hunting capability is maintained to detect, track, and disrupt threats that evade existing safeguards.
• the threat-hunting capability is employed[Assignment: frequency].

Assessment Methods

Examine

• Risk assessment policy
• assessment reports
• audit records and/or event logs
• threat-hunting capability
• system security plan
• other relevant documents or records

Interview

• Personnel with threat-hunting responsibilities
• system/network administrators
• personnel with information security responsibilities

Test

• Processes for assessments and audits
• mechanisms or tools supporting and/or implementing threat-hunting capabilities

Povezani zadaci

• NIST -

  https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final