What is cloud threat hunting?
Threat hunting involves a systematic, continuous search to find and eliminate malicious activity within an organization’s environment. Active threat hunting complements automated tooling, such as EDR, WAF, and CWPP, with human expertise, enabling organizations to uncover active threats deep in their infrastructure.
How has threat hunting changed in the cloud?
The multicloud model has brought enhanced agility, scale, and flexibility—as well as a new threat model. Cloud attackers use different tactics, techniques, and procedures (TTPs), requiring threat hunters to evolve with new tools and new sources of telemetry to detect and investigate. The proactive approach of cloud threat hunting remains essential, allowing companies to tackle new attacks, evade threats, safeguard digital assets, and maintain operational resilience.
Quickstart Cloud Incident Response Template
The only IR plan template on the web built with the cloud in mind.
Download Template
Key attributes of a cloud threat hunting solution
Proper tooling is key to enable threat hunters to work effectively in this new environment. Below, we cover the primary components any such tool should have.
Real-time monitoring and threat detection
Cloud threat hunting requires real-time and continuous monitoring of user activity, data events, audit logs, flow logs, IDP logs, PaaS logs, and runtime events from virtual machines and containers.
Analyzing all these sources of telemetry in real time, especially in ephemeral cloud environments, is critical to enable identification of possible security issues by assessing deviations from established baselines and recognizing unusual patterns. When threats are detected, analysts need to take action immediately: because of the centralized control plane, attackers can move through cloud environments significantly faster than in traditional environments, making real-time detection and response even more important.
The Cloud Threat Landscape
A comprehensive threat intelligence database of cloud security incidents, actors, tools and techniques.
Explore
Cloud-Native User and Entity Behavioral Analysis (UEBA)
Security teams need advanced analytics when examining vast amounts of telemetry data from multiple sources in a multicloud environment. These data sources need to be normalized and modeled in a cloud-native way, enabling threat hunters to easily understand behavioral baselines for not just users and machines, but also cloud-native entities like storage buckets, IAM roles, serverless functions, and more.
Working with behavioral baselines, threat hunters can analyze anomalous activity that may bypass security measures and uncover hidden risks.
Incident response and remediation
Cloud threat hunters must carry out prompt and efficient incident response in the case of a security incident to limit harm, isolate compromised systems, and put root cause analysis (RCA) procedures in place.
Incident response activities may also involve patching vulnerabilities and upgrading security configurations to facilitate the swift resumption of regular operations.
Threat intelligence integration
To improve their threat comprehension, cloud threat hunting teams need access to threat information feeds and analysis. Threat actors use different tactics, techniques, and procedures (TTPs) in the cloud than in traditional environments: instead of deploying malware to encrypt data, threat actors may leverage IAM credentials to exfiltrate data through the control plane.
External threat intelligence sources like threat feeds, industry reports, and open-source data can keep you up-to-date on the latest cloud-native attacker tactics and better prioritize threat hunting activities.
Benefits of cloud threat hunting
Done properly, cloud threat hunting results in several key advantages that enhance your overall cybersecurity resilience.
| Benefits | Description |
|---|---|
| Early threat detection | Due to the centralized control plane in cloud environments, attackers can move extremely quickly to move laterally and exfiltrate data. Defenders need to move just as fast, and cloud threat hunting is a vital step to increase the speed of both validating existing alerts and proactively detecting new Indicators of Compromise (IOCs) which may not have been picked up by automated tooling. This lowers the risk of a data breach, compromise, or service disruption, protecting your brand and limiting financial loss. |
| Enhanced situational awareness | By giving you more insights into your multicloud settings, cloud threat hunting helps you spot new threats, weak points, and security gaps. Organizations can obtain actionable insights into their security posture and prioritize resource allocation. This, in turn, lets them address key security concerns by continuously monitoring and analyzing security telemetry data throughout their cloud infrastructure. |
| Continuous improvement | Cloud threat hunting encourages innovation and constant improvement. Organizations today must adjust to changing threat environments, evolving attack methods, and shifting business needs. Threat hunting equips organizations to handle these demands by giving an accurate view of potential attack vectors in the face of changing technologies, procedures, and tools. Over time, enterprises can also increase the efficacy of their cloud threat hunting skills by implementing enhancement initiatives. |
Challenges to adopting cloud threat hunting
Despite its clear benefits, cloud threat hunting presents several hurdles that organizations must overcome.
| Challenges | Description |
|---|---|
| Multicloud complexity | Handling security on several cloud platforms can get complicated since every platform could have different security features, setups, and logging systems. Ensuring uniform security rules and visibility across many cloud environments can also be difficult. |
| Data visibility and integration | Security teams may find it challenging to obtain a cohesive understanding of their security posture due to telemetry data being dispersed across several platforms. |
| Skills shortage | The hunt for cloud threats necessitates specific knowledge and abilities, such as familiarity with cloud security best practices, threat analysis, incident response, and cloud native security platforms and tools. Unfortunately, a lack of qualified cybersecurity experts with the necessary training and expertise makes it difficult for businesses to create and sustain efficient cloud threat hunting. Plus, they also have to perform continuous upgrading and upskilling. |
| Threat actor sophistication | The sophisticated TTPs employed by malicious actors today involve complex tools and strategies to circumvent detection in multicloud systems. Threat actors in the cloud use stealthy strategies to avoid detection by automated systems. Often, cloud threat actors do not even deploy malware, instead leveraging compromised identities to move laterally through the control plane. These kinds of tactics can often fly under the radar of threat hunters looking for traditional indicators of compromise (IOCs). |
The role of security teams in cloud threat hunting
Cloud security teams play a critical role in properly executing cloud threat hunting initiatives. Below, we discuss the top attributes your team will need to execute their threat hunting activities effectively.
Clear ownership and accountability: Security teams need to designate specific individuals to handle monitoring, analysis, and remediation for cloud threat hunting operations.
Collaborative incident response: To coordinate an efficient response to an incident and reduce its impact on operations, you’ll have to work closely with other stakeholders, such as IT ops, legal teams, support, and senior leadership.
Continuous skills development: Organizations need to keep up with the latest developments in tools, techniques, and threats to help improve their knowledge and proficiency in threat hunting and properly safeguard a multicloud estate.
Hunting for signs of persistence in the cloud: an IR guide following the CircleCI incident
Read more
The cloud threat hunting process
Hunting down threats in a multicloud system entails several key steps for a security team:
Data collection: Gather and compile data from numerous sources, such as CSP audit logs, host telemetry, identity provider logs, and more.
Hypothesis formation: Create hypotheses regarding possible threats and weaknesses in the environment based on an analysis of the gathered data.
Data analysis & triage: Evaluate the gathered information to confirm theories and set priorities for action according to the gravity and significance of identified threats.
Incident response and remediation: Carry out incident response protocols to respond to potential risks and resume regular operations following a confirmed security incident.
Ongoing improvement: Conduct regular reviews and evaluations of your threat hunting efforts, finding areas for improvement and putting remedial measures in place to boost your overall security posture.
Cloud Security Threat Report
The Wiz Threat Research team looks back on the past year to highlight trends and the state of multi cloud usage based on visibility across our customer base.
Download Report
Tools required for cloud threat hunting
Several solutions can help you with your cloud threat hunting efforts. By leveraging these together, organizations can enhance their ability to proactively identify and mitigate security threats, bolstering their cybersecurity posture in the face of evolving threats.
Features and capabilities
Along with, and as part of, the attributes discussed above, effective cloud threat hunting demands advanced tools and technologies that provide:
Scalability: The capacity to handle and examine data from various sources in multicloud setups
Real-time alerting: Automated alerts that instantly inform the security team of possible events so that they can take the appropriate actions
Integration: Ability to correlate threat hunting data with other sources of security intelligence via seamless integration with security tools and technologies
ML and AI: Utilizing advanced analytics via artificial intelligence and machine learning to spot patterns and abnormalities that point to hostile activities
Cloud detection and response (CDR)
These tools offer the ability to detect and respond to security problems in real time by combining security telemetry data from several sources and automating the analysis and correlation.
Cloud native application protection platforms (CNAPPs)
CNAPPs include a variety of instruments designed specifically for cloud settings, including:
Cloud security posture management (CSPM): Security configuration management tools that guarantee compliance with best practices
Vulnerability management: Practices for locating and ranking cloud infrastructure vulnerabilities
Threat hunters in cloud environments can use these instruments to provide vital context about the environment as they investigate.
Cloud infrastructure entitlement management (CIEM)
CIEM solutions assist enterprises in upholding the least privilege principle and reducing identity-related risks by controlling access rights and permissions within cloud environments.
Security information and event management (SIEM)
SIEM tools provide centralized logging and analysis capabilities via threat identification and investigation. They do this by gathering and connecting security events throughout your infrastructure.
Threat intelligence platforms (TIPs)
By offering insights into threats and mitigation strategies from external threat intelligence feeds, TIPs help businesses improve their threat hunting efforts.
Cloud access security broker (CASB)
CASB solutions guarantee a uniform security posture and adherence to legal regulations. They achieve this by enforcing security guidelines and regulations across cloud environments.
Wiz's cloud threat hunting solution: Empowering organizations for seamless threat detection and response
A special combination of CSPM, CIEM, and CDR capabilities forms the basis of Wiz's cloud threat hunting solution:
CDR provides real-time threat detection and response across all your cloud environments. Wiz CDR correlates security telemetry data from multiple sources, including network, endpoint, and application logs, allowing you to promptly uncover and remediate issues.
CSPM gives you complete insights into your cloud infrastructure, making it easier to spot setup errors and enforce security best practices. By continuously monitoring cloud resources and configurations, Wiz CSPM helps proactively identify security gaps and vulnerabilities that could be exploited.
CIEM offers cloud identity, access control, and security. Wiz's CIEM capabilities identify and resolve risks linked to excessive permissions, unauthorized access, and other IAM issues that jeopardize your security posture.
Wiz's cloud threat hunting solution signifies a fundamental shift in cybersecurity for multicloud settings, simplifying the process for enterprises by merging CSPM, CIEM, and CDR capabilities.
Wiz helps you stay ahead of emerging threats, respond to security incidents, and boost your cybersecurity resilience via its integrated strategy, unified management capabilities, and emphasis on efficiency.
Sign up for a personalized demo to see Wiz in action today.
See Your Cloud Activities Come to Life
Schedule a demo to learn how Wiz can detect and analyze threats in context so that you can prioritize, investigate, and respond quickly to the right risks.
