An Interview Study on Third-Party Cyber Threat Hunting Processes in the U.S. Department of Homeland Security

2024/02/19 by William P. Maxam, Maxam, William P., James C. Davis +1 · 3 citations
Computer Science · Social Sciences · #Cryptography and Security (cs.CR) #Cybercrime and Law Enforcement Studies #Cybersecurity and Cyber Warfare Studies #FOS: Computer and information sciences #Information and Cyber Security #Software Engineering (cs.SE)

paper · pdf · doi:10.48550/arxiv.2402.12252

openalex publication_date 2024/02/19 · openalex created_date 2025/10/10 · openalex updated_date 2026/07/28

Abstract

Cybersecurity is a major challenge for large organizations. Traditional cybersecurity defense is reactive. Cybersecurity operations centers keep out adversaries and incident response teams clean up after break-ins. Recently a proactive stage has been introduced: Cyber Threat Hunting (TH) looks for potential compromises missed by other cyber defenses. TH is mandated for federal executive agencies and government contractors. As threat hunting is a new cybersecurity discipline, most TH teams operate without a defined process. The practices and challenges of TH have not yet been documented. To address this gap, this paper describes the first interview study of threat hunt practitioners. We obtained access and interviewed 11 threat hunters associated with the U.S. government's Department of Homeland Security. Hour-long interviews were conducted. We analyzed the transcripts with process and thematic coding.We describe the diversity among their processes, show that their processes differ from the TH processes reported in the literature, and unify our subjects' descriptions into a single TH process.We enumerate common TH challenges and solutions according to the subjects. The two most common challenges were difficulty in assessing a Threat Hunter's expertise, and developing and maintaining automation. We conclude with recommendations for TH teams (improve planning, focus on automation, and apprentice new members) and highlight directions for future work (finding a TH process that balances flexibility and formalism, and identifying assessments for TH team performance).

Cited by

• From Retrieval to Reasoning: A Framework for Cyber Threat Intelligence NER with Explicit and Adaptive Instructions
• Automated Attack Testflow Extraction from Cyber Threat Report using BERT for Contextual Analysis
• Hunting in the Dark: Metrics for Early Stage Traffic Discovery

Related

• Fuzzy to Clear: Elucidating the Threat Hunter Cognitive Process and Cognitive Support Needs
• A systematic literature review on cyber threat hunting
• How do information security workers use host data? A summary of interviews with security analysts
• Human Aspect of Threat Analysis: A Replication
• Enhancing Cyber Threat Hunting -- A Visual Approach with the Forensic Visualization Toolkit