DAY 0

A 3-letter government agency calls you to inform that an advanced threat group has targeted organizations similar to yours and that your organization is likely to be one of them. They won’t tell how they know, but they suspect that there are already several breached systems within your enterprise. An advanced persistent threat, also known as an APT, may be involved. This is the most complex threat that you could face when trying to protect your data and systems. The adversaries may have been actively searching your network for months, or even years without being detected.
This is a hypothetical situation, but the chances are very high that hidden threats already exist inside your organization’s networks. Organizations can’t afford to believe that their security measures are perfect and impenetrable, no matter how thorough their security precautions might be. It is impossible to prevent human adversaries with specialized skills from getting around security systems. Organizations can’t afford to believe that their security measures are sufficient. This process is called incident response. “threat hunting”. Threat hunting is a proactive approach to finding new data breaches. It uses well-known adversary behaviors.
Over the last few years, Incident response and threat hunting techniques and procedures have changed rapidly. You cannot afford to use old-fashioned threat hunting and incident response techniques that fail in the detection of compromised systems, do not effectively contain the breach and then fail to swiftly remediate the situation. Incident response and threat hunting teams are essential to identify and observe malware patterns and patterns in order generate accurate threat intelligence to detect future and existing intrusions.

 Here’s what you can expect in the new book SANS FOR 508 Videos version 2019