Threat Hunting Engagement
Wɔ Ghana, cybersecurity ne data-protection anidasoɔ ho nsɛm no de fapem a wɔahyɛ ho ahye ma Threat Hunting Engagement a egyina adwene a wɔde hyɛ ase so, a egyina nhyehyɛe ho nkyerɛkyerɛmu a ɛyɛ adwuma mu, telemetry a wɔama kwan, bere a wɔpene so sɛ wɔbɛkora data, ne nsɛm a ɛyɛ nwonwa ho nhyehyɛe a wɔakyerɛ. BilgeQor hwehwɛ nsɛm a wɔahunu mu na ɛyɛ IOC anaa IOA nneɛma a ɛfa ho ne nyansahyɛ a ɛfa ntumi a wɔde hu asiane no ho ma bere a wɔapene so no. Ɛyɛ adwuma a wɔahyɛ ho ahye a ɛhwehwɛ sɛ wɔbisa kan, ɛnyɛ 24/7 hwɛ, SOC anaa MDR, ntɔkwaw a ɛrekɔ so mu ahyɛ, ahoɔden san, anaa adanseɛ sɛ wɔatwa wɔn ahobammɔ mu biara nni hɔ.
Yɛ ahunahuna ho nhwehwɛmu a wɔahyɛ bere a ɛbɛdi, na egyina adwene a wɔde resɔ ahwɛ so; fa nhyehyɛe no dwumadi ho nsɛm a wɔapene so sɛ wɔde bedi dwuma no nyinaa mu hwehwɛ, na yi nsɛnkyerɛnne, dwumadi a ɛma adwenem naayɛ ba, ne sintɔ ahorow a ebia kɔmputa no ankasa kɔkɔbɔ ahorow no anhu no adi.
Ɛfata wo sɛ
- ✓Woama nhwehwɛmu a ɔbenfo bɛyɛ ho kwan, na moapene nea wɔbɛsɔ ahwɛ, nea nhwehwɛmu no bɛfa ho, ne bere a wɔde bɛyɛ sɔhwɛ no anaa mmara a wɔde bɛyɛ adwuma no so.
- ✓Wuhia nhwehwɛmu a wɔakyerɛ nea ɛka ho ne n'ahye, a wɔyɛ wɔ nsusuwii ne anohyeto a wɔahyɛ no mu den pefee no mu
- ✓Wopɛ nea wɔahu a wɔakyerɛw ato hɔ ne nea wɔahyɛ no nsow a wɔahyehyɛ sɛnea ɛho hia fa, a efi adwuma a wɔde nhyehyɛe ne ahwɛso yɛ mu
- ✓Wunim sɛ eyi yɛ nhwehwɛmu a ɛwɔ ahyeɛ, ɛnyɛ ahobammɔ a ɛkɔ so daa anaa mfaso a wɔahyɛ ho bɔ
Ɛmfata wo sɛ
- –Wohia nhwehwɛmu a ɛnyɛ den anaa vulnerability nhwehwɛmu a wɔyɛ daa
- –Wuhia sɛ wɔdi tebea a egye ntɛmpɛ ho dwuma bere a ɛrekɔ so no ara anaa sɛ wɔyɛ sɔhwɛ a wɔmma ho kwan
- –Wohwɛ kwan sɛ wɔbɛma wo bɔhyɛ sɛ wobehu akwan a wɔfa so de nhyehyɛe mu mmerɛwyɛ di dwuma anaa wɔbɛma wo banbɔ a edi mũ
- –Wo hia 24/7 ɔhwɛ, MDR, anaa ahunahuna ho nhwehwɛmu a ɛkɔ so daa na ɛtrɛw sen adwuma no hye a wɔahyɛ.
Nea Ɛfata Pa
- Ahobammɔ akuw a wɔboaboa data a mfiri de ma fa wɔn dwumadi ho ano, nanso wonnyinaa nhyehyɛe so nhwehwɛɛ ahunahuna wɔ saa data no mu ɛ
- Ahyehyɛde a wɔresiesie wɔn ho ama akontaabu ne adwumayɛ mu nhwehwɛmu, akwankyerɛ kuw no nhwehwɛmu, anaa adwuma no fã titiriw a wɔde ma adetɔfo ahotoso, a kyerɛwtohɔ a ɛfa nea wɔahu wɔ ahunahuna hwehwɛ mu no bɛboa
- Akuw a wɔwɔ dadwen pɔtee, nsusuwii a wɔpɛ sɛ wɔsɔ hwɛ, anaa nsakrae a aba nnansa yi a wɔpɛ sɛ wɔhwehwɛ mu wɔ berɛ a wɔahyɛ ano mu
- Adwumakuo a wɔpɛ sɛ obi a ɔnka wɔn ho hwɛ wɔn telemetry, a wɔnhyɛ continuous monitoring apam mu
Nneɛma a Yɛhwehwɛ Mu
- Adwemmɔ a wɔapene so a wɔde bɛhwehwɛ ahobammɔ ho ahunahuna, a wɔkyerɛkyerɛ mu na wɔhyehyɛ no sɛnea ɛho hia bere a wɔrekyerɛ adwuma no mu anohyeto
- Mfiri ne nhyehyɛe dwumadi ho nsɛm fibea a wɔapene so mu nhwehwɛmu wɔ bere a wɔapene so no mu — mfiri a ɛka ntamgyinae no ho, wɔn a wɔde nhyehyɛe no di dwuma ne wɔn ho adanse, intanɛt so kɔmputa nneɛma, ntamgyinae, anaa aplikɛhyɛn dwumadi ho kyerɛwtohɔ, sɛnea ɛka adwuma no hye ho
- Nhwehwɛmu wɔ nneyɛe a ɛma adwene mu naa ba a wɔahu bere a wɔrehwehwɛ ahunahuna no ho
- Nea wɔahu no mu nhwehwɛmu ne nkyekyɛmu sɛnea ɛho hia, de gu nsɛm a ɛma ntease, nea ɛma adwenem naayɛ, ne nea wɔasi so dua sɛ ɛfata sɛ wɔde adwene si so no akuw mu
- Adanse nneɛma a ɛkyerɛ sɛ wɔasɛe nhyehyɛe bi mu ahobammɔ (IOC) ne nea ɛkyerɛ ntua (IOA), wɔ baabi a ɛfa nsusuwii a wɔapene so no ho
Nneɛma a ɛsɛ sɛ wɔde ma
Ahwehwɛde a ɛsɛ sɛ wodi kan di ho dwuma ne tumi a wɔde ma
- +Tumi krataa a nea nsɛm no yɛ ne dea de ma sɛ wɔnkɔ mfiri dwumadi ho nsɛm fibea a wɔapene so no mu
- +Baabi a wonya mfiri dwumadi ho nsɛm a wɔboaboa ano, bere ahorow a wɔde sie saa nsɛm no, ne ɔkwan a wɔfa so nya saa nsɛm no ho nsɛm a wɔahyehyɛ, a wɔapene so na wɔde asi pi wɔ krataa so
- +Bere a wɔapene so sɛ wɔde bɛhwehwɛ asiane ho nsɛnkyerɛnne, a wɔakyerɛ bere a wɔbɛhyɛ ase ne bere a wɔbɛgyae
- +Nsusuwii a wɔapene so a wɔde bɛhwehwɛ kɔmputa nhyehyɛe mu ahunahuna ne anohyeto biara a ɛfa nneɛma a ɛho hia sɛ wɔhwɛ so yiye ho, a wɔakyerɛw ato hɔ ansa na adwuma no afi ase
- +Nkitahodi nnipa titire ne backup a wɔadi wɔn din, a wotumi nya wɔn bere nyinaa wɔ hunt bere a wɔapene so no mu
- +Provider, cloud, anaa identity-platform kwan a wɔagye wɔ baabi a ɛho hia ma telemetry access
Nneɛma a Ɛnka Ho ne Ahye
- Eyi yɛ adwumayɛ a wɔahyɛ bere a ɛbɛba awiei; ɛnyɛ nhwɛso a ɛkɔ so daa anaa MDR nhyehyɛe
- SOC adwuma a wɔyɛ dɔnhwerew aduonu anan, kɔkɔbɔ ho mmuae a wɔyɛ bere a wɔfrɛ wɔn, ne ahunahuna a wɔhwehwɛ hu na wɔhwɛ so no nka ho
- Ahobammɔ ho asɛm a ɛrekɔ so mprempren ho mmuae, ano a wɔbɛsiw, ne nhyehyɛe no a wɔbɛsan ama ayɛ adwuma no nka ho, gye sɛ wɔahyɛ eyinom ho adwuma ahye wɔ ɔkwan soronko so.
- Nneɛma foforo a ɛboaboa nhyehyɛe no adwumayɛ ho nsɛm ano de mena, mmoa dwumadi, anaa akwan a wɔfa so kyerɛw nhyehyɛe no mu nsɛm boaboa ano a wɔde bɛfi ase ayɛ adwuma no nka ho, gye sɛ wɔayɛ ho apam soronko.
- Saa adwuma yi nhyɛ bɔ sɛ wobehu ahunahuna a ɛwɔ kɔmputa nhyehyɛe a wɔreyɛ ho adwuma no mu nyinaa
- Wɔnma adansedi, tumi-kwan nkrataa, anaa adanse biara a ɛkyerɛ sɛ wodi mmara ne ahyɛde so wɔ dwumadie yi mu.
- Mmerewyɛ a wɔahu no ho nsiesie a wɔde bɛyɛ no nka ho, gye sɛ wɔahyɛ ho ahyɛde soronko
Sɛnea Ɛyɛ Adwuma
Adwuma no hye ne nsusuwii a wɔbɛsɔ ahwɛ no a wɔbɛkyerɛ
Yɛpene hunt hypotheses, telemetry sources a ɛwɔ scope mu, bere a wɔbɛyɛ hunt no, kwan a wɔfa so nya access, nsɛm a ɛyɛ nwonwa ho ano hye, ne gyinabea a ɛma wogyae. Wɔkyerɛw biribiara ansa na adwuma no refi ase.
Ho kwan a wɔma ne access
Wɔhwɛ hu sɛ nsɛm no wura ama kwan wɔ nkyerɛwee mu, na wɔanya pene biara a ɛho hia fi wɔn a wɔde ɔsom no ma no hɔ. Wɔhyehyɛ ɔkwan a wɔfa so nya nhyehyɛe no dwumadi ho nsɛm a wɔboaboa ano wɔ akyirikyiri no fi mmeae a wɔapene so no, wɔ ahye a wɔapene so no mu.
Ahunahuna Hwehwɛ Adwuma no a Wɔyɛ
Yɛsɔ nsusuwii a yɛapene so no hwɛ de toto mfiri no dwumadi ho nsɛm a wɔboaboa ano a ɛwɔ adwuma no ahye mu no ho wɔ bere a yɛapene so no mu. Yɛhwehwɛ nneɛma a ɛkɔ so wɔ akwan a ɛma adwenem naayɛ so no mu, na bere a nea yehu no da adi no, yɛhyehyɛ no sɛnea ɛho hia sɛ yedi ho dwuma ntɛm no.
Amanneɛbɔ
Yɛde nea nhwehwɛmu no ada no adi ho amanneɛbɔ, IOC ne IOA ho nneɛma a wɔaboaboa ano wɔ baabi a ɛfata, nyansahyɛ wɔ nneɛma a ɛho nhyehyɛe no nni tumi nhwehwɛ nhu ne nsɛm a nhyehyɛe no ankasa susuw na ɛboaboa ano mu nea enni hɔ ho, ne nhwehwɛmu a ɛsɛ sɛ wɔde di kan wɔ akyidi mu ma.
Adwuma no Akyi Nkɔmmɔbɔ
Yɛne mo ahobammɔ ne mfiridwuma ho adwuma no mu kyɛfafo yɛ nhyiam de san susuw adwuma no ho, ka ɔkwan a yɛfaa so hwehwɛɛ ahunahuna, nea yehui a ɛho hia, ne anammɔn a edi hɔ a wɔahyehyɛ sɛnea ɛho hia fa ho.
Bisrɛ dwumadi no mu di kan. Yɛsi botaeɛ, tumi krataa, sɔhwɛ bere ne yɛbea mu nhyehyɛeɛ so dua wɔ nkrataa so ansa na dwumadi adetɔ foforo biara aba. Kratafa yi nnye sika, na ɛmfi nimdeɛ adwuma ase. Nimdeɛ adwuma biara nfi ase ansa na wɔama dwumadi no mu tumi.
Nea adwuma no ka ho ne bo a wɔde bɛyɛ
Adwuma no hye ne bo a wɔbɛbɔ no awiei gyina nea wɔama kwan sɛ wɔnsɔ nhwɛ, adwumayɛ tebea, ne sɔhwɛ ho nhyehyɛe a wɔapene so no so.
Nsɛm a Wɔtaa Bisa
Woasiesie wo ho sɛ wobɛka w'adwuma no mu nea ɛka ho ne anohyeto ho asɛm?
Ka nea wopɛ sɛ wosɔ hwɛ, nhyehyɛe ne tebea a ɛwɔ mu, ne bere a wɔbetumi ayɛ sɔhwɛ no ho asɛm kyerɛ yɛn. Yɛbɛsan de adwuma no bo ho nkrataa a ɛkyerɛ adwuma no hye ama wo.