What is Threat Detection Engineering (TDE)?
While traditional cybersecurity may provide the first line of defense against basic or well-known attack methods, newer or more advanced threats might still go undetected. For instance, traditional antiviruses work by scanning a system for traces of programs known to be malicious. However, an antivirus will not be able to recognize signatures that are unknown to the provider. This is why antiviruses must be continually updated with the signatures of the newest known malware if they are to remain effective.
Threat Detection Engineering (TDE) is a proactive cybersecurity practice that focuses on threat detection, prevention, and mitigation. The main component of TDE is code written by the Threat Detection Engineer.
Code written with a threat detection engineering strategy will not only be able to monitor what is being used on a given device but how it is being used. This means that the TDE system will be able to establish a regular baseline of user behavior, and the ability to trigger an alert if there is a suspicious deviation in this behavior. This is indispensable for a more advanced cybersecurity system because attackers have been known to engage in malicious activity through legitimate programs, instead of relying on more potentially conspicuous malware, which would be detected by an antivirus. For instance, Rclone is a legitimate tool commonly used for managing cloud storage. However, it is also a popular tool among threat actors, who have been known to use it for data exfiltration. For a traditional antivirus, it would not be possible to detect the use of Rclone, let alone distinguish normal user behavior from its criminal use.
By creating custom code and detection rules, threat detection engineers can effectively identify and respond to potential threats before a breach occurs, rather than relying on the threat having been seen before.
Components of Threat Detection Engineering
There are three main components that contribute to effective TDE.
Threat Intelligence
Before writing any code, it is important to have a clear understanding of the potential threats to the system. This can come from sources such as threat alerts, reports, or observations. Threat intelligence involves understanding key factors that contribute to the threat landscape, such as industry, type of organization, the main threat actors in the sphere, and their preferred cyberattack methodologies.
Code
With the necessary information at hand, Threat Detection Engineers are able to best write code that is able to best detect potential threats, and create alerts that monitoring teams will see and respond to. Most of this code is comprised of detection rules, which provide the cybersecurity system with a set of instructions to search for and identify threats. Like all other forms of cybersecurity, detection code must be continually updated with the latest threat intelligence on the most current threats if it is to remain relevant and effective.
Threat Detection Engineers
The threat detection process inevitably involves human monitoring and intervention. It is essential to have trained staff and enough resources in order to properly respond to threat alerts as soon as they happen. It is important to note that an alert will be useless unless there is a cybersecurity specialist there to react to it.
The Ever-Growing Importance of TDE for Organizational Security
The threat landscape is constantly shifting and evolving. As such, organizations must be ready to identify and mitigate the newest threat, whether it may be a sophisticated attack from an advanced threat actor or a more common threat with a new spin on it. This ever-changing plethora of threats makes it imperative to have in place a system that will be able to detect suspicious activity regardless of whether a threat is known or not. As stated above, TDE does this by monitoring user behavior, and establishing patterns of typical use, which it then uses to detect deviations and create alerts accordingly.
Ultimately, TDE is a value-add proposition. When it comes to finding a reliable defense against cyber threats, commercial products are not the only way to go. Many products lack the sophistication and particular tailoring that threat detection engineering services provide. Unlike commercial products, TDE comes with specialized skill sets that can be tailored to a client's exact needs and requirements. The convenience of having this service available cannot be understated in today's digital world, where businesses are increasingly vulnerable to security risks but equally varied in their thread landscapes and detection needs.
Key Practices for Implementing TDE
Organizations must engage in diligent threat modeling if they are to engineer a successful detection system. Therefore, it is essential that they follow these key practices to maximize their security incident detection and response.
Know the IT Operating Environment
A common failing of organizations is a lack of knowledge concerning their operating environment. This means that they do not keep a strict record of, for instance, how many devices they have, what they are being used for, and how and where they are connected to the internet while on or off premises. Without a clear understanding of the operating environment, it is impossible for threat detection engineers to know which programs should be allowed, where attacks could be coming from, and what areas a threat detection engineering system must engage in. This makes it difficult to write detection rules that will conduct successful security operations.
Know What Data to Monitor
It is only after an operating environment is mapped out that security professionals can identify areas to monitor to collect relevant data or telemetries. This involves considering the areas where breaches are most likely (sometimes using vulnerability reports) and understanding the techniques of the most common threat actors in the industry, which will allow an organization to be able to produce a response to specific threats.
Our Ankura InterXeptor MDR (Managed Detection and Response) categorizes data into four types:
- Endpoint Data
- Logs Data
- Network Data
- Cloud Data
Understanding what parts of the operating environment are most likely to be targets of bad actors is a key part of TDE, as threat detection engineers attempt to identify suspicious behavior and generate alerts. Without the right data, security teams are likely to miss important anomalies, or experience alert fatigue, especially with high false positives.
Know How to Interpret Data
Nonetheless, collecting the right data is not the end of the story: while many organizations monitor the information, they lack the know-how of interpreting the data. There can be so many factors to look out for that a security team may not know how to prioritize or focus its threat hunting. For successful and efficient security, either in-house or outsourced teams must be knowledgeable of the various methods computers and networks that can be breached (tactics, techniques, and procedures (TTPs)), identify which are most critical to hunt for/detect based on potential threats to the business at hand, as well as adjust detection tools/mechanisms appropriately.
Proactively Test the TDE System
As threat detection engineering has become an essential part of any organization's preventative measures to protect against unwanted cyber threats, having a strategy for testing and validating the efficacy of such threat detection is just as important for threat hunters. Testing can involve placing a simulated threat on the platform, triggering a pre-existing threat detection, or even fully simulating an attack campaign. Doing so allows organizations to make sure their threat detection methods are up to date with what their security infrastructure requires. They can also take into account when threat detections become outdated and require retirement from the system, therefore reducing unnecessary threat notifications from appearing in its security operations center.
Concluding Remarks
Threat Detection Engineering (TDE) is an IT security practice to hunt for signs of threats and compromise and alert security teams about any malicious activity before the threat can spread across the entire infrastructure of the organization. It does so by continually monitoring user and systems activities, establishing an understanding of 'normal behavior', and creating alerts when this behavior changes in suspicious ways. The alerts go to a team of experts who will then evaluate the situation, and decide on the best way to isolate and neutralize the threat.
TDE is a good choice for organizations willing to invest in the latest advanced, reliable, and tailored cybersecurity measures to protect valuable and sensitive data.
However, while it is possible to build TDE operations from scratch, this can be difficult and costly. This is why hiring a reputable third party may be advisable in most cases. A good TDE provider can not only protect against potential threats but also remove existing ones before they have a chance to cause any harm. Considering the level of expertise offered by TDE, it is clear why it is so much more reliable than traditional commercial cybersecurity products.
What we do at Ankura
At Ankura, we specialize in threat detection engineering (TDE) and have the experience, knowledge, and processes necessary to protect organizations from potential cyber threats. When engaging with clients, our team takes time to understand their operating environment and specific needs before creating a tailored threat detection solution. Our cybersecurity experts are technology-agnostic, striving to recommend the best tools for the job, regardless of other incentives. From endpoint monitoring to cloud security and log systems, we are well-equipped to handle all aspects of threat detection engineering ensuring that businesses remain secure against malicious attacks. This is why threat detection engineering has become an essential part of any organization's preventative measures against unwanted cyber threats. Having reliable strategies and techniques for testing and validating the threat detection process is just as important, which is why Ankura has become a trusted provider of threat detection engineering services.
© Copyright 2023. The views expressed herein are those of the author(s) and not necessarily the views of Ankura Consulting Group, LLC., its management, its subsidiaries, its affiliates, or its other professionals. Ankura is not a law firm and cannot provide legal advice.
