Only 29% of almost a thousand government employees surveyed were able to say whether their agency practiced proactive threat hunting. Going into next year, that may need to change given provisions in the National Defense Authorization Act currently in consideration.
Versions of the legislation passed by both the House and Senate have called for the secretary of Homeland Security to assess the ability of the Cybersecurity and Infrastructure Security Agency to conduct threat hunting activities across the federal government and the private sector.
Lawmakers in the House have also laid out details for what a threat hunting program would look like within the defense industrial base. It would require participating entities to address any vulnerabilities identified and provide incentives for the private sector to also share information it finds with the government.
Threat hunting, according to cybersecurity firm CrowdStrike, relies on human intelligence to investigate and identify potential threats weeks or even months in advance of when they would be detected by relying solely on automated tools.
The survey, published in May 2019, was conducted by the Government Business Council, with 70% of respondents describing themselves as at least somewhat familiar with their organization’s cybersecurity programs. It suggests agencies may have kept rank and file workers in the dark about threat hunting programs. GBC is a division of Government Executive Media Group, Nextgov’s parent company.
“It is not uncommon for agencies to keep knowledge of threat hunting programs and practices to limited personnel,” the survey reads. “As would be expected, nearly two-thirds of respondents are not familiar with their organization’s threat hunting practices.”
The survey was then nar ..
Support the originator by clicking the read the rest link below.
