Stop cyber threats dead in their tracks with new training from Marc Quibell

It’s a busy time for cyber threat hunters, says new Infosec Skills author Marc Quibell. 

“The past eight years I've traveled around the United States helping people with their security postures,” Marc said. “I’ve assisted with a lot of incident response and ransomware events that crippled a company or a client.”

Now he’s bringing his 30 years of IT and security experience to Infosec Skills with his new Cyber Threat Hunting Learning Path.

Cyber Threat Hunting

Rise in need for cyber threat hunters

As businesses continue moving critical workflows to the cloud, risk and security experts are looking to move away from reactive cybersecurity measures to blocking digital threats before they become a problem. 

According to the 2020 Verizon Data Breach Investigations Report, attacks on web applications accounted for 43% of all data breaches — more than double the amount from the previous year — and 27% of all malware incidents were attributed to ransomware. For companies trying to level the playing field and bring some level of control to the threats, cyber threat hunters can be a security game changer.

“At the end of the day, cyber threat hunting is all about vigilance,” Marc said. “It's knowing what is going on in your network and having your finger on its pulse. It’s about understanding that attackers are trying to get in all the time, and you want to be there to make sure you discover threats or any anomalies.”

The new Cyber Threat Hunting Learning Path

The Infosec Skills Cyber Threat Hunting Learning Path consists of six courses and a hands-on project where you'll put your new skills to the test. As you progress through the courses, you’ll build core hunting skills such as intelligence gathering, investigation techniques and remediation methods. 

“After taking the new courses, you’ll be able to look at a network and say, ‘Hey, this isn't normal and now I need to take this next step,’” Marc said.

In the Cyber Threat Hunting Project, you’ll work through a real-life scenario to identify anomalies in network traffic patterns and then investigate malware. You'll use Wireshark to examine packet capture files for potential red flags and piece together the clues to identify and defeat the threat.

“Other things a good cyber threat hunter looks at are virus alerts, intrusion prevention or detection alerts,” Marc said. “Intrusion detections do generate more false positives, but they'll give you more anomalous notifications. It may not be an intrusion, but it could be something else. So having tools in place and then monitoring is part of the core of threat hunting activities."

How to get started in cyber threat hunting

For aspiring cyber threat hunters, Marc recommends gaining experience in Linux to understand how to use traffic capturing and other security tools. He says network knowledge is also useful so that you understand the basics of information technology.

“Let's say I'm log monitoring and get a Windows alert and I'm going crazy because I can't figure it out,” said Marc. “Well, you should know what those Windows alerts mean, what they are and what causes those alerts. If you don't, you'll be slower at your job or you’ll have a false sense of security. A good threat hunter doesn’t want either.” 

Not every organization has the resources to employ a full-time cyber threat hunting team or contract with an outside security operation center to provide full 24/7 monitoring and threat remediation. That’s why it’s good for every security professional to understand cyber threat hunting at a basic level, Marc said.

“Security is part of the job for most people from analysts to engineers and architects. It's a core responsibility. You need to know how to investigate, how to packet sniff, how to figure out what kind of traffic is occuring. Are you under a brute force attack? Are you under an APT attack? Is it malware? Is the attack coming from somebody inside? Is it somebody outside? Is there a hole in your firewall that's allowing this traffic? All of these questions can be managed by someone with cyber threat hunting skills.”

See Marc's courses

About Marc Quibell

Marc Quibell is a cybersecurity blue team expert with nearly 30 years of professional IT experience. In addition to being an Infosec Skills author, he’s a consultant and security architect with a Bachelors of Science in Technology Information Management from Upper Iowa University and an Associate of Applied Science in Computer Systems Networking from Texas State Technical College in Waco. Marc has been CISSP certified since 2009 and was previously CCNA, MCSE and CRISC certified.