Summary
The threat hunt team is there to counter an adversary. This countering extends beyond just the cyber domain. The team's top priority should always be to protect the data that they gather for the hunt. Encrypt transmissions and data storage, and maintain accountability for any portable devices that could have data on them. To protect the data, the team's equipment must also be strongly secured both logically and physically. Control the team's operating spaces as much as possible. When operating space security is limited, secure the equipment as much as is reasonably possible.
Above all else, the team members themselves are more valuable than any piece of data or equipment. Some adversaries have worked physical exploitation into their attack processes. Always protect yourselves and each other. Now that we have covered how to not become the vulnerability during a hunt, in the next chapter, we will take a closer look at some sample hardware and toolsets that are...
