Protecting the team
Why would there be a section in a cyber threat hunting book that discusses personal protection? While the hunt itself is executed in a place that is made up entirely of the 1's and 0's of the electromagnetic spectrum, those doing the execution live in the physical domain. The physical domain has threats that encryption will not address; for certain adversaries, the simplest way to ensure success is to remove the opportunity for a defender to defend the enterprise. This could be through physical manipulation, theft, or even violence. Will this be the case for the majority of hunt operations that teams undertake? No. Physical interaction with adversaries is possible when dealing with an inside threat or when the adversary is of the higher tiers, such as organized crime or nation-state actors.
A threat hunt can put teams into very interesting positions where...
