Hanford Team Hunts Cyber Threats Before They Strike

Meet the Hanford Site’s Digital Forensics and Incident Response Team with contractor Hanford Mission Integration Solutions. From left: Zoran Djuric, Thomas Collette, John Shaw, Joe Garry, Daniel Johann, Corey Hopper and Ashlee Gonzales.

RICHLAND, Wash. — When it comes to cybersecurity and protecting the Hanford Site’s vital information, simply monitoring the network and waiting for an alarm to sound is not enough. Skilled analysts at the Hanford Field Office (HFO) are actively combing through the site’s expansive computer networks to uncover hidden risks.

Hanford’s Digital Forensics and Incident Response (DFIR) team is taking a bold, proactive approach with its new Threat Hunting program, deliberately searching for trouble across more than 10,000 connected devices. In many ways, it’s like searching for breadcrumbs in a forest.

“The Hanford Site utilizes a comprehensive strategy to protect its sensitive and proprietary information and maintain a strong cybersecurity posture,” said Paul Boehning, HFO director of information management and chief information officer. “The DFIR team is a key part of that strategy, identifying small clues before they turn into bigger issues.”

Analysts say attackers often hide by using tools that are already part of the network. By carefully planning hunts, collecting system logs, analyzing anomalies, and validating findings against threat intelligence, the team can confirm there are no active threats on the network and strengthen defenses against future attempts.

The DFIR team, managed by contractor Hanford Mission Integration Solutions (HMIS), says hunts for threats can last hours or weeks depending on the complexity, and no two are alike.

“No network can be completely secure,” said Joe Garry, Security Operations and Engineering manager with HMIS. “But the more difficult we make it for attackers, the more likely they’ll give up and look elsewhere.”

The program started in 2023 and now includes six DFIR specialists. While the team has not found an active threat in 50 hunts, they have created more than a dozen new defenses that keep Hanford’s critical systems secure.