The industry is quickly maturing beyond the need to just respond to attacks. Given the increasing risk associated with digitized business, organizations are realizing they need to assess threats targeting their own organization and stay ahead of attackers. They need to understand what might happen next, as well as what has already happened. This requires actively looking at the files across all sources of incoming digital content including email, web, file shares, file upload applications and storage, software releases and supply chain. This is the underlying driver behind the Malware Lab- to centralize malware analysis and research, consolidate tools, and automate processes in order to gain visibility into how threat actors might attack their organization, as well as serve the needs of incident responders.
In this session, we’ll discuss:
- Why organizations are moving toward understanding adversary and attack behaviors locally, and those trends likely to impact their business.
- What key capabilities are required as part of the “Malware Lab” to not only respond to attacks, but to provide the needed visibility to thwart adversaries before they attack.
- How to consolidate and optimize file analysis tools, (e.g. static and dynamic analysis), accelerate investigation times and hunt for latent threats.
- How to apply more explainable IOCs and actionable insights on malicious payloads to prepare for an adversary's attack in advance.