From recent research...
Upon notification of potential malware infection, SOC analysts tend to spend more time trying to confirm the malware infection, whereas IR/DF analysts tend to assume infection and move toward understanding impact.
Upon notification of potential malware infection, SOC analysts tend to spend more time trying to confirm the malware infection, whereas IR/DF analysts tend to assume infection and move toward understanding impact.
Usually, this results in different investigative actions. Confirming infection focuses more on the leading portion of the timeline relevant to the current event. Exploring impact focuses more on the trailing portion of the timeline.
Sometimes the investigative actions can look the same, but that depends on the malware and how the infection presents. Even with similar investigative actions, the intent is different.
I don't think this is too surprising given the nature of the roles and where they come into the process. But, it's food for thought on how the specialties mold folks initial approach and where some additional assumptions creep in.
While this research comes from a study focused on experts, I contrast this with my inexperienced analyst students. They also tend to initially focus on impact (across all disciplines) rather than confirming the initial infection too. But, for different reasons...
First, they don't know how to confirm infections. They haven't gotten comfortable with the work of doing the research, choosing high-quality resilient artifacts, and doing those lookups in evidence. It *can* be easier to focus on "what's next?" rather than "How did we get here?"
Second, inexperienced analysts often put a lot of (too much) faith in the detection source. Particularly in the case of IDS, they haven't yet grasped that an IDS alert is a question in and of itself, and not an answer. This effect is larger with new/novel signatures.
• • •
Missing some Tweet in this thread? You can try to
force a refresh
