Integrate threat hunting into SOC triage to mitigate software supply chain risk

With the continual evolution of malware, it is often too late to prevent the initial infection by the time a security alert is generated. Additionally, malware files are frequently changing, rendering file name or hash-based alerts fundamentally useless.

The ability to triage an alert retroactively, evaluating functionality over a signature, is a critical capability to quickly mitigate the spreading of malware.

Here are key insights into second- and third-tier Security Operations Center (SOC) investigations — and how a robust threat-hunting and malware analysis platform can significantly enhance the triage process.

Key takeaways: Supply chain security risks addressed in new Gartner reportGet the Gartner report: Mitigate Enterprise Software Supply Chain Security Risks

What is threat hunting?

Threat hunting is traditionally a human-driven activity on networks and computers that enables them to proactively look for cyber threats to an enterprise. It is a practice usually employed by mature security teams yielding results that can preempt material damage from cyber exploitation.

Hunting is typically a pre-activity of incident response; if done correctly, it should reduce the level of response. In many instances, hunting also involves a historical analysis of previous incidents, including the environments where those incidents occurred.

Hunting has not been used extensively in software environments but could play an important role in ensuring that the code used by organizations or shared between them is protected.

The evolution of threat analysis and hunting

Whether it’s an enterprise using technology or a product organization selling technology and services, we are moving to everything as code. This pivot represents an enormous opportunity to evolve the use and scalability of technology products and services for business outcomes.

It also means a shift in the attack surface. This means our methods and tools must also shift. The code landscape is made up is billions of lines of programming and millions of executable files. This is highly dynamic and changes at a pace much faster than computer and network components. It is an environment where cyber threats have already started to exploit and represent a serious risk to any organization using technology.

This is an opportunity to converge and optimize activities from SOC analysis, threat hunting, and incident response. Because of the prevalence of code in our enterprises, we must move faster with greater precision.