Digital Forensics and Incident Response - Second Edition

Using threat intelligence

There are two distinct advantages to integrating threat intelligence into an organization's security methodology and response capability. From the proactive approach, organizations can utilize this data to increase the effectiveness of their detective and preventive controls. This allows organizations to enhance their ability to either block attacks through such mechanisms as blacklisting known malware sites or through their detective capability by alerting you to specific host behavior that is indicative of a compromise. On a reactive stance, organizations can integrate threat intelligence into their existing toolset and bring those to an investigation. This allows them to find evidentiary items that may have gone ...