1. How does your daily work look like? With the huge amount of new malware every day I wonder how one can keep up analyzing them.
   
2. What are the most important skills needed in the job? And do you need to know certain programing languages?

@ wrote:

I've got two more general questions on the job of a threat researcher.

 

1. How does your daily work look like? With the huge amount of new malware every day I wonder how one can keep up analyzing them.
   
2. What are the most important skills needed in the job? And do you need to know certain programing languages?

It would be great if the community or even on of the stars could answer my questions :)

@ wrote:

Sorry I took so long to reply Marcus I just got lost in time! Nice to meet you and see you again ENZO was so cool to see in action when I saw it during my visit! One Question that I forgot to ask what does ENZO stand for?

 

Thanks,

 

Daniel ;)

@ wrote:

@ wrote:

I've got two more general questions on the job of a threat researcher.

 

1. How does your daily work look like? With the huge amount of new malware every day I wonder how one can keep up analyzing them.
   
2. What are the most important skills needed in the job? And do you need to know certain programing languages?

It would be great if the community or even on of the stars could answer my questions :)

Good questions!

 

1. A good majority of our day is spent using our ENZO research database hunting for malware and adding new detections. Being cloud based and having researchers spread out over the world helps us keep up with all of the new malware that comes in. 

 

2. The most important skill is the ability to learn and adapt - the malware landscape is constantly changing, and we have to change with it in order to keep up. Understanding how malware works and knowing how to spot malicious behaviors vs. legitimate behaviors are also important skills, as well as general Windows troubleshooting skills. Most of us tend to have an IT background that involves manual malware removal. A programming background definitely helps, especially when it comes to the more advanced levels of analysis.  

 

-Dan

 

@ wrote:

To echo what Dan said each of the threat researchers goes about there day slightly differently.

 

I myself am on the community, I do support tickets, Android research, Enzo work, training duties,sample testing and I will talk to customers if needed. Some of the guys on the team do Mac research, some do purely Enzo work, some are exclusively Android, some of the guys do more testing etc. Its depends on your skillset and/or your interests.

 

Since Malware is so varied (on a number of platforms) its very hard to be briliant at everything...not an problem I have of course :D

 

 

 

....gets coat

@ wrote:

Thanks nic and very nice interview Marcus. And by the way Marcus, any fantasy league tips, feel free to slip under my door! ;)

@ wrote:

@ wrote:

Sorry I took so long to reply Marcus I just got lost in time! Nice to meet you and see you again ENZO was so cool to see in action when I saw it during my visit! One Question that I forgot to ask what does ENZO stand for?

 

Thanks,

 

Daniel ;)

You'll actually get two different answers to the origins of the name ENZO depending on who you ask. The most common one you'll hear is that it comes from Enzo Ferrari or the Ferrari Enzo model - a fast database named after a fast car.

 

The story I initially heard when we were first in talks with Prevx is a bit different though. ENZO was named after Ensor, a character from the British science fiction series Blake's 7. Ensor was a scientist that built a supercomputer named Orac, and ORAC was the name of the database that preceded ENZO at Prevx.

 

-Dan

@ wrote:

Marcus is actually out on paternity leave right now, so I'll see if one of the others can jump in and answer the questions.