Increasing Adoption of SOAR Solutions
Over the past several years, Security Orchestration, Automation and Response (SOAR) has gone from being viewed as a niche product to one gaining traction across almost all industry verticals. Today, more and more private organizations, MSSPs and governments are turning to SOAR Technology to address previously unsolved problems in their security programs. SOAR is about taking action: “Automate. Orchestrate. Measure”. Organizations are implementing a SOAR solution to improve their incident response efficiency and effectiveness by orchestrating and automating their security operations processes. Gartner estimates that by 2019, 30% of mid to large-sized enterprises will leverage a SOAR technology, up from an estimated 5% in 2015.
In this three-part blog, we will discuss the key drivers for SOAR adoption and what problems a SOAR solution can help solve. In the next blog, the second part of this three-part blog, we will discuss the three pillars of Security Orchestration, Automation and Response (SOAR). Finally, we will round out the series by discussing the critical components and functionality that a SOAR solution should contain.
Five Key Problems SOAR Technology Helps to Solve
Like many new product categories, Security Orchestration, Automation and Response (SOAR) technology was born from problems without solutions (or perhaps more accurately, problems which had grown beyond the point that they could be adequately solved with existing solutions). To define the product category more accurately, it is crucial to first understand what problems drove its creation. There are five key problems the SOAR market space has evolved to address.
- Increased workload combined with budget constraints and competition for skilled analysts means that organizations are being forced to do more with less
As the number and sophistication of threats has grown over the past decade, there has been an explosion in the number of security applications in the enterprise. Security analysts are being forced to work within multiple platforms, manually gathering desperate data from each source, then manually enriching and correlating that data. Although it may not be as difficult to find security analysts as it once was, a truly skilled security analyst is still somewhat of a rare breed. Intense competition for these skill analysts means that organizations must often choose between hiring one highly skilled analyst, or several more junior analysts.
- Valuable analyst time is being consumed sorting through a plethora of alerts and performing mundane tasks to triage and determine the veracity of the alerts
Even when alerts are centrally managed and correlated through a SIEM, the number of alerts is often overwhelming for security teams. Each one of these alerts must be manually verified and triaged by an analyst. Alerts which are determined to be valid then require additional manual research and enrichment before any real action can be taken to address the potential threat. While these manual processes are taking place, other alerts sit unresolved in the queue and additional alerts continue to roll in.
- Security incidents are becoming more costly, meaning that organizations must find new ways to further reduce the mean time to detection and the mean time to resolution
The cost of the average incident has increased steadily year on year. The immediate cost of an incident due to lost sales, employee time spent, consulting hours, legal fees and lawsuits is relatively easy to quantify. The financial loss due to reputational damage, however, can be much more difficult to accurately measure. Reducing the time to detect and resolve potential security incidents must be an absolute priority. Each hour that a security incident persists is effectively money out of the door.
- Tribal knowledge is inherently difficult to codify, and often leaves the organization with personnel changes
Employee retention is an issue faced by almost every security team. Highly skilled analysts are an extremely valuable resource for which competition is always high. Each time an organization loses a seasoned analyst, some tribal knowledge is lost with them and they are replaced with an analyst who, even if they possess the same technical skills, will lack this tribal knowledge for at least a period of time. Training new analysts takes time, especially when processes are manual and complex. Documenting security processes is a complex, but critical task for all security teams.
- Security operations are inherently difficult to measure and manage effectively
Unlike other business units which may have more concrete methods for measuring the success or failure of a program, security metrics are often much more abstract and subjective. Traditional approaches to measuring return on investment are often not appropriate for security projects and can lead to inaccurate or misleading results. Properly measuring the effectiveness and efficiency of a security product or program requires a measurement process specially designed to meet these unique requirements.
About DFLabs IncMan SOAR
DFLabs is an award-winning and recognized global leader in Security Orchestration, Automation and Response (SOAR) technology. Its pioneering purpose-built platform, IncMan SOAR, enables SOCs, CSIRTs, and MSSPs to automate, orchestrate and measure security operations and incident response processes and tasks. IncMan SOAR drives intelligence-driven command and control of security operations, by orchestrating the full incident response and investigation lifecycle and empowers security analysts, forensic investigators and incident responders to respond to, track, predict and visualize cyber security incidents. As its flagship product, IncMan SOAR has been adopted by Fortune 500 and Global 2000 organizations worldwide.
Schedule a live demo with one of our cyber security specialists here and see DFLabs IncMan SOAR platform in action. For more information on any of these topics, please check out our new whitepaper titled “Security Orchestration, Automation, and Response (SOAR) Technology” here.
Stay tuned for our next blog in this series, where we will discuss the three pillars of SOAR technology.
The increase in the number and complexity of cybersecurity threats and attacks in the last several years is continuing to heavily influence enterprise security decisions. As well as seeing the growing business need, the significant benefit that Security Orchestration, Automation and Response (SOAR) technology can offer security operations and incident response teams is now truly being realized.
The complexity of cyber attacks has increased the need for organizations to share threat intelligence information within different areas of the business, and today may even include external stakeholders such as law enforcement or government agencies, to enable them to detect, contain and mitigate the constant and diverse cyber attacks that are occurring. Choosing the right SOAR tool can bring significant added value to an organization’s security operations, not only in terms of full incident lifecycle automation, (including triage, notification, context enrichment, hunting and investigation, as well as threat containment), but it can also enable incidents to be detected, responded to and mitigated more efficiently than ever before, ultimately becoming a force multiplier, enabling security teams to do more, respond faster, all with less resources.
It is key for any security team to ensure the security tools, technologies and platforms they implement are best suited for their infrastructure, workflows, processes, and procedures. Every set up likely varies from organization to organization. So, what questions should you be asking yourself as a security manager or CISO when it comes to selecting the appropriate SOAR solution? It is important to perform research, evaluate the tools and request a proof of concept before you invest in any SOAR tool. Here, we will cover 5 fundamental areas that should be considered as part of the process.
Human Manual Actions or Machine Automated Actions?
Incident response teams are now in constant defense mode as the number of security alerts being generated is hitting an all-time high. In addition to the increasing and advancing threat challenges, many security teams now face a lack of skilled workforce that can efficiently react, investigate and collect the necessary threat intelligence to properly determine the impact of an attack, then contain and remediate it. It is no secret that there is a lack of skilled cybersecurity professionals in the industry, but this fact is also well known by attackers. A skilled analyst will know exactly what information is needed to assess a situation and quickly eliminate the attack by containing and remediating the threat. Humans, even when very skilled, do have limitations on how fast they can react and access, collect, analyze and correlate information to gather proper threat intelligence.
Therefore, it is important to assess your resources and answer key questions including: Are all your alerts being responded to or are they falling along the wayside? Are analysts overworked and suffering from alert fatigue? Would it be more effective and efficient for them to be working on higher level prioritized tasks, as opposed to basic, mundane, repetitive ones that could potentially be automated? If the answer is yes to any of these questions, then some form of automation would make a significant impact on the operational performance of your security team.
When analyzing a SOAR solution, you should also consider one that enables both human actions and automated machine actions to work hand in hand simultaneously. Dual-action will enable you to automate the menial, repetitive tasks, but also ensure those tasks that need human intervention can also easily be actioned.
Which Existing Software and Solution Integrations Does It Have?
The average security team uses somewhere between 10 to 15 key security tools from third-party security vendors, including tools such as system information and event management (SIEM), intrusion prevention system (IPS), endpoint detection and response (EDR), malware sandboxes and threat intelligence. A SOAR tool should easily integrate with these third-party technologies to provide bi-directional support for a number of different actions to expedite the incident response process. The selected SOAR tool should not only support cybersecurity standards and best practices, but also APIs and interfaces to other tools which would be beneficial. The tool should also support queries into databases to facilitate obtaining enrichment information. Widely used communication methods, such as syslog and email should be supported as they allow the transmission of data from a large number of third-party tools.
It is crucial to evaluate the security tools currently in use and ensure they are capable of being integrated into the SOAR platform, which will ultimately be used to orchestrate and automate these security tools.
Does it Aid Regulatory Compliance?
SOAR vendors that endeavor to ensure their products and solutions follow industry best practices and standards, such as ISO, NIST, CERT, SOA, COBIT, OWASP, MITRE, OASIS, PCI, HIPAA, offer the best products, factoring these into the planning, architecture, design and build development stages.
Vendors which are able to think ahead of the curve and have the ability to cater for a range of industries and their respective compliance, regulations, and standards across worldwide locations offer the best solutions, as large enterprises need to meet their day to day business needs as well as their security needs. One example is the upcoming Global Data Protection Regulation (GDPR) where breach notification is required within 72 hours. Your SOAR solution needs to be able to cater for this need and ensure it can provide a complete and user-friendly incident report as needed for varying levels of stakeholders.
When choosing a SOAR solution, it is important to make a list of all the regulations, standards and best practices that you need to meet and ensure the SOAR provider can address these requirements.
What is the True Cost of the Tool?
The price of SOAR solution can be a significant consideration. Most SOAR products are charged per number of users per license per year, but you need to ensure there are no extra hidden costs associated, especially for those that are complex and may require professional services to be deployed.
Questions that should be asked include:
– Is the deployment and general day to day use for analysts straightforward?
– Are professional services needed to configure and deploy the solution?
– How long does it take to implement and customize the solution?
– Is basic support included in the price?
– Is additional product support maintenance available?
– Does the vendor provide playbooks and runbooks that can be customized?
One factor that is often overlooked is the price to feature ratio. Remember to evaluate which features will actually be needed versus which would be nice to have or simply won’t be utilized. Select a vendor that can offer affordable tools with no hidden costs and are willing to offer a license and maintenance price that works well for your budget and requirements.
What Product Support
As mentioned above, product support often comes at a price, so it is important to establish what support is included in the base price. Being able to obtain a high level of service and support from the SOAR vendor is an important consideration from the perspective of the success of the rollout, assessing the overall cost and day to day maintenance. Some of the questions that should be asked here are:
– What does the basic support package include?
– What is the cost of extended support?
– When is support available?
– Does the vendor have a significant presence in the region of operation? For example, some SOAR vendors are primarily U.S. based, so if an organization is based in EMEA, ASIA or Latin-America, they may not provide the level of support required.
Support costs can significantly drive up the cost of deployment and should be assessed in the early stages of the procurement process as it is important to establish how much can be achieved directly by the security analysts and engineers internally. Security team managers and CISOs have to ultimately measure the increase in performance of security operations and justify the return of investment received.
Overall, deciding whether or not to implement a SOAR solution should come down to the pure facts and figures from analyzing your current security operations performance against a number of KPIs and metrics and identifying the business need for it. Will it solve your common pain points and challenges such as a lack of skilled resources, the increasing number of alerts, etc. In most cases, the answer will be yes!
Weighing up the SOAR solutions out there then becomes the harder challenge. It is worth reviewing Gartner’s approach to SOAR, as well as making a list of requirements that you know must be covered to effectively work within your current and future infrastructure, those that are nice to have and those that are not so important to you. Overall though, the solution needs to be easy to implement, scalable, cost-effective and something that will enhance the overall performance of the security operations, improving the efficiency and effectiveness of the way incidents are managed.
If you would like to see DFLabs’ SOAR solution in action, request a demo of our IncMan SOAR platform today and get your questions answered.