Increasing Adoption of SOAR Solutions
Over the past several years, Security Orchestration, Automation and Response (SOAR) has gone from being viewed as a niche product to one gaining traction across almost all industry verticals. Today, more and more private organizations, MSSPs and governments are turning to SOAR Technology to address previously unsolved problems in their security programs. SOAR is about taking action: “Automate. Orchestrate. Measure”. Organizations are implementing a SOAR solution to improve their incident response efficiency and effectiveness by orchestrating and automating their security operations processes. Gartner estimates that by 2019, 30% of mid to large-sized enterprises will leverage a SOAR technology, up from an estimated 5% in 2015.
In this three-part blog, we will discuss the key drivers for SOAR adoption and what problems a SOAR solution can help solve. In the next blog, the second part of this three-part blog, we will discuss the three pillars of Security Orchestration, Automation and Response (SOAR). Finally, we will round out the series by discussing the critical components and functionality that a SOAR solution should contain.
Five Key Problems SOAR Technology Helps to Solve
Like many new product categories, Security Orchestration, Automation and Response (SOAR) technology was born from problems without solutions (or perhaps more accurately, problems which had grown beyond the point that they could be adequately solved with existing solutions). To define the product category more accurately, it is crucial to first understand what problems drove its creation. There are five key problems the SOAR market space has evolved to address.
- Increased workload combined with budget constraints and competition for skilled analysts means that organizations are being forced to do more with less
As the number and sophistication of threats has grown over the past decade, there has been an explosion in the number of security applications in the enterprise. Security analysts are being forced to work within multiple platforms, manually gathering desperate data from each source, then manually enriching and correlating that data. Although it may not be as difficult to find security analysts as it once was, a truly skilled security analyst is still somewhat of a rare breed. Intense competition for these skill analysts means that organizations must often choose between hiring one highly skilled analyst, or several more junior analysts.
- Valuable analyst time is being consumed sorting through a plethora of alerts and performing mundane tasks to triage and determine the veracity of the alerts
Even when alerts are centrally managed and correlated through a SIEM, the number of alerts is often overwhelming for security teams. Each one of these alerts must be manually verified and triaged by an analyst. Alerts which are determined to be valid then require additional manual research and enrichment before any real action can be taken to address the potential threat. While these manual processes are taking place, other alerts sit unresolved in the queue and additional alerts continue to roll in.
- Security incidents are becoming more costly, meaning that organizations must find new ways to further reduce the mean time to detection and the mean time to resolution
The cost of the average incident has increased steadily year on year. The immediate cost of an incident due to lost sales, employee time spent, consulting hours, legal fees and lawsuits is relatively easy to quantify. The financial loss due to reputational damage, however, can be much more difficult to accurately measure. Reducing the time to detect and resolve potential security incidents must be an absolute priority. Each hour that a security incident persists is effectively money out of the door.
- Tribal knowledge is inherently difficult to codify, and often leaves the organization with personnel changes
Employee retention is an issue faced by almost every security team. Highly skilled analysts are an extremely valuable resource for which competition is always high. Each time an organization loses a seasoned analyst, some tribal knowledge is lost with them and they are replaced with an analyst who, even if they possess the same technical skills, will lack this tribal knowledge for at least a period of time. Training new analysts takes time, especially when processes are manual and complex. Documenting security processes is a complex, but critical task for all security teams.
- Security operations are inherently difficult to measure and manage effectively
Unlike other business units which may have more concrete methods for measuring the success or failure of a program, security metrics are often much more abstract and subjective. Traditional approaches to measuring return on investment are often not appropriate for security projects and can lead to inaccurate or misleading results. Properly measuring the effectiveness and efficiency of a security product or program requires a measurement process specially designed to meet these unique requirements.
About DFLabs IncMan SOAR
DFLabs is an award-winning and recognized global leader in Security Orchestration, Automation and Response (SOAR) technology. Its pioneering purpose-built platform, IncMan SOAR, enables SOCs, CSIRTs, and MSSPs to automate, orchestrate and measure security operations and incident response processes and tasks. IncMan SOAR drives intelligence-driven command and control of security operations, by orchestrating the full incident response and investigation lifecycle and empowers security analysts, forensic investigators and incident responders to respond to, track, predict and visualize cyber security incidents. As its flagship product, IncMan SOAR has been adopted by Fortune 500 and Global 2000 organizations worldwide.
Schedule a live demo with one of our cyber security specialists here and see DFLabs IncMan SOAR platform in action.
Stay tuned for our next blog in this series, where we will discuss the three pillars of SOAR technology.
“Noise” is a prevalent term in the cyber security industry. Here at DFLabs – Security Orchestration, Automation and Response Platform, we consistently receive feedback from vendor partners and clients that one of the major issues they face on daily basis is the ability to sift through the noise in order to understand and differentiate an actual critical problem from a lost cause.
What is “noise”?
Noise is a vast amount of information passed from security products that can have little or no meaning to the person receiving the information. Typically, lots of products are not tuned or adapted for certain environments and therefore would present more information than needed or required.
Noise is a problem to all of us in the cyber security industry, as there are meanings within these messages that are on many occasions simply ignored or passed over for higher priorities. For example, having policies and procedures that are incorrectly identified or adapted, or a product is not properly aligned within the network topology.
There is not one security product that can deal with every attack vector that organizations experience today. What’s more disturbing about this paradigm is that most of the tools and technologies within the security infrastructure do not talk to each other natively, yet all them have intelligence data that can overlay to enrich security operations and incident response teams.
Understanding the Noise Using Security Orchestration, Automation and Response
Cyber incident investigative teams spend a vast number of hours carrying out simple administrative tasks that could easily be relieved by introducing an effective security orchestration, automation and response (SOAR) solution. Given the sheer volume of alerts, we can see from SIEM products on a day to day basis, a Security Orchestration Automation and Response SOAR tool can be used in conjunction to execute most, if not all of the human to machine actions, following best practice per type of incident and company guidelines, all through automated playbooks.
Re-thinking what information is being presented and how we deal with it is the biggest question. There are several ways to manage this:
- Fully automating the noise worthy tasks.
If these are consistently coming into your Security Operations Center (SOC) causing you to spend more time on administration than investigation, it may be prudent to schedule the tasks in this manner.
- Semi-automation of tasks can give your SOC teams more control over how to deal with huge numbers.
Automating 95% of these tasks and then having an analyst to provide the last sign off via manual look over, can heavily reduce time if your organization is against fully automating the process.
- Leverage all of your existing products to provide better insight into the incident.
For example, leverage an existing Active Directory to lock out or suspend a user account if they log in outside of normal business hours. Additionally, it’s possible to sandbox and snapshot that machine to understand what is happening. A key consideration here is to make sure not to disrupt work at every opportunity. It really is a balancing act, however, depending on their privilege you may want to act faster for some users compared to others depending on their role and responsibilities.
During the second half of 2018, the readiness and capability to respond to a variety of cyber incidents will continue to be at the top of every C-level agenda. By leveraging the security orchestration automation and response capabilities offered by DFLabs’ IncMan SOAR platform, stakeholders can provide 360-degree visibility during each stage of the incident response lifecycle. This provides not only consistency across investigations for personnel but encourages the implementation of Supervised Active Intelligence across the entire incident response spectrum.
At DFLabs we showcase our capacity to reduce the investigative time and incident dwell time, all while increasing incident handling consistency and reducing liability. Arming your SOC teams with information prior to the start of their incident investigation will help to drive focus purely on the incidents that need attention rather than the noise.
Please contact us to discuss how we can work together to grow your incident response capabilities or schedule a demonstration of how we can utilize what you already have and make it more effective and efficient.
Worldwide infrastructure outages caused by DDoS attacks are continuing to be a growing threat to today’s organizations as attackers find new ways to bypass existing mitigation technologies. According to a recent report by Kaspersky, DDoS attacks in Q1 2018 were at an all-time high in terms of both volume and duration. In addition to these growing numbers of attacks, organizations are experiencing a shortage of experienced cybersecurity professionals, making it more difficult to effectively defend their infrastructure and quickly remediate such attacks.
How SOAR Tools Can Help Expedite DDoS Incident Response
Manual data collection is time-consuming and requires an individual to manually access each tool to get the specific information they require, then export the data and manually perform data correlation. Depending on the organization’s workflow, the information may also need to be added to the incident management ticketing system in order to be shared with other teams within the organization. This process requires a skillful analyst to spend a significant amount of time performing mundane and repetitive tasks which can easily be automated, greatly reducing their value to the organization.
A security orchestration, automation, and response (SOAR) platform, properly integrated into the security program, can help maximize the value of these skilled analysts. The IncMan SOAR platform from DFLabs allows security program administrators to create automated, conditional workflows to respond to incidents such as a DDoS attack though IncMan’s R3 Rapid Response Runbooks. These runbooks allow the automation of mundane, repetitive tasks, while IncMan’s Dual Mode Orchestration technology allows security program administrators to ensure that human intervention, oversight or approval is required when necessary. This allows security analysts to focus solely on the tasks which require human input, allowing organizations to maximize the efficiency of their security teams, as well as speed up the mean time to detection (MTTD) and mean time to resolution (MTTR).
IncMan SOAR is able to collect data from sources such as email, syslogs, database queries, as well as custom scripts and an assortment of bi-directional integrations with third-party solutions. With the right SOAR solution in place, it is possible to expedite data collection, collect threat intelligence and acquire forensic information from automatically triggered actions, notify the appropriate stakeholders and conduct supervised containment actions when appropriate. The use of the platform will heavily reduce the number of manual and mundane tasks that the analyst needs to perform, freeing up their time to complete more in-depth analysis and incident mitigation.
How Can Threat Intelligence Prevent DDoS Attacks?
A vast amount of threat data is being generated from a number of security tools and other data sources on an ongoing basis. It is critical that this information is accurately collected, stored and applied in order for the intelligence to be actionable and provide benefit to the organization.
Using the analogy of cooking, there is little value in having all of the ingredients for a recipe without the proper context regarding how each ingredient is used. Simply throwing all of the ingredients into a single pot will not create a culinary masterpiece and will not produce the desired results. The same concept applies to threat intelligence data. The vast amount of threat data is of little value to a security team without the proper context. The right SOAR platform should assist the security team in correlating this threat data, turning a list of ingredients into a proper dish, or threat data into actionable threat intelligence.
Accurately correlated threat intelligence can provide critical insight to inform decisions as well as to contain and mitigate present and future attacks. Intelligence data should be made available in multiple forms, including visualizations, to assist security analysts in correctly understanding the full context of the information. Correlation graphs and search capabilities can also be utilized to enable threat hunting, allowing security analysts to proactively seek out threats which may be looming or have gone undetected by automated detection technologies.
The Best Approach to Prevent DDoS Attacks
A layered approach of defense is the best method to prevent, or at the very least minimize the impact of a DDoS attack, while eliminating any single points of failure. Maintaining network baseline information, monitoring the network for any anomalies and ensuring all systems remain patched are all critical components of DDoS mitigation.
For critical systems which cannot tolerate any downtime, it is important to have a documented DDoS mitigation strategy in place. DDoS mitigation strategies may vary depending on the type of network being protected and the maximum tolerable downtime, however, may include high availability or redundant systems, backup connections or DDoS scrubbing services.
DDoS attacks represent a dominant threat and often target organizations that provide a service to a wide customer base, area or network in order to have the largest impact. DDoS attacks are also continuing to become more complex and larger in size, as recently seen in the attacks on GitHub in early March which generated 1.3 Tbs of traffic, shortly to be followed by another attack of 1.7 Tbs two weeks later.
Some organizations are now experiencing over 10,000 threat events weekly; an overwhelming number of events to be manually investigated and mitigated by incident responders. A SOAR solution will act as a force multiplier, enabling security teams to do more with fewer resources, and will help reduce the MTTD and MTTR, proactively helping to respond to future alerts and even preventing incidents from occurring in the first instance. Historical event and data correlation is critical and can be used to identify security gaps, harden networks and allow for early detection of potential security incidents, further increasing the ROI of a SOAR platform.
With a vast range of security technologies, tools and platforms now widely available in the market for security teams, it is ever more complex to decide which tools are best to deploy to suitably defend the organization’s infrastructure.
Within security structures of larger organizations, it is common to have a security information and event management (SIEM) tool in place, alongside or sitting on top of several other systems, but how can it benefit from implementing a Security Orchestration, Automation and Response (SOAR) solution on top of its existing SIEM infrastructure to further manage its security operations and incident response processes and tasks? Let’s find out.
In simple terms, a SIEM collates and analyses the information generated from various sources, identifying issues and raising the initial security alerts. Alert triage is then often carried out by security analysts in a very manual and non-methodical way and subject to mistakes and errors due to the sheer volumes and number of repetitive and mundane actions required, often not being able to fulfill all of them. One of the original core drivers for SIEM technology was to ingest and process large volumes of security events; a function which SIEMs continue to excel at today. However, although some advanced SIEMs have incorporated additional features, such as integration with threat intelligence and other third-party solutions, many SIEMs are still largely focused on data ingestion and presentation.
Another fundamental limitation of many SIEM solutions is that the communication between the SIEM and other third-party products is unidirectional. SIEMs were designed to ingest information, however, support for two-way communication with third-party tools is often limited at best. In most cases, this severely limits a SIEM’s ability to carry out actions beyond the initial alert; this is where a SOAR solution can add significant additional value.
A SOAR solution, on the other hand, is often used in conjunction with a SIEM, however, it is not dependent on having a SIEM in place. A SOAR solution is not intended to be a SIEM replacement, instead, when used in conjunction with a SIEM it is intended to be utilized to help security teams automate and orchestrate actions across their entire portfolio of security products in a bidirectional manner to reduce analyst workload, alert fatigue, time to respond and remediate and reduce overall risk.
Sitting on top of the SIEM, the SOAR solution would orchestrate and automate multiple third-party tools from different vendors, whereas the SIEM would be used to collate and analyze data and generate the alert, which is just the first step of a multistep process. SOAR technology would then be leveraged once the initial security threat had been detected and the security alert generated by the SIEM.
The amount of security events that cybersecurity professionals deal with on a day to day basis can be overwhelming and analysts often have to delve through a deluge of data to find what they are looking for, ultimately preventing them from tackling incidents more efficiently. SIEM tools collect large amounts of information from different areas of the IT framework, but too much information sometimes is just as crippling as not enough information.
A SIEM used in isolation helps to centralize information gathered from various other security tools being used, but it can often lead to an overwhelming amount of information, that then needs to be filtered and correlated to eliminate the false positives to leave only the critical events that need to be acted upon. It can produce a vast quantity of security alerts, leaving security analysts inundated, not knowing which alerts should take priority and be tackled first. This will have a negative impact on the security team, with what is already considered a scarce resource.
Most security teams do not realize the sheer number of alerts that will be received and the resulting alert fatigue until they have deployed a SIEM and a full advanced threat detection architecture. There is a common misconception that a SIEM will reduce the number of incoming alerts by applying correlation rules. However, this is not always the case and correlation rules may only reduce a small percentage of the total number of alerts. Most enterprises will see a clear business need for implementing a SOAR solution to help reduce alert fatigue, orchestrate the organization’s different security tools and automate menial tasks.
Integrating a SIEM with a SOAR solution combines the power of each to create a more robust, efficient and responsive security program. Taking advantage of the SIEM’s ability to ingest large volumes of data and generate alerts, the SOAR solution can be layered on top of the SIEM to manage the incident response process to each alert, automating and orchestrating a number of mundane and repetitive tasks that would take many manual man hours to complete.
SOAR solutions such as IncMan from DFLabs support SIEM integrations and present a comprehensive solution for all organizations that are trying to create a successful and affordable security program, by effectively reducing the noise generated by a high number of alerts and sometimes less than reliable threat intelligence. This can ultimately enable security teams to minimize incident resolution time, maximize analyst efficiency and overall increase handled incidents.
The combined power of a SOAR solution working alongside a SIEM is crucial to ensure that alerts do not go untouched or ignored. More importantly, it ensures all alerts are dealt with in a timely manner and are acted upon following a standard set of consistent and repeatable practices and procedures.
A SIEM is a crucial tool within any security infrastructure, amongst other tools. However, it is critical to keep in mind what a SIEM is designed to achieve, and what gaps may still exist within the security program. The combination of a SIEM and a SOAR solution can transform the security operations and incident response capability and take it from one level to the next, in an intelligent and predetermined manner, so why wait? To learn more about the topic read our new whitepaper “How to Leverage Your Existing SIEM Tool with SOAR Technology”
The increase in the number and complexity of cybersecurity threats and attacks in the last several years is continuing to heavily influence enterprise security decisions. As well as seeing the growing business need, the significant benefit that Security Orchestration, Automation and Response (SOAR) technology can offer security operations and incident response teams is now truly being realized.
The complexity of cyber attacks has increased the need for organizations to share threat intelligence information within different areas of the business, and today may even include external stakeholders such as law enforcement or government agencies, to enable them to detect, contain and mitigate the constant and diverse cyber attacks that are occurring. Choosing the right SOAR tool can bring significant added value to an organization’s security operations, not only in terms of full incident lifecycle automation, (including triage, notification, context enrichment, hunting and investigation, as well as threat containment), but it can also enable incidents to be detected, responded to and mitigated more efficiently than ever before, ultimately becoming a force multiplier, enabling security teams to do more, respond faster, all with less resources.
It is key for any security team to ensure the security tools, technologies and platforms they implement are best suited for their infrastructure, workflows, processes, and procedures. Every set up likely varies from organization to organization. So, what questions should you be asking yourself as a security manager or CISO when it comes to selecting the appropriate SOAR solution? It is important to perform research, evaluate the tools and request a proof of concept before you invest in any SOAR tool. Here, we will cover 5 fundamental areas that should be considered as part of the process.
Human Manual Actions or Machine Automated Actions?
Incident response teams are now in constant defense mode as the number of security alerts being generated is hitting an all-time high. In addition to the increasing and advancing threat challenges, many security teams now face a lack of skilled workforce that can efficiently react, investigate and collect the necessary threat intelligence to properly determine the impact of an attack, then contain and remediate it. It is no secret that there is a lack of skilled cybersecurity professionals in the industry, but this fact is also well known by attackers. A skilled analyst will know exactly what information is needed to assess a situation and quickly eliminate the attack by containing and remediating the threat. Humans, even when very skilled, do have limitations on how fast they can react and access, collect, analyze and correlate information to gather proper threat intelligence.
Therefore, it is important to assess your resources and answer key questions including: Are all your alerts being responded to or are they falling along the wayside? Are analysts overworked and suffering from alert fatigue? Would it be more effective and efficient for them to be working on higher level prioritized tasks, as opposed to basic, mundane, repetitive ones that could potentially be automated? If the answer is yes to any of these questions, then some form of automation would make a significant impact on the operational performance of your security team.
When analyzing a SOAR solution, you should also consider one that enables both human actions and automated machine actions to work hand in hand simultaneously. Dual-action will enable you to automate the menial, repetitive tasks, but also ensure those tasks that need human intervention can also easily be actioned.
Which Existing Software and Solution Integrations Does It Have?
The average security team uses somewhere between 10 to 15 key security tools from third-party security vendors, including tools such as system information and event management (SIEM), intrusion prevention system (IPS), endpoint detection and response (EDR), malware sandboxes and threat intelligence. A SOAR tool should easily integrate with these third-party technologies to provide bi-directional support for a number of different actions to expedite the incident response process. The selected SOAR tool should not only support cybersecurity standards and best practices, but also APIs and interfaces to other tools which would be beneficial. The tool should also support queries into databases to facilitate obtaining enrichment information. Widely used communication methods, such as syslog and email should be supported as they allow the transmission of data from a large number of third-party tools.
It is crucial to evaluate the security tools currently in use and ensure they are capable of being integrated into the SOAR platform, which will ultimately be used to orchestrate and automate these security tools.
Does it Aid Regulatory Compliance?
SOAR vendors that endeavor to ensure their products and solutions follow industry best practices and standards, such as ISO, NIST, CERT, SOA, COBIT, OWASP, MITRE, OASIS, PCI, HIPAA, offer the best products, factoring these into the planning, architecture, design and build development stages.
Vendors which are able to think ahead of the curve and have the ability to cater for a range of industries and their respective compliance, regulations, and standards across worldwide locations offer the best solutions, as large enterprises need to meet their day to day business needs as well as their security needs. One example is the upcoming Global Data Protection Regulation (GDPR) where breach notification is required within 72 hours. Your SOAR solution needs to be able to cater for this need and ensure it can provide a complete and user-friendly incident report as needed for varying levels of stakeholders.
When choosing a SOAR solution, it is important to make a list of all the regulations, standards and best practices that you need to meet and ensure the SOAR provider can address these requirements.
What is the True Cost of the Tool?
The price of SOAR solution can be a significant consideration. Most SOAR products are charged per number of users per license per year, but you need to ensure there are no extra hidden costs associated, especially for those that are complex and may require professional services to be deployed.
Questions that should be asked include:
– Is the deployment and general day to day use for analysts straightforward?
– Are professional services needed to configure and deploy the solution?
– How long does it take to implement and customize the solution?
– Is basic support included in the price?
– Is additional product support maintenance available?
– Does the vendor provide playbooks and runbooks that can be customized?
One factor that is often overlooked is the price to feature ratio. Remember to evaluate which features will actually be needed versus which would be nice to have or simply won’t be utilized. Select a vendor that can offer affordable tools with no hidden costs and are willing to offer a license and maintenance price that works well for your budget and requirements.
What Product Support
As mentioned above, product support often comes at a price, so it is important to establish what support is included in the base price. Being able to obtain a high level of service and support from the SOAR vendor is an important consideration from the perspective of the success of the rollout, assessing the overall cost and day to day maintenance. Some of the questions that should be asked here are:
– What does the basic support package include?
– What is the cost of extended support?
– When is support available?
– Does the vendor have a significant presence in the region of operation? For example, some SOAR vendors are primarily U.S. based, so if an organization is based in EMEA, ASIA or Latin-America, they may not provide the level of support required.
Support costs can significantly drive up the cost of deployment and should be assessed in the early stages of the procurement process as it is important to establish how much can be achieved directly by the security analysts and engineers internally. Security team managers and CISOs have to ultimately measure the increase in performance of security operations and justify the return of investment received.
Overall, deciding whether or not to implement a SOAR solution should come down to the pure facts and figures from analyzing your current security operations performance against a number of KPIs and metrics and identifying the business need for it. Will it solve your common pain points and challenges such as a lack of skilled resources, the increasing number of alerts, etc. In most cases, the answer will be yes!
Weighing up the SOAR solutions out there then becomes the harder challenge. It is worth reviewing Gartner’s approach to SOAR, as well as making a list of requirements that you know must be covered to effectively work within your current and future infrastructure, those that are nice to have and those that are not so important to you. Overall though, the solution needs to be easy to implement, scalable, cost-effective and something that will enhance the overall performance of the security operations, improving the efficiency and effectiveness of the way incidents are managed.
If you would like to see DFLabs’ SOAR solution in action, request a demo of our IncMan SOAR platform today and get your questions answered.
DFLabs is excited to announce the latest release of its industry-leading Security Orchestration, Automation and Response platform, IncMan version 4.3. Solving customer’s problems and adding value to our customer’s security programs is one of our core goals here at DFLabs and this is reflected in our 4.3 release with over 100 enhancements, additions, and fixes; many suggested by customers, all designed to make the complex task of responding to potential security incidents faster, easier and more efficient.
IncMan 4.3 includes many new bidirectional integrations from a variety of product categories including threat intelligence, malware analysis, ticket management and endpoint protection, chosen to broaden the orchestration and automation capabilities of our customers. These new bidirectional integrations include:
- Atlassian Jira
- BMC Remedy
- Carbon Black Defense
- Cuckoo Sandbox
- McAfee Advanced Threat Defense
- McAfee Threat Intelligence Exchange
- Recorded Future
With IncMan 4.3, we have also greatly enhanced the flexibility of our R3 Rapid Response Runbooks with the addition of two new decision nodes; Filter and User Choice. Filter nodes allow users to further filter and refine information returned by previously executed integrations; for example, filtering IT asset information to include only servers, focusing on key assets first. Unlike automated Enrichment actions, automated Containment actions could have serious unintended impacts on the organization. User Choice nodes allow users to minimize this risk by allowing them to define critical junctions in the workflow at which a human must intervene and make a decision. For example, human verification may be required before banning a hash value across the enterprise or quarantining a host pending further analysis.
Improvements to our patent-pending Automated Responder Knowledge (DF-ARK) module allow IncMan to make even more intelligent decisions when suggesting response actions, and enhancements to IncMan’s correlation engine allow users a more advanced view of the threat landscape over time and across the organization. IncMan’s report engine has been significantly bolstered, allowing users to create more flexible reports for a variety of purposes than ever before. Finally, numerous changes have been made to IncMan’s Dashboard and KPI features, allowing users to create more actionable KPIs and gather a complete picture of the organization’s current state of security at a moment’s glance.
These are just some of the highlights of our latest IncMan release; IncMan 4.3 includes many other enhancements designed to streamline your orchestration, automation and response process. If you would like a demo of our latest release, please go to our demo request site. Stay tuned to our website for additional updates, feature highlights, and demos of our latest release.
Last week, Anton Chuvakin from Gartner announced that Augusto Barros and himself are planning to conduct research in Q4 2017 on the topic of Security Orchestration, Automation and Response (SOAR), or Security Automation and Orchestration, depending on which analyst firms’ market designation you follow. At DFLabs we are very excited that Gartner is finally showing our market space some love and will be helping end users to better assess and differentiate SAO offerings.
Anton provided many questions that he wanted SAO vendors to prepare for. The questions immediately piqued our interest, with one question, in particular, standing out to us.
1.When is SOAR a MUST have technology? What has to be true about the organization to truly require SOAR? Why your best customer acquired the tools?
Anton also said that he had one main problem with Security Automation and Orchestration. In his own words, “For now, my main problem with SOAR (however you call those security orchestration and automation tools…if you say SOAPA or SAO we won’t hate you much) is that I have never (NEVER!) met anybody who thought “my SOAR is a MUST HAVE.”
The question is not entirely unwarranted. During my own time at Gartner covering the SOAR space, I spoke to many clients who were seeking an SAO solution without knowing that they were. Typical comments were, “I have too many alerts and false positives to be able to deal with them all”, or “We are struggling to hire enough skilled people to be able to respond to all of the incidents that we have to manage”. Another common comment was, “I am struggling to report operational performance to my executives?”. Often, these comments were followed by the question, “Do you know of any technology that can help?”.
Typically, these organizations had a mature security monitoring program, usually built around a SIEM. They often had critical drivers, such as regulatory requirements, or held sensitive customer data. We hear the same buying drivers from our own customer base.
To sum up the most common drivers for someone asking about Security Automation and Orchestration:
- A high volume of alerts and incidents and the challenge in managing them
- A large portfolio of diverse 3rd party security detection products resulting in a large volume of alerts
- Regulatory mandates for incident response and breach notification
- An overstretched security operations team
- Reporting risk and the operational performance of the CSIRT and SOC to an executive audience
One interesting thing is that when there is no external driver like regulatory compliance, deploying a Security Automation and Orchestration solution is often determined by maturity. Most organizations don’t realize that they will be unable to cope with the volume of alerts and the resulting alert fatigue until they have deployed a SIEM and a full advanced threat detection architecture.
The common misconception is that the SIEM can help to reduce the number of incoming alerts by applying correlation rules. This not entirely untrue, but correlation rules will only reduce a small percentage. They are essentially signature based. You need to know in advance what you want to correlate, and adding a correlation rule to cover all and every incoming alert is not a trivial task. Even with correlation rules, additional work will be required to qualify an incident. Gathering additional IoC’s, incident observables and context is still a very manual process. Lastly, detection is only one part of the entire incident response process – notifying stakeholders, gathering forensic evidence and threat containment will also have to be done manually. These are the areas where SAO solutions provide the greatest ROI – as a force multiplier.