Improve SOC efficiency with SOAR systems

‍

‍

Gartner describes SOAR solutions as technologies that allow companies to collect security threats data and alerts from various sources, where incident analysis can be accomplished leveraging a mixture of human and machine power to help determine, prioritize and accelerate incident response activities according to a standard workflow. In other words, SOAR tools enable an organization to organize incident analysis and response procedures in a digital workflow setup, such that a variety of machine-driven movements can be automated.

According to Gartner, 70% of enterprises with a dedicated SOC will adopt SOAR tools by 2021, up from less than 5% in 2018. This increase is triggered by an enhanced requirement to report on and analyze security operations. The skill shortage and growing intensification in the threat activity stimulate the shift to full and semi-automation of operational activities. The important questions are how to improve the efficiency of SOC by using SOAR and how can orchestration and automation help transform a reactive response system into a proactive response system? Let’s take a look at how it helps to improve the efficiency of SOC.

How security automation and orchestration systems can improve SOC efficiency?

Analysts in the SOC have their hands full when it comes to putting up with great volumes of alerts. For example, they must recognize, prioritize and handle these alerts on a constant basis. It may look difficult for SOC analysts to manage these alerts on a consistent basis. Treating an unending stream of alerts can limit SOC from reacting quickly and effectively.

Recruiting new SOC analyst is one method to solve this difficulty, but obtaining skilled people is another matter altogether. No company would go for a never-ending hiring cycle that delivers unskilled people. If the SOC is full of untrained team members, the error percentages will increase as the team fails to react on security incidents efficiently. When automation comes on stage, you can use the power and agility of a machine to evaluate an unbelievable volume of alerts in moments. SOC analysts and incident handlers will get the ability to use important contextual data proactively, allowing faster decision-making for investigation cases. This gives huge benefits, such as a decreased headcount, lessened error rate, efficient and speedy decision-making, and at the end, reduced costs.

As mentioned earlier, security orchestration is the action of combining different technologies and connecting security tools to glue them for working together and participating in incident response. For example, consider that one of the employees of a company submits a suspicious email to the SOC. The analysts at SOC will check different things in the email with different solutions (either internal or external). Let’s say the following steps are defined:

Email sender check in threat intelligence database
Subject check in threat intelligence database
Reputation score of existing links in the email
Attachment detonation in a dedicated sandbox
Automatic answer to the user

Now, companies may get thousands of malicious emails every day. Is it achievable to investigate each reported email manually? This is where security orchestration and automation come into place. For each malicious email, it processes the previous steps automatically. Based on the value of the results, analysts can be notified and enter into the process. On this precise case, we can see security orchestration playbook can react to the incident and either implement remediation or empower the analyst.

Top 5 Ways Security Automation and Orchestration Can Improve SOC efficiency

Extensive Integration

The true advantage of security automation and orchestration systems is to allow seamless interaction between existing solutions. In fact, when ESG Research asked IT experts why they needed SOAR solutions, 35% answered they wanted to apply security automation and orchestration technology to combine external threat intelligence with internal security data gathering and analysis, and 28% wanted the tools to connect and contextualize data using the output of different tools.

SOCs usually operate a variety of security tools such as SIEMs, firewalls, intrusion detection systems, and threat intelligence platforms. They are helpful but these tools might lack interoperability. That suggests that in order to understand the big picture, analysts must manually bind together the data from these tools like a puzzle. This requires time and brings analysts’ focus away from other tasks. Security automation and orchestration systems can associate the puzzle parts on its own. This saves time since analysts no more have to collect information from different tools and find out how to connect it into a valuable, actionable summary. Besides saving time, this also optimize SOC activities so that analysts can focus on the most critical issues.

Speedy Response

SOAR solutions can be configured to react automatically on various situations. For example, consider an endpoint infected with malware that regularly tries to connect to blocked domains. In a conventional setup, these links are identified and flagged, and SOC staff is not able to handle the case manually until the endpoint shows other signs of dangerousness. In this period, other events could occur: classified data might be transmitted to an attacker, or extra malware might be downloaded.

With a SOAR solution in SOC, an event like this one can be handle much faster to prevent expansion. As soon as a suspicious connection occurs, a SOAR playbook can automatically quarantine the infected device from the network. This drastically reduces the SOC’s response time and also reduces the stress on the SOC team to react manually and contain incidents. If there are other events that require analyst time, this infected device can be handled later, since it does not longer endanger the company.

Consistency

The automation principles of a SOAR solution give the advantage of consistency. The automated responses are processed in a defined workflow so that all events of a particular type are be managed identically. Automation reduces the chance of human error and decreases the number of decision calls analysts are expected to take. Consistency can also be effective for contractual aspects. SOAR can automate many activities required to secure regulatory compliance. Errors and mistakes in this area are usually expensive when it occurs, automation and orchestration avoid landing in this costly situation.

Boring task reduction

False alarms are a regular plague for SOC. These fake alarms consume staff time that could be used much more productively. Even worse, staff gets so used to viewing alert warnings on their different dashboards that they seldom ignore to react to real difficulties. Security automation and orchestration systems attempt to solve this condition by automating the processing of low-level alerts and directing attention where it is really needed.

Cost Reduction

Automation and orchestration systems help in decreasing operational expense. For example, it assists in optimizing and decreasing an analyst’s workload by automating monotonous manual duties and saving their time to spend more on research and investigation of threats. Thus, it can decrease an organization’s expense in manpower significantly.

‍

Partager l'article :