The benefits of SOAR

SOAR stands for Security Orchestration, Automation, and Response. The term is used to describe three software capabilities – threat and vulnerability management, security incident response and security operations automation. SOAR allows companies to collect threat-related data from a range of sources and automate responses to low-level threats.

The term was originally coined by Gartner, who also defined the three capabilities. Threat and vulnerability management (Orchestration) covers technologies that help amend cyber threats, while security operations automation (Automation) relates to the technologies that enable automation and orchestration within operations. As many the cyber threats facing companies will require multiple technologies to combat them and several team members to conduct manual tasks and liaise information, the orchestration of remediation must be seamless. While orchestration targets efficiency when executing threat remediation, automation aims to reduce the time of these actions using machine learning – making the orchestration process itself more efficient. Security incident response (Response) is how the response to a threat is planned, managed, coordinated and monitored. Response measures the process of responding to a threat or vulnerability, and can be used to inform strategy.

SOAR systems can help define, prioritize and standardize functions that respond to cyber incidents. In other words, SOAR stacks enable organizations to determine the issues, define the solutions and then automate the response. The system is often adopted by organizations to improve efficiency, making security more self-operating. By removing the need for human assistance, threats and vulnerabilities can be responded to quicker and workers can better prioritize their time.

The software allows security teams to gain attacker insights with threat rules derived from insight into attacker tactics, techniques and procedures (TTPs) and known indicators of compromise (IOC) s. To do this it uses multiple threat intelligence feeds (organized and analyzed information on potential and current threats) which supplements threat detection.

Combat budget restraints

SOAR was introduced to combat a number of issues in the workplace relating to cyber security, including budget restraints. With the rate at which threats are advancing, new technologies are constantly being required to combat attacks. New technology requires a larger budget to fund both the tech itself and the talent managing it. As the levels of sophistication grow, so does the quantity of applications, and too the workload involved in monitoring them. SOAR streamlines these processes, making it more time and cost efficient.

Improve time management and productivity

The other benefit to improved time management is an increase in productivity. By using automated responses to threats, members of staff can better prioritize their time on tasks that cannot be automated.

Time can also be on the recruitment process – companies may find they are on the search for talent less often, as many aspects of the operations can be covered by SOAR software solutions and others can be conducted by the members of staff that were previously working on orchestration, for example.

Effectively manage incidents

Organizations may also find that threats and vulnerabilities are responded to faster. Incident response becomes more accurate, the time it takes is reduced and threat-risk is minimized with SOAR technology. The automated process removes human error.

Flexibility

The software can be flexible for your needs. SOAR was designed to adapt to any security system, being customizable for your environment. Multiple teams in a workforce should be able to utilize the tool with ease and access to input and read data. Data can be provided from machine to machine, email and manual input. How the data is tracked – and which data is tracked – will be dependent on what works for your operations.

Encourage collaboration

Collaboration becomes possible with SOAR security software. With response involving multiple processes to remediate threats – which SOAR aims to streamline – this will involve multiple individuals, or even teams. As we previously stated, multiple teams should have access to the SOAR stack that is used by a company.

How SOAR fits into a wider security network

SOAR tools are designed to seamlessly integrate into a wider network. Being flexible and adaptable, the SOAR tools can fit into the security operations of any organization. Designed to support a range of products and capabilities, it can enhance cyber security and efficiency without disruption.

SOAR software is similar to Security Information and Event Management (SIEM), but while they both collect data from a range of sources, SOAR’s capabilities integrate with more applications – both internal and external. Due to the differences between the systems, it would be advised to combine both for a full, secure solution. Currently, SOAR platforms are often used to boost existing SIEM systems, but it is anticipated that SOAR services will become available on the platforms in the future.

转载声明

• Author: 本文转载自 fireeye，版权归作者所有。文章内容仅代表作者独立观点，不代表本人立场，转载目的在于传递更多信息。如有侵权，请联系 2769905554@qq.com。

• 原文链接：https://www.fireeye.com/products/helix/what-is-soar.html