The creation of the internet has been one of the greatest revolutions of modern time. The same can be said of its growth, but all these perks come with a multitude of downsides. One of the greatest shortcomings of having such a large base is increased difficulty in network management. The best Security Operation Centers (SOCs) in the world are built along the premise of speed-to-response and efficiency. Each of these is directly proportional to the performance of a system. However, most security experts will tell you never to underestimate the difficulty these two elements present.
Certain aspects of cybersecurity can be frustrating. Instead of identifying and analyzing potential threats, a lot of time is often spent on ingesting, enriching and correlating data – a simple, yet monotonous task. For instance, combing through rows of alert data from different systems to patch together a report of whether an alert is a real threat and devising an appropriate response. This kind of monotony can be frustrating for security operations teams, and frustration can never breed productivity.
The problem, in part, is that most SOCs use over a dozen different tools for analyzing and filtering threats. This creates a situation where an organization depends on technologies that can barely understand each other. However, the most efficient systems aren’t monolithic structures, but tools that are connected and can speak to each other.
Another issue often faced by security specialists is the dependence on oftentimes poorly-documented security operations processes – an unfortunately prevalent condition in many SOCs. This leads to many teams simply trusting in their peers’ knowledge and filling in any blanks using their own experience to remedy problems. Considering the whole thing is done by hand, it’s no wonder the process is error-prone and the investigations take much longer.
This is where Security Orchestration comes in. Security orchestration serves to solve the kinds of challenges brought up by the reliance of teams on more traditional methods. The larger the amount of traffic the SOC receives in a day, the more the number of alerts, and the greater the number of threats you will face. Incidentally, every tool involved will have more work each tool in the system will have to do. Recall that since every one of these works as a separate unit, there is almost no communication between them. Security orchestration aims to remedy this situation by bringing together these disparate tools – it facilitates various stages of work that would otherwise have to be done by hand. This includes communication (which would have been achieved through the more traditional copy-paste mechanism) and data collection (rather than filtering through every piece of data by hand).
In essence, security orchestration offers teams a kind of agility that’s virtually impossible to achieve using standard conventional systems. It does this by a process that can be broken down into roughly six elements.
Collecting data
A security alert is only as useful as the amount of information you can collect and learn from it. Say your SOC has been alerted of a potential phishing attack on a user via email. Without anything to back it, it’s like being alerted to a robbery but being unable to do anything about it. In many ways, a good security specialist is like a detective – it’s now time for you to put on your thinking cap and look for clues as to who’s behind it: where do the requests originate from? Is the attacker making any efforts to mask their identity? Has the IP been flagged before…?
There are numerous steps to be undertaken if the threat is to be revealed. Security orchestration platforms can collect all data in the relevant context within any ecosystem, no matter how numerous.
Analyzing the data
Once the data has been aggregated and the context applied, teams will be able to move from managing every single case to only being presented with data on the case-level basis. Such a solution saves specialists large amounts of time, and false-positives can be easily brushed aside in a single location.
Security orchestration would allow a SOC to, instantly analyze a multitude of alerts and filter them according to context. This can be changed to any otherwise set of criteria – metadata, browser data, number of users affected by a single IP, etc.
Carrying out the investigations
Continuing our well thought out sleuth-security analyst example, this is the part where the data is filtered through to determine the perpetrators involved. Possibly including the relationship between different sets of data.
This is the most time-consuming step in the whole process, given the amount of manual effort involved. Security orchestration, however, would enable the team to carry out this operation in a well-detailed process – using timelines and graphs – for each part of the case.
Automation
Security automation and orchestration are fundamentally different. Automation is letting the machine doing all the work, while orchestration is connecting all these pieces together to make everything even easier. When done right, these two components can work beautifully together and will be a crucial part of time-saving.
Now, instead of having to go through every potential phishing scam by hand, we can have our well-trained automated system do all the work. It will gather the data, and since everything is connected, pass data to the next component until the analyst’s attention is needed.
Involving the team
Once the system has done everything it can, the data is then passed down to the individual cybersecurity teams. The data is often received by Tier 1 analysts who then escalate it to 2 and 3. There is a slew of people usually involved in the process – management and Chief Information Security Officers (CISOs) or even HR and executive if the breach is dire.
Even in this phase, security orchestration plays a role in making collaboration much easier, rather than just connecting different parts of a system. A proper security orchestration system should be able to offer a way for the higher-ups to have any crucial information relayed to them as soon as the data is compiled. Not only that, but even mid and low-level management and employees can have relevant data pushed to them at the appropriate times.
Reporting the results
Any existing technology is only as good as the results it can produce. Anyone who has worked in tech can tell you measuring results is notoriously difficult, and detecting a breach is even tougher. And that’s when extra steps have been taken to integrate reporting solutions manually.
At the core, security orchestration creates a structure that has collection and reporting of metrics as an inbuilt component. Since it’s able to bring together monolithic components, it’s also able to collect relevant metrics from each of these systems. With these measurements, teams can use the underlying data to improve the workflow further and reduce the number of unsolvable cases. Even better, management will be able to more easily show the benefits of security orchestration as a part of the organization’s investments.
In summary, a complete security orchestration system, when combined with well-implemented automation, offers a slew of benefits to any SOC. This includes breaking down the data into more digestible chunks, compiling the data – making it human-friendly, and creating a space for all the users in the system (employees and management) to communicate whenever necessary. It completely overhauls human-controlled, error-prone systems.
