Threat Hunting, Detection and Remediation with SOAR
August 9, 2021Demystifying the Cognitive Capabilities of SOAR
August 24, 20213 Common Challenges To Avoid While Implementing SOAR
Security Orchestration, Automation and Response (SOAR) platforms enable organizations to streamline security operations, understand the cyber threat landscape, and proactively respond to incidents with little to no human intervention. For all these reasons, companies all over the world are investing in SOAR solutions, and the fast-growing SOAR market is expected to be worth $1.79 billion by 2024, up from $868 million in 2019.
But despite the growing interest in SOAR, many organizations face challenges during implementation. In this brief article, we explore three common challenges, and the steps you can take to avoid them, and set your organization up for long-term SOAR success.
Challenge #1: Not Knowing Your Current Security Posture
A SOAR tool provides a comprehensive, proactive and robust way to strengthen security with contextual threat intelligence, enhanced incident response, and automated security operations. Nonetheless, if you don’t know where you currently stand, you won’t know where you need to improve, or how SOAR can help you fill those gaps.
Solution #1
Review the operational metrics from your security operations and response program to understand your current status. Make sure to focus on all metrics to understand the broader picture, and not just a subset of metrics that often lead to myopic decision-making with respect to SOAR implementation.
Solution #2
Start with an established cybersecurity framework like NIST to guide your security automation implementation journey and prevent over- or under-investments in any particular SOAR capability.
Solution #3
SOAR implementation should not be considered a “set it and forget it” activity. Monitor the implementation, run tests and scenarios, and improve automation processes to ensure they remain up-to-date against evolving threats.
Challenge #2: Lack of In-house Skills
SOAR requires a tailored approach to match the organization’s security objectives and maturity level, and ensure a smooth implementation. This in turn requires that the organization’s SOC have certain skills and capabilities, without which the implementation may slow down, and even fail.
For instance, to integrate security tools or build playbooks, some SOAR solutions require hands-on knowledge of scripting languages like Python, Ruby or Perl. A lack of these coding capabilities will hinder your ability to complete the required integrations, and build the necessary playbooks.
Solution #1
Before selecting and finalizing a SOAR solution, check what in-house skills are required to successfully make use of that solution. If you already have these skills, go ahead and deploy that solution. If not, either look for another solution, or find resources with these skills.
Solution #2
If your team has a mix of coders and non-coders, you can deploy a solution that supports both a graphical user interface (GUI) with drag-and-drop functionality, and an integrated development environment (IDE), The GUI is ideal for non-coders who can start using the solution out-of-the-box, while the IDE is suitable for coders who can customize the solution as per the organization’s unique needs.
Solution #3
If neither of the above solutions is feasible, check if the SOAR vendor can provide professional services to assist with implementation or customization of the required integrations and automation playbooks. This discussion should take place before purchase, not during implementation. This step is even more important if you have processes that involve interaction with legacy systems or applications.
Challenge #3: Difficulties with Automation
The automation of security operations processes is a big part of SOAR (the “A”), but this is also where some organizations struggle. This is because they’re either unclear on which processes should be automated, try to automate every possible process, or assume that automating a flawed process will magically improve its efficiency or performance.
None of these strategies is desirable, because SOAR is not a silver bullet that will resolve every security issue and automate every legacy process. SOAR can only help security teams (and therefore the organization) to better utilize their current resources to improve enterprise security.
Solution #1
Before creating SOAR process playbooks, your security team should ensure that it is fully defined and outlined. Visualizing the existing process will clarify SOAR requirements, goals, and action items. This will enable them to work towards achieving these goals, instead of making incorrect assumptions and automating the wrong processes. Good instrumentation and metrics will also guide them towards what to automate next, and why.
Solution #2
To get started quickly, ask the SOAR vendor for standardized playbooks prior to solution implementation. After deployment, you can start customizing these playbooks as per your enterprise security requirements.
Solution #3
Instead of automating every process and leaving every aspect of threat analysis, prioritization and mitigation to the SOAR solution, identify which activities can be automated, and which ones should remain analyst-driven. Look for a solution that offers a single workflow to seamlessly manage both kinds of tasks.
Conclusion
A SOAR platform, like SIRP, brings advanced capabilities into an organization’s security ecosystem. But it doesn’t eliminate the need for human decision-making and judgment. Moreover, its automation capabilities do not extend to resolving the challenges we have outlined here. So before embarking on your SOAR journey, make sure you’re aware of these challenges, and are prepared to deal with them in order to get the maximum value from your investment.
To learn more about SIRP, arrange a personalized demo.
