An increasing number of companies leverage SOAR to improve the effectiveness of their cybersecurity operations. In this article, we explain how harnessing the value of SOAR could be crucial to improving the security of your organization.
What is SOAR?
Coined by the research firm Gartner, Security Orchestration, Automation and Response (SOAR) is a term used to describe the convergence of three distinct technology markets:
1. Security orchestration and automation.
2. Security Incident Response Platforms.
3. Threat Intelligence Platforms.
SOAR technologies allow organizations to collect and aggregate large amounts of data and security alerts from a wide range of sources. As a result, human and mechanical analysis has improved, as have standardization and automation of threat detection and recovery.
It is estimated that by the end of 2020, 15% of organizations with a security team will leverage SOAR technologies. In 2018 they were 1%.
How is SOAR helping companies overcome security challenges?
Rapid technological evolution is bringing complicated challenges to the IT industry. The threats are constantly evolving, the qualified staff is in constant shortage and the IT properties to be managed are constantly increasing. As a result, the SOAR concept is helping companies of all sizes improve their ability to detect and respond to attacks quickly. Let’s see how, in practice, SOAR can improve corporate security.
1. Provide better quality intelligence
Tackling the latest and most sophisticated cyber security threats requires a thorough understanding of attackers’ tactics, techniques and procedures (TTP), as well as the ability to identify indicators of compromise (CIO).
SOAR aggregates and validates data from a wide range of sources. Specifically, these are threat intelligence platforms, security technologies, intrusion detection systems, and SIEM and UEBA technologies. Thus, through the collected and validated data, SOAR helps SOCs to become more intelligence oriented.
The effect of this is that security personnel are able to contextualise incidents, make more informed decisions and accelerate incident detection as well as threat response.
2. Improve the efficiency and effectiveness of operations
The need to manage so many disparate security technologies can put a strain on security personnel. Systems need constant monitoring to ensure efficient performance. Furthermore, the thousands of daily alarms they generate can also lead to dangerous fatigue. The constant transition from one system to another only makes the situation worse, costing teams time and effort, as well as increasing the risk of errors.
SOAR solutions help SOCs automate and semi-automate some of the daily tasks of security operations.
By presenting intelligence and controls through a single panel and using artificial intelligence and machine learning, SOAR tools significantly reduce the need for SOC teams to perform ‘context switching’.
In addition, they can help ensure that processes are managed more efficiently. This improves the productivity and the ability of organizations to deal with a greater number of incidents without the need to hire additional staff. A key goal of the SOAR approach is to help security personnel work smarter and not harder.
3. Improve incident response
To minimize the risk of breaches and limit the extensive damage they can cause, a quick response is vital. SOAR helps the organization reduce mean time to detection (MTTD) and mean time to response (MTTR). Security alarms can be qualified and remedied in minutes, rather than days, weeks or months.
SOAR, therefore, allows security teams to automate incident response procedures. Automated responses can include blocking an IP address on a firewall, suspending user accounts, or quarantining infected endpoints on a network.
4. Simplify reporting
In many cyber security operations centers, frontline workers spend a lot of time managing cases, writing and reporting, and documenting incident response procedures. Instead, by aggregating information from a wide range of sources and presenting it via visual and customized dashboards, SOAR can help organizations reduce collateral work while improving internal communication.
In addition, by automating the tasks of procedures, SOAR helps encode knowledge about threats.
Ultimately, doing tasks faster means more time for threat resolution and mitigation. The longer these are not addressed, the greater the chances of damage and malfunctions.
While both security information, event management (SIEM) and SOAR accumulate relevant data from multiple sources, SOAR services integrate with a wider range of internal and external applications.
At present, many companies are using SOAR services to potential internal SIEM software. In the future, it is expected that as SIEM suppliers begin to add SOAR functionality to their services, the market for these two product lines will merge.
SOD applies SIEM Next Generation and UEBA technology for the management of cyber threats and SOAR processes. This guarantees prevention and timeliness of an excellent level. If you want to know more, visit our SOCaaS service page and contact us for more information.
A SIEM solution in IT is one of the essential components of a SOC (Security Operation Center). Its task is to collect information and analyze it in search of anomalies and possible breaches in the system. But the defense process hasn’t always been that simple. What we now call SIEM, Security Information and Event Management, is the union of two different types of cyber security tools.
SIM and SEM: the origins
Before the arrival of a complete SIEM solution in computing, security was heavily focused on perimeter security and did not keep the internal network adequately controlled. The first solutions developed in the 90s were basic and basically dealt with security information management (SIM) or security event management (SEM). They were solutions available as tools that had to be deployed on-site in the data center to be protected. This limited scalability, because adding capacity required the purchase of additional equipment.
These early solutions were also built on proprietary databases that forced customers to use technology from a single vendor. If you wanted to move your data to another system, the process was long and complicated. It should also be noted that archiving was more expensive, so only the most valuable data was collected. Furthermore, although the SIM and SEM solutions contained all the data necessary for the defense, the search and alarm were rudimentary. Additionally, they depended on experienced security analysts to research, understand and interpret what they found in the data.
SIEM origins in computer science
As data became more sensitive and technology more powerful, SIEM systems (SIM + SEM) became capable of ingesting, processing and storing a great deal of data. Next-generation SIEM IT solutions are able to use signature-based alerts to identify threats in collected data. However, only those alerts that have identified indicators of compromise (IOC) of a certain threat can be identified in this way.
To be clear, if the type of attack to which a system is subjected has not been cataloged in a series of IOCs, a first generation SIEM is not able to detect it. The main drawback of those systems was the very limited ability to detect unknown cyber threats.
To give a practical example: it was possible to use a rule like this: “give a warning if a user enters 10 consecutive wrong passwords“. In theory this could be used to detect brute force password attacks. But what if the attacker only tried 9 passwords in a row? Or what if the alarm was given for a very forgetful user?
Next Gen SIEM (NGS)
A next generation SIEM is built on a large data platform that provides unlimited scalability and is hosted in the cloud. A next gen SIEM includes log management, advanced threat detection based on behavior analysis and automatic incident response, all on a single platform.
This eliminates the problems that old on-premises systems were prone to. Not having to install anything and being able to send the necessary data to the cloud quite simply, the computing power of the local machine is not compromised and the SIEM can manage all the data safely.
How a SIEM proceeds in cyber threat analysis
1. Data Collection: An IT SIEM solution collects data from across the organization using agents installed on various devices, including endpoints, servers, network equipment and other security solutions. Next generation SIEM includes support for cloud applications and infrastructure, business applications, identity data and non-technical data feeds.
2. Data enrichment: Enrichment adds further context to events. SIEM will enrich data with identity, resources, geolocation and threat information.
3. Data storage: The data will then be stored in a database so that it can be searched for during investigations. The next generation SIEM exploits open source architectures and big data architectures, exploiting their scalability.
4. Correlation and Analysis: SIEM solutions use several techniques to draw actionable conclusions from SIEM data. These techniques vary greatly.
5. Report: A SIEM, particularly a next generation SIEM, gives you the ability to quickly search for data, allowing you to dig through alerts and search for threat actors and indicators of compromise. The displayed data can be saved or exported. It is also possible to use out-of-the-box reports or create ad hoc reports as needed.
What a SIEM is used for
Threat hunting and investigation
The ability to perform threat hunting on a SIEM is critical to understanding the true patterns of attacks based on access, activity and data breaches. By developing a detailed and contextual view of attacks, security analysts can more easily develop policies, countermeasures and incident response processes to help mitigate and remove the threat.
Response in case of an accident
An effective response to incidents is essential to intervene more quickly and reduce the residence time of the threat. For this, a SIEM provides an incident response playbook with configurable automated actions. A SIEM is able to integrate with third party solutions for security orchestration (SOAR) or individual case management.
Defense against insider threats
The reason why insider threats are such a big problem is because it’s not about entering the perimeter, but about exploiting insider positions. They can be your employees, contractors or business associates. It may be they themselves wanting to exploit their location, or their account may have been hacked.
With all kinds of internal threats, the attacker tries to stay hidden, gathering sensitive data to exploit. This could cause significant damage to the company, its position in the industry and its relationship with consumers or investors. By using a SIEM, you avoid this risk.
Cyber threat detection
Your organization is likely to have at least one sensitive data repository. Cybercriminals thrive on looting this data for financial gain. Many breaches begin with a simple phishing email against an organization’s target. Simply clicking on an attachment can leave malicious code behind. A SIEM will allow you to monitor advanced cyberthreat patterns such as phishing, beaconing and lateral movement.
For many industries, adherence to compliance standards is critical. A SIEM can help by providing reports focused on data compliance requests. Integrated packages covering all major mandates, including PCI DSS, SOX, and ISO 27001, are a standard feature of SIEMs as well.
Next Generation SIEM
A next generation SIEM is not just a cloud hosted system. It also makes use of the implementation of AI and Machine Learning to increase the defense of the IT system.
We will see it in a future article, but it is right to specify that the SOCaaS offered by SOD makes use of the latest generation technology offered by Next Gen. SIEM systems. Contact us to find out more about it and talk to experts who can dispel all your doubts.
Evolving beyond its roots in log file management, today’s security information and event management (SIEM) software vendors are introducing AI, advanced statistical analysis and other analytical methods into their products. . But what is SIEM software and what are its uses?
Acronym for Security Information and Event Management, it is a product that provides cyber security professionals in companies with an overview and a track record of the activities within their IT environment.
The technology used has been around for more than a decade, and has evolved from the practice of managing log files. It combined security event management (SEM), which analyzes log and event data in real time to provide threat monitoring, event correlation and incident response, with security information management (SIM) that collects, analyzes and reports log data.
How does it work?
SIEM collects and aggregates log data generated across the organization’s technological infrastructure, from host systems and applications to network and security devices such as firewalls and virus filters. Then, it identifies and categorizes incidents and events, as well as analyzing them.
The software has two main objectives, which are: to provide reports on incidents and events related to cyber security, such as successful and unsuccessful logins, malware activities and other possible malicious activities, and to send alerts if the analysis shows that an activity ‘goes against established rules, indicating a potential security problem.
According to experts, corporate demand for more security measures has pushed the market to expand in recent years. Today, large organizations look to SIEM as a basis for the creation of a security operations center (SOC).
Analysis and intelligence
One of the main factors underlying the use of SIEM software for security operations is represented by the features offered.
Many products offer threat intelligence feeds in addition to traditional log file data. Some SIEM software also has security analysis capabilities and examines network and user behavior to provide more information on whether or not an action indicates malicious activity.
Generally speaking, SIEM tools provide:
1. Real-time visibility through an organization’s IT security systems
2. Event log management that consolidates data from numerous sources
3. A correlation of collected events from different logs or security sources, using rules that add important information to the raw data
4. Automatic notifications of security events. Most SIEM systems provide dashboards for security issues and other direct notification methods
The SIEM operation process
In practice, the operating process of a SIEM system can be divided into the following steps:
1. Data collection: All sources of network security information (eg servers, operating systems, firewalls, anti-virus software and intrusion prevention systems) are configured to send event log files. Most modern SIEM tools use agents to collect event logs from business systems, which are then processed, filtered, and sent to the system.
2. Policy: A policy profile is created by the administrator. This defines the behavior of business systems, both under normal conditions and during predefined security incidents. We provide predefined rules, alerts, reports and dashboards that can be adjusted and customized to your specific security needs.
3. Data Consolidation and Correlation: These software consolidate, analyze and control log files. The events are then categorized based on the raw data and correlation rules are applied that combine the individual events.
4. Notifications: If an event or set of events triggers a SIEM alarm, the system notifies the security personnel.
It is clear that a SIEM stops at the analysis of threats and subsequent notification. Following these, someone needs to intervene, both by checking the reports and taking measures to mitigate any threat. This can only happen if there is a team of trained technicians behind the software 24/7 to carry out maintenance and intervene when necessary.
While these solutions offer various benefits to businesses of all sizes and shapes, they also have limitations and vulnerabilities that should not be ignored.
A SIEM requires constant 24/7 monitoring of logs and alarms, regular maintenance and configuration, as well as a dedicated security team responsible for managing the software. Most of the work begins after the SIEM implementation. Therefore, organizations cannot rely on these solutions alone to protect critical IT infrastructures.
Even with such a system in place, security professionals must ensure that they have adequate resources, tools, budget and time to be able to exploit the features and ensure complete protection against potential security threats.
From this point of view, the most interesting solution for companies is that of a SOCaaS, which includes SIEM and other suitable tools for a complete management of a company’s cyber security.
La maggior parte degli ambienti di hosting utilizzano un'interfaccia intuitiva per aiutare gli utenti a gestire i l… https://t.co/tGd8EwJmU4
Most hosting environments use an intuitive interface to help users manage their web spaces. Two very famous panels… https://t.co/UVLwZOGouC
Una soluzione SIEM in informatica e' uno dei componenti essenziali di un SOC (Security Operation Center). Il suo co… https://t.co/lz8yrVoVrv
Evolving beyond its roots in log file management, today's security information and event management (SIEM) software… https://t.co/jBMv9QKWdF
Evolvendosi al di la' delle sue radici nella gestione dei log file, gli odierni fornitori di software per la gestio… https://t.co/zZjnMSu1i7