Security threats are becoming more sophisticated and more numerous than ever before, and that’s not going to change anytime soon. Looking for a solution to the avalanche of security threats that many big companies are facing, security engineers have often turned to progressive automation as the next step in the evolution of cybersecurity.
And while automation has always been deemed as a thing of the future, it seems that the future has arrived, and automation is already making strides, primarily as one of the main capabilities provided by SOAR (Security Orchestration, Automation and Response).
However, even though automating a significant portion of your security tasks is slowly becoming common practice, there are still many who are skeptical about automation and are reluctant to delegate entire processes to the hands of security automation. But is that skepticism justified? And will progressive security automation prove to be the antidote to the evolving threat landscape? Read on to find out.
What is security automation?
Security automation describes the process of using artificial intelligence and machine learning to apply full or semi-automation to workflow processes. Automation makes human intervention redundant – to some extent – and gives organizations the freedom to choose which tasks they want to automate and which tasks they want to handle manually.
If we were to define security automation in a nutshell, it would go something like this:
-
The technology used to make cybersecurity processes free of manual intervention.
Even though full automation of high-caliber security processes is still not common practice, the application of automation for simpler, repetitive tasks that take up a lot of analysts’ time is definitely achievable and actually present in many SOCs today.
Security Operations Centers (SOCs), especially those in charge of guarding highly-targeted organizations, are in dire need of technologies that boost their productivity and allow them to optimally utilize their resources. Ergo, SOAR as a technology that applies progressive, machine learning automation is deemed as a very popular option.
Task overload and alert fatigue are deemed as one of the biggest challenges in today’s cybersecurity world, and this is why the premise on which SOAR is built revolves around security automation and orchestration. SOAR was actually created with the goal of automating a wide range of repetitive tasks in order to take some of the burdens off of analysts’ shoulders.
With the implementation of SOAR, security analysts and engineers can actually choose which processes they want to fully automate and which processes they want to semi-automate or handle manually. This level of automation is completely adjustable, allowing security professionals to have the freedom to apply automation in the way they deem most beneficial.
What does progressive automation mean in SOAR?
The automation technology applied in SOAR utilizes a machine learning engine. What this means is that the engine itself is programmed to extract knowledge out of the cyber threat it encounters.
For example, let’s say that there is an alarm triggered, signifying a potential breach or malicious file. Once SOAR reads the details and consumes the data regarding the idiosyncrasies of the threat, it will provide recommended courses of action in order to determine the status of the alert as a false positive or actual threat.
What this means is that by using the knowledge it has extracted from previous encounters with similar threats, SOAR can actually determine the degree of danger this alarm poses to the organization with great accuracy.
If SOAR had previously been alarmed of a similar threat with similar characteristics, it would use the courses of action taken that were previously used to effectively nullify and remediate that threat, and from the extracted knowledge, it would either label the threat as a false positive or an actual threat. If the alarm proves to be a threat, SOAR will either carry out the remediation phase by applying automation or it will notify analysts to manually handle the tasks. This depends on the level of automation the analysts chose to apply to these types of processes.
The reason why this type of automation is labeled as progressive is that its machine learning engine allows it to continuously build up its knowledge and sharpen its detection capabilities. The more threats it encounters, the better it will be at recommending correct remediation procedures and autonomously improving its decision-making skills.
Why is automation necessary in cybersecurity operations?
Security Operations Centers are often understaffed, as the lack of skilled security professionals is becoming more prominent. Additionally, given the evolving unpredictability of modern-day cyber threats, this means security professionals are now required to do more with fewer resources, and without the help of automation, that mission is virtually impossible. Some of the main reasons why automation is deemed as a necessity in the modern-day cyber world are:
-
Takes care of repetitive, mundane tasks single-handedly
-
Allows analysts to save more time and focus on high-stake assignments
-
Allows SOCs to optimally utilize their resources
-
Sharpens the SOCs threat-detection skills
Automating security processes, even the low-risk, repetitive ones, will alleviate much of the burden and allow analysts to direct their focus on high-stake tasks such as threat hunting and intelligence gathering, rather than spending time catching up with the huge volume of alerts, which often leads to alert fatigue.
Moreover, given that some SOCs are bombarded with endless alerts, applying automation to find out if they’re false positives or false negatives alone is a major, major benefit.
Can cybersecurity operations be fully automated by SOAR?
Yes, but not all SOAR solutions offer full automation. In fact, currently, Cloud SOAR is the only SOAR platform to offer full incident lifecycle automation. Cloud SOAR uses an R3 Rapid Response Runbook engine which is able to fully automate vital operations of an incident lifecycle, including:
-
Advanced Triage
-
Investigation
-
Containment
The R3 Runbooks include 100+ out-of-the-box automation actions that ensure no security alert is unassessed.
The full automation provided by Cloud SOAR allows SOC teams to extract relevant and granular data regarding a cyber threat, and its dual-mode action feature allows the combination of manual, semi-automated, and fully-automated actions. This allows security analysts to determine the appropriate level of automation applied to a certain threat.
Still, it should be noted that not all security operations should be automated. Tasks that are occurring scarcely and are labeled as high-risk can be handled manually.
How reliable is security automation?
Progressive automation is highly reliable, but it is still used with a grain of salt by many SOCs. Automation is still considered a new phenomenon in the cyber world, and many organizations are not feeling comfortable leaving entire operations in the hands of automation.
If we were to assess the reliability of automation in an objective manner it would go something like this:
-
Low-risk, repetitive tasks: Many organizations are using automation to automate repetitive, mundane tasks. The reliability of automation for these types of assignments is high.
-
High-risk, unprecedented alerts: New alerts with no recognizable pattern should be assessed by SOAR, accompanied by human interaction.
Once again, analysts can choose which tasks they want to automate, as the degree of automation is completely customizable, allowing analysts to decide which assignments they want to fully automate, and which ones should include human intervention.
The expertise of skilled cybersecurity professionals cannot simply be replaced by technology, regardless of how advanced and contemporary. But still, even if progressive automation is used only to handle low-risk assignments, that would still make up more than 60% of all the alerts, meaning that it’s going to offload a big portion of alerts and make life easier for analysts.
How prevalent is progressive security automation?
There are still mixed feelings about automation in the cyber world. Those organizations that don’t receive a huge amount of alerts don’t feel obligated to implement automation. But those organizations that are constantly attacked with huge volumes of alerts are already reaping the benefits of automation.
It all depends on the maturity of the organization and the level of alerts and threats they are facing. Security automation is still considered uncharted territory for many, so the application of automation is not taken lightly. Why automate when we can do things manually? That is the question many would ask if they are not threatened by too many alerts. But, the ROI of automation is clear:
-
Time-saving
-
Addressing the skill shortage
-
Preventing alert-fatigue
-
Drastically improve response time to threats
-
Enhanced detection of false positives
-
Optimize the utilization of resources and staff
The benefits of security automation are more than obvious, but there is still fear in some that automation may compromise the infrastructure of their security platform, which is justified but not realistic. Security automation is built to enhance the cybersecurity posture, not cripple it.
Bottom line, security automation is not as prevalent as it should be at the moment, but the circumstantial evidence leads to the fact that no organization is capable of filtering out thousands of alerts without the use of automation; thus the implementation of automation and SOAR, in particular, is only going to go up from here.
