Security Response Orchestration

Orchestration builds on automation capabilities. Full automation is not appropriate in all circumstances. When dealing with complex incidents, human knowledge can help to better understand context so that more informed decisions can be taken. Security response orchestration aims to provide that in an effective manner.

Why is it important (hot)?

Figure 1: Severity of incident response challenges (Source: Virtual Intelligence Briefing)

Organisations are increasingly being placed under pressure to respond to an ever growing volume of increasingly complex cyber attacks that put their organisations at risk. In response, organisations have implemented a variety of security controls to increase their defence capabilities, but this does not solve all the issues that they face. Rather, greater focus on an effective response strategy is needed.

The vast majority are under pressure owing to the worldwide shortage of skilled security personnel, increasing the desire to automate tasks where possible to make the most of the limited skilled resources that they have available. Many traditional incident response controls throw up enormous volumes of alerts, many of which are irrelevant, making it hard to determine which constitute an real threat so that response actions can be based on actual need and prioritised according to the severity of the threat the organisation faces.

For many years, incident response automation has been seen as a panacea to reach for, removing much of the manual labour involved in responding to a security incident. Tasks that are suited for automation are those for which the outcome is defined and relatively certain, such as deploying antivirus defences, authentication controls, automated patching and firewall management. However, there is a significant amount of uncertainty associated with cybersecurity, which requires that the response to a situation must be dynamic and agile. Adversaries are not only malicious, they tend to regularly change tack in terms of their tactics to gain the upper hand against defenders. A response system that can be adapted to needs and current circumstances is required. Orchestration provides the answer to this—it uses automation where possible, complementing this with human coordination where necessary to achieve the desired result.

How does it work?

Figure 2: Impediments facing IR teams (Source: SANS Institute)

Security response orchestration helps organisations to respond effectively to data related to security events that has been gathered, correlated and analysed from multiple sources throughout the network. Building on automation capabilities, the emphasis of orchestration is on utilising the knowledge of humans where an outcome is unsure to make the entire response process more efficient and effective.

With security response orchestration, possible responses to security incidents are often codified in playbooks that outline processes required for a coordinated response following predefined steps based on the nature of the incident. Something to look for is the provision of information related to regulatory compliance requirements that can be mapped to obligations that must be met to the response actions being taken to avoid any situations of non-compliance.

To make orchestration more effective, threat intelligence updates are required for providing context into the nature and severity of an incident. These help to supplement alerts with relevant context regarding the details of the attack.

Machine learning applied to historical responses to threats, taking into account the effectiveness of the human response rather than just relying on historical data of what occurred, is a core facet of many orchestration technologies. It enables automation capabilities to be built based on the results of previous investigations in a proactive manner, helping to improve an organisation’s overall security posture.