That moment when you realise SOAR is just a bunch of building blocks.
That moment when you realise SOAR is just a bunch of building blocks.
I hear this a lot, but it doesn’t matter. If anything, a smaller team has more of a need for SOAR.
Don’t believe me? Listen to Bruce Potter (CISO, Expel) and Mike Johnson (CISO, Fastly) on the CisoSeries blog (fast forward 1m38s)
A listener writes in asking “How do you thrive, and how do you survive as a team of 1?”
The panel discuss many general points, including:
Whilst the panel lean towards distributing responsibilities and finding allies to do work on your behalf (lucky them), I was just hearing:
Essentially, automate the hell out of it. If you have 1 or 2 people, surely automation is the only way to scale.
Example: User submits a request (priority 3?), which goes to the bottom of the priority queue, which takes 2 days to find, and 30 minutes to fix. That’s a long wait for something simple. People see the IT team as blockers, not enablers.
Now imagine SOAR performing all those simple/fast requests with a turnaround of 2 minutes. 2 days wait -> 2 mins wait is a 144,000% increase in service you give without any additional head count or training.
Use Cases every sized organisation has to deal with:
This has a few benefits:
That’s just the basics of what SOAR does. Taking that further and using all the functionality of SOAR Case Management here too:
Honestly I could go on lots more on how SOAR in the background supports a smaller team, but I hope this makes the point?
After recently getting married, I quickly discovered my wife was cheating on me, with these three:
As soon as I left the house to go shopping, seeing the family, or working away my (NOT-SO-)good lady would jump into bed, turn on the TV and spend quality time watching series without me, getting ahead in a series we were watching together !
This is disastrous and would no doubt lead to a playbook on how get divorced. Urgent actions were needed, so I turned to SOAR!!
(Really this is a blog post about automating the whitelisting/blacklisting of IP/domains. Either for a SOC team who are detecting new attacks, or whether it’s members of staff managing their own policies. But hey I love drama, pun intended. Read to the end where I discuss “This In Business”)
I need a process that:
SOAR running on a virtual machine at home
The DNS activity/alert is generated by PassiveDNS on a Raspberry PI on a network sniffer port
My home network has lots of Unifi in. Unifi do amazing kit with a full API available to control the WAP, Firewall rules, network config etc. I <3 the Unifi!
To avoid a SIEM at home, I simply have PassiveDNS forward logs for Netflix DNS requests direct to SOAR.
PreProcessing is then used to make sure that all prior tickets/incidents are closed (i.e. check this is a new situation)
SOAR then queries my Unifi controller to see if my personal mobile phone is connected to the WIFI. If “yes” then I am home, if “no” I’m likely out travelling.
The VICTIM (innocent me) who is likely in a hotel/shop is then either sent an email with a choice to block the activity instantly, or to request a justification….
….or if I’m being an uber admin, I can use the mobile app to decide….
If I chose to ask “EnforceJustification” a questionnaire is send to the wicked one!
Answers are forwarded to the sysadmin
Of course being the benevolent kind generous soul I am, I of course decide to Allow this traffic (between you and me, I watched this the other day, so I’m already ahead of her… #guilty)
And thus our marriage is saved. Should I train to become a marriage counsellor?
I previously talked about the value of SOAR and I think this playbook ticks off many of those:
Many of us are familiar with this phone call from a member of staff who was denied a work related website:
“How dare you block my access to the internet, I need that website to do my job! You’re stopping business! Stop being paranoid! I’m going to report this!”
So let’s adapt the above process:
We now have a process that is operational 24/7, works at the speed of the affected staff (not the huge workload of the security team), takes no effort on your team, does threat enrichment and sanity checking, cleans up after itself, has SLA, RBAC, is fully audited. All the while, no member of staff was given access to any security tool!
I previously posted “but don’t forget that over-automating can lead to reduced visibility“. Machines do what we tell them (to a fault), how do we retain some control?
Example – At Demisto, when you ask for access to our help-center, the email is processed by a SOAR playbook to validate the request, manage access, and respond to the user, like self-service.
However recently it took a wrong turn so I had to open and take control and override our usual logic. This was easy as each incident (which the automation belongs to) is tracked like case management, so we simply “re-open”, open up the playbook to find the issue, and correct it.
So what best practise can we utilise to keep control over SOAR?
Human Checks – Before any critical steps (e.g. pushing IP to firewall) you might want to ask a human analyst to verify (either using ticket management, email/slack question, or using the Mobile App)
Playbook Design – Many playbooks have forks based upon automated decisions. Consider the chain of events in a ticket if is restarted from a certain point taking a different action. Do any original steps have to be undone? A good design allows users to quickly make changes and walk away.
Human Notifications – If anything is seen slightly odd (too much data in a reply) then continue a human analyst of the observation with a direct link “click here to see the playbook in operation”
Summary Page – All key data and decisions should be in the tickets summary page, so any analyst/team leader having a quick view can see the key points of ticket (e.g. User not found resulting in playbook taking a specific course of action)
“Visibility is critical in all contexts: network, endpoint, DNS, email, web and, most importantly, the hybrid cloud, where monitoring workloads and accessibility presents a big challenge.”
Agreed, in a way SOAR isn’t a security tool, it orchestrates them, so make sure you have visibility. Even a free/open/cheap tool with SOAR can show value if it’s integrated to a complete workflow.
Lots of great points in the article, I’ve taken a few out below.
“Organizations are being forced to hire Tier 1 analysts with little or no experience, and spread their Tier 2 analysts too thin”
To help your Tier1 team, either hire anyone in IT and just do data collection, or use Automation:
” …if there is no judgment to be made, you don’t need a human analyst – you need to automate. “
To help your Tier2 team
“Analysts should be equipped with tools that can help them automatically investigate incident “
I recently attended a talk by Bruce Schneier talking about Automation and his new book “Click here to kill everybody” (charming)
Though the talk wasn’t specific to SOAR, it’s still relevant to IT Security I think this borders on similar concepts to SOAR, so here are my personal notes from the talk
The talk summarised with the need for regulation from the govt.
Some food for thought?
I recently wrote about adding a personal touch in SOAR:
One point included an end user who wants to break out of automation and talk direct to a human with a “click here” button, so they don’t feel ignored/shunned.
I noticed recently this is how a lift works. Lots of buttons to trigger certain functions, but also an alarm button to press when something goes wrong… responsible automation.
My own SOAR demo is guilty of not doing this, it intelligently and informatively acknowledges the request and thanks the user, but until my playbook has reached a conclusion the end user is just a stressed and panicking passive bystander.
Here is my new version, you can see the original acknowledgement email which now gives your staff the ability to ‘break out’.
And here is the logic I wanted: increase the severity, assign it to a team member and start the response SLA counter
Great deck (shame I couldn’t watch it too)! I’ve worked in a SOC and in my role I talk to a different SOC every day and agree massively with all of this. Of course I also love how they mention SOAR 😉
The only thing I would add is that Recommendation 1-4 all require having more time (without being bogged down on alert overload) so Recommendation 5 (SOAR) maybe should be promoted to Recommendation 1?
But I work on SOAR, so of course I would say that 😉
” A combination of emerging technologies, alert overload, and fallout from the cybersecurity talent shortage is starting to gradually squeeze out the entry-level SOC position “
“The Tier 1 SOC analyst will become more like the Tier 2 analyst”
“Gone will be the mostly manual and mechanical process of the Tier 1 SOC”
Yup yup and yup.