Could SOAR save skills-short SOCs?

Abstract

Over the past year or so it's becoming clear that, when it comes to a cyber breach, it's no longer a matter of if it will happen, but when. With threats coming in thick and fast, organisations, and the cyber security professionals in their employ, are increasingly struggling to resist each and every threat; and they know it. A 2018 CyberEdge survey revealed that 77% of respondent organisations were compromised during the 12 months ahead of the study. 1 With a skills shortage and working with tight budgets, security operations centres (SOCs) are struggling with limited resources. The problems faced by SOCs need a solution, and embedded security orchestration, automation and response (SOAR) promises to be just that. A SOAR approach automates a lot of the mundane tasks usually undertaken by SOCs. By reducing the day-to-day workload through improved intelligence and reporting, streamlined workflows and playbooks for automated response actions, SOAR can enable cyber security professionals to put their talents and knowledge to better use, explains Ross Brewer of LogRhythm.