One of the buzzwords when talking about Incident Response is playbooks or advanced workflows with specifically tailored actions. Learn more.

The terms security automation and security orchestration are often used almost interchangeably nowadays in the IT ecosystem. But it’s very important to note that these terms have completely different meanings and purposes. The aim of this blog is to discuss the core differences by explaining what these terms mean exactly, what their functions are, and how they can be used within an IT context.

Creating a modern security operations center (SOC) requires so much more than getting the right equipment and hiring experts. In fact, it’s a constant process of keeping up with countless security threats, staying up to date with developing trends and technologies, recruiting and keeping skilled professionals, while also providing them with an environment they can thrive in. All this, while aiming to improve the overall organization’s security posture and performance.

Security incidents and digital forensics investigations are complex events with many facets, all of which must be managed in parallel to ensure efficiency and effectiveness. When investigations are not managed and documented properly, processes fail, critical items are overlooked, inefficiencies develop, and key indicators are missed, all leading to increased potential risks and losses. Investigation management can be broken down into a number of key components and it is important that an organization is able to carry out all of these elements collectively and seamlessly in order to properly handle and manage any incident they may potentially face.

SANS recently released their 2018 SOC Survey and many of their findings were of no surprise to anyone who has been responsible for maintaining their organization’s security posture. Many respondents reported a continued breakdown in communication between NOC and SOC operations, lack of dynamic asset discovery procedures, and event correlation continues to be a manual process even though SOC staffing is being worn thin by the surmounting responsibilities they have to take on.

Read our latest blog and find out how SOAR extends the limits of what your SOC team previously thought was capable of achieving.

I have often talked about the benefits of employing flexible playbooks to deal with evolving cyber incidents and unique threat scenarios, and in these series of blogs, I am going to explore some of the points of emphasis when creating a new playbook.

Incident response has become a crucial component in the information security management process of every well-prepared organization. Performing effective incident response is a complex operation that requires resources and planning. Forensically sound preservation of evidence can also easily be overlooked by an incident responder due to the rapid and changing nature of the incident being investigated, which can potentially have a huge impact on the effective post-incident analysis and potential legal position.

As technology becomes more sophisticated, organizations find it more difficult to fully protect sensitive data, as cyber fraudsters use evolving technology to penetrate security platforms. Read this blog post to find out how SOAR strengthens security teams and prevents cyber fraud.

Incident response automation brings many benefits to SOCs, but it must be done in a balanced and well-organized manner.