The next-generation security operation centre’s (SOC’s) response to cyberattacks requires an intimate coupling of three primary platforms and disciplines: security automation and orchestration (SAO), security incident response (SIRP) and threat intelligent platforms (TIP). The introduction of the SOAR — security orchestration, automation and remediation — facilitates automated containment and remediations to automated attacks.

The efficacy of the traditional manual response to effective containment and remediation has reduced significantly with an inversely proportional increase in the costs associated to manage, let alone the difficulty of finding these key skills.

With the ever-increasing consumption of cloud-based services, consuming what you need as and when you need it is not a new concept. We believe that cybersecurity should and could be readily available to all. The democratisation of security is made possible through the “as a service” model. And SOAR “as a service” is core to everything we do at Port443.

In most ICT estates, there is a plethora of security controls from an ever-increasing vendor landscape. Ensuring that these controls are “state aware” and can trigger each other requires platforms that can integrate across these technologies. The inherent integration and automation capability of SOAR’s provides significant benefits:

Traditional SOC operations generally have a bias towards containment, incident response and remediation, with less focus on the hardening of the existing controls, and ensuring they remain hardened. Using the power of automations inherent in a SOAR, one can be assured of a more defensive approach with continual adherence to best practice and appropriate framework conformance such as NIST, CIS and PCI.
It is only through the integration across multiple controls, that one can immediately move to containment when automations are triggered as a result of indicators of compromise (IOCs).
The contextualisation of threats with supplementary threat intelligence allows for a quicker response for validation, supported with AI and machine-learning capabilities.
Visibility into the threat landscape, incidents and what has been immediately contained is inherent in most Soar platforms.

A SOAR platform should not be the exclusive domain of large Managed Security Service Providers. Any company that has invested in security controls should be the beneficiary of the capabilities that a SOAR has to offer. However, the traditional assumption is that the investment in a SOAR, where a company only requires minimal functionality is not really worth it. Further to this, the skills required to build effectively on a SOAR are very difficult to come by. A combination of software dev, security and operational skills is not readily available.

It is for these reasons that we believe the capabilities and benefits of a SOAR should be extensible to all companies, irrespective of size and industry. If as a company you deem your information to be valuable and a breach of some sort could be debilitating, ensuring your security estate is effectively configured to best practice should not be a question of affordability. Neither should the opportunity to have your core assets constantly monitored for potential IOCs.

Aligned

Many organisations have spent a fortune on various cybersecurity controls, from various vendors. Our approach is to make sure you sweat those assets by validating the configurations on a continual basis — essentially maintaining a posture that is aligned with your business risk appetite. We do this using the automations developed on the SOAR, at a price point that is affordable. Further to this, we use the automations of the SOAR to ensure that your security controls are all mindful of each other’s state at any point in time. And when an IOC is picked up, the automations immediately trigger the various controls locking down the estate by ensuring immediate containment. Thereafter, with additional threat intelligence, an orchestrated decision can be made either to retract the policies that were automatically implemented or allow for them to remain in place. All the while taking comfort that the threat has been contained.

Our belief is that cybersecurity needs to be affordable, consumed as a service and focusing on a continual defensive approach, all while sweating your existing assets.

About Port443
Port443 is a cybersecurity company operating across the Middle East and Africa offering services to all market segments. We believe that security should be readily accessible, affordable and always ahead of the ever-evolving threat landscape. Our core platform is a SOAR (security orchestration, automation and remediation) platform on top of which we offer automations “as a service” across multiple security controls and across multiple security technologies. The automations augment security engineering teams, introducing efficiency and speed in reacting to IOCs and a focus on continual hardening of the existing security controls.

Port443 has extensive experience in identifying candidates for automation and building these automations, so they can be consumed “as a service”.

Contact us on [email protected] or via our via our website www.port443.co.za. Alternatively, find us on LinkedIn.