SOAR and Its Contribution to Cybersecurity Architecture

Today the fight against cyberattacks spans a very wide range, from the security of every internet-connected device in our homes to the protection of critical infrastructure on an international scale. Security tools used at individual and organisational level play an important role in this fight.

Working on the principle of monitoring the activity on all devices in a network and passing detected threats to cybersecurity teams, “Security Information and Event Management” (SIEM) solutions are tools that give cybersecurity professionals a monitoring capability.

Working on a similar principle, security tools such as “Endpoint Detection and Response” (EDR), “Managed Detection and Response” (MDR) and “Extended Detection and Response” (XDR), which can detect malware and take measures against these threats, also contribute to the cybersecurity architecture alongside SIEM systems.

In recent years, “Security Orchestration, Automation and Response” (SOAR) systems, which take existing capabilities even further, have been added to the range of security solutions.

In this article we will try to examine the role of SOAR systems in the fight against cyberattacks and their contribution to cybersecurity architecture.

What Is SOAR?

SOAR is a cybersecurity tool designed to optimise cybersecurity operations. These systems integrate threat detection, response and remediation while also supporting cybersecurity teams with automation features.

More concretely, as a platform from which a cybersecurity team can control all the security tools it manages from a single centre, SOAR takes cybersecurity operations to a different level thanks to its ability not only to detect threats but also to react to them simultaneously.

Before SOAR, cybersecurity architecture generally relied on manual processes. Intervention, analysis and response to detected security incidents were usually handled separately, which could cause lost time and delay an effective response.

With SOAR systems becoming part of security architecture, the overall effectiveness of cybersecurity began to increase as the capabilities of rapid reaction, effective coordination and continuous improvement were gained in the fight against cyberattacks.

The Development of SOAR Technology

The needs that would give rise to SOAR systems were identified, and these systems first put into practice, in the early 2010s. We can examine the not very long history of SOAR and the development of these systems in stages under the following main headings:

1. Identifying the need and awareness phase (2010–2015): As cybersecurity operations grew more complex and threats increased, security teams realised that manual processes were inadequate. In this period, the need for, and awareness of, how automation and integration could be built into security operations emerged. The first SOAR solutions began to develop, focusing on providing automation and integration to manage security incidents more effectively. The first SOAR platforms combining threat intelligence, automation and response processes appeared in this period.

2. Integration and expansion (2015–2020): In this period, the integration capabilities of SOAR systems with various security products and tools were expanded. SOAR platforms began to manage a wider range of security incidents and to integrate data from various cybersecurity tools such as SIEM and EDR.

3. Adding AI and analytical capabilities (after 2020): Today, artificial intelligence and machine learning capabilities are being integrated into SOAR systems with the aim of detecting more complex threats and responding more intelligently, and the capabilities of these systems continue to be developed.

In this context, real-time analytical capabilities and the capacity to understand the context of incidents were developed first. Beyond automating the processes from threat detection to response, SOAR has also been turned into comprehensive security platforms. These platforms offer cybersecurity teams an integrated approach, enabling them to manage, analyse and respond to incidents better.

What Do SOAR Systems Contribute to Security Operations Center (SOC) Architecture?

Managed security service providers (MSSPs), which provide security services to companies, and Security Operations Center (SOC) teams, which house cybersecurity tools as well as trained cybersecurity analysts who manage these tools and processes, became the teams that use SOAR systems most intensively.

The reason is that, besides the cost making it impossible for companies of every size to acquire a SOAR solution, it is also unrealistic to use a SOAR system effectively without trained engineers and analysts.

It is no exaggeration to say that, besides reinforcing conventional capabilities, SOAR has the potential to shape SOC architecture significantly.

Being a platform into which all the solutions within SOC teams, such as SIEM and EDR/MDR/XDR, can be integrated and through which automated reactions (isolating a device from the network, blocking an IP address or hash value, and so on) can be taken has made SOAR even more important alongside other solutions and components.

SOAR’s contributions to SOC architecture can be listed as follows:

1. Automation and integration: SOAR’s ability to react quickly and automatically to security incidents lets SOC teams speed up the processes from threat detection to response through automation and minimise manual workload.

2. Division of tasks and cooperation: SOAR offers the opportunity to improve the division of tasks and cooperation between security teams. Through the automation of certain tasks and integration, teams can communicate and work together more effectively.

3. Centralised management: By integrating with different security tools and systems, SOAR makes it possible to manage the various components of a SOC from a single centre. Whereas in the past responding to threats detected by different security tools required monitoring each tool, SOAR systems make this possible through a single platform. This allows cybersecurity operations to be better coordinated and efficiency to increase.

4. Real-time threat analysis: Equipped with real-time threat analysis capabilities, SOAR helps the SOC detect and respond to threats faster and more effectively.

5. Continuous improvement: SOAR supports continuous improvement by using data from security incidents. This helps the SOC analyse its operations, optimise security measures and be better prepared for future threats.

With the capabilities described above, SOAR can strengthen cybersecurity operations by helping the SOC work more effectively, quickly and adaptively.

Could SOAR Systems Also Be Seen as a Threat to Cybersecurity Analysts?

The fact that it optimises cybersecurity operations and completes threat detection with automated reaction raises the question: “Could SOAR systems become a threat to cybersecurity analysts in future?”

While helping cybersecurity analysts with its current capabilities, a SOAR system can be seen less as a threat than as a support tool. After all, by automating repetitive and time-consuming tasks, SOAR enables security teams to respond faster.

Moreover, SOAR’s capabilities do not eliminate the importance and role of cybersecurity analysts; they allow analysts to focus on the more complex and strategic tasks they should be concentrating on.

Although SOAR provides automated reaction and remediation, human analysis and expertise will remain important in the future. Given the complexity and variety of attacks, cybersecurity analysts will continue to play a critical role in detailed analysis and decision-making.

SOAR can be effective against known threats, but cybersecurity analysts will always be needed as a core component because they provide the flexibility and creativity required to deal with new, constantly evolving threats.

SOAR, moreover, by automating routine tasks, gives analysts the chance to focus on more strategic, human-centred tasks. These may include developing security strategies and improving training and awareness.

As a tool that supports cybersecurity analysts and cybersecurity operations in general, SOAR adds a new dimension and strength to the fight against cyberattacks, while the human factor will keep its critical role in the use of SOAR and similar security tools.

In conclusion, the use of SOAR systems, which bring an important innovation to cybersecurity architecture, will keep growing, and the capabilities of security solutions such as SIEM and EDR will be usable more manageably and effectively on a single platform.

While its optimisation and automation capabilities are acknowledged, SOAR will only ever contribute to the fight against cyberattacks thanks to the oversight and correct configuration of cybersecurity analysts.