A Low-Cost and Cloud Native Solution for Security Orchestration, Automation, and Response

Abstract

Information security is a must-have for any organization willing to stay relevant and grow, it plays an important role as a business enabler, be it from a regulatory or reputation perspective. Having people, process, and technology to solve the ever growing number of security incidents as fast as possible and with the least amount of impact is a challenge. The use of security orchestration, automation and response (SOAR) is a way to translate the manual procedures followed by the security analysts into automated actions, making the process faster and scalable while saving on human resources budget. This paper proposes a low-cost cloud native SOAR platform, presenting the underlying details of its design. The performance of the proposed solution is evaluated through real-world experiments performed in a large multinational enterprise. The results show that the solution decreases the duration of the tasks by an average of 99.02% while having an operating expense of less than $65/month.