4 tough questions (and answers) about orchestration

If government IT and security teams appear to be in a perpetual state of stress these days, it’s understandable: They’re under constant pressure to defend an ever-expanding attack surface created by the cloud, a mobile workforce using their personal devices, the internet of things and other trends and innovations. At the same time, adversaries keep coming up with new tricks to compromise data, devices and systems with greater volume and velocity. And it doesn’t help that agencies must effectively respond to all of this with limited funding and personnel.

The cybersecurity environment has shifted dramatically in recent years, and that means yesterday’s tools and approaches -- especially those which rely upon manual and/or siloed processes -- will no longer suffice. In seeking new strategies and solutions to successfully address modern challenges, teams are increasingly turning to what’s known as security orchestration.

Security orchestration is about integrating and automating the entire cybersecurity ecosystem of information-gathering and enforcement products so IT teams can protect networks, systems and devices with unified, holistic visibility. It often incorporates advancements in automation, artificial intelligence and machine learning as part of its solution portfolio and strategic execution plan.

Investment in this approach is producing tangible, bottom line-impacting results: Three of five IT and cybersecurity professionals said they feel that an executed orchestration strategy (one which includes automation, ML and AI) strengthens their cyber resilience, according to research from the Ponemon Institute and IBM. Orchestrated incident responses can save organizations an average of $1.5 million in data breach costs. Within the federal government, orchestration has reduced the time required for cloud service providers to achieve authority to operate under the Federal Risk and Authorization Management Program  (FedRAMP) from 12 to 18 months to as little as six months, according to research from Coalfire.

That said, the adoption of these tools and practices remains somewhat tentative: Just one-fifth of organizations are “extensively” deploying technologies for security orchestration, but two-fifths are doing so on a limited basis, according to research from Enterprise Strategy Group (ESG). This is generally consistent with a forecast from Gartner indicating that, by the end of 2020, three of 10 organizations with a security team larger than five people will leverage security orchestration, automation and response (SOAR) tools.

As for the intended outcomes of orchestration, 35% of IT and cybersecurity professionals would like to integrate external threat intelligence with internal security data collection and analysis; 30% want to expand the functionality of existing tools; 29% hope to automate basic remediation tasks; and 28% would seek to correlate and contextualize data from two or more tools, according to the ESG research.

Clearly, the potential benefits are immense for government customers. However, agency IT/security team leaders may face pushback in getting approval for SOAR implementation. With this in mind, here are effective responses to four tough questions IT managers are likely to get from budget decision-makers and other key influencers about orchestration:

Question 1: I don't know anything about orchestration. Is it just another buzzword?

The response: There are plenty of buzzwords like "cloud" that describe technologies that are now universally accepted. Similarly, we expect orchestration to distinguish its value from the other heavily promoted tools and approaches and emerge as a mainstream, widely adopted strategy. Through pilot programs and testing, we can demonstrate how it enables security teams to “see” -- with a single point of view -- all of the activity impacting devices, networks and data, and then immediately resolve the biggest and most potentially damaging threats first.

Question 2: We’re struggling with budget constraints. How can we justify this investment?

The response: Orchestration is all about cost savings, i.e. “doing more with less.” The automation, AI and ML core components greatly boost efficiencies and free up thinly stretched, frazzled IT/security team members from tedious, time-consuming manual processes. This means we will not only work smarter, but we will also improve retention levels, which is badly needed: One-quarter of security employees and managers leave their jobs within two years, and two-thirds leave within four years.

Question 3: We need to see some use cases in the federal space before we can justify this investment. What do you have for us to look at?

The response: Even if the term “orchestration” isn’t used, major government projects have leveraged its core components. The Department of Homeland Security’s EINSTEIN, for example, is a cyberattack detection and blocking system that uses the situational awareness gained from one agency’s threat information to inform and defend other agencies governmentwide. Through its AI Next campaign, the Defense Advanced Research Projects Agency is investing $2 billion to automate critical Department of Defense business processes, including the real-time analysis of sophisticated cyberattacks. FedRAMP and National Institute of Standards and Technology programs promote security standards for increased automation and near real-time data for continuous monitoring solutions.

As these use cases report positive qualitative and quantitative results, we fully expect to see more agencies moving forward with additional, significant projects.

Question 4: How can we implement this without required expertise and skills in-house?

The response: There are qualified security companies that can help us complete implementation. We must be careful, however, to avoid “one size fits all” vendors who do not have government experience. These vendors may say, “All orchestration initiatives are the same, whether for a federal customer or a business,” but this is not true. That’s why we should limit candidates to those with not only solid orchestration credentialing, but with a proven track record of working with agencies like ours. The winning candidate should command an in-depth understanding of our specific IT environment, mission, goals and challenges.

As agencies continue to invest in mobility, the cloud, IoT and other innovations, they will subsequently increase their risk of exposure. But by transforming all of the cybersecurity ecosystem “parts” into an entirely integrated “whole” that provides a single view of the network environment as well as automated threat intelligence and response, government IT/cybersecurity teams can greatly diminish the potential for compromises, no matter what new tricks the bad guys have in store.