Certified Information Security Manager (CISM)Incident ManagementMedium
During a significant cyber incident, the CISO observes that the incident response team (IRT) is overwhelmed with manual tasks such as log aggregation from disparate systems, manual threat intelligence lookups, and uncoordinated communication across multiple platforms. This significantly delays containment and recovery. To address this, which capability should the CISO prioritize implementing to improve the IRT's efficiency?
- AEnhanced security awareness training for all employees.
- BImplementation of Security Orchestration, Automation, and Response (SOAR) technologies.
- CIncreased budget for hiring additional forensic specialists.
- DDevelopment of a new, more detailed incident response plan document.
Show answer & explanationAnswer & explanation
Correct answer: B. Implementation of Security Orchestration, Automation, and Response (SOAR) technologies.
SOAR platforms are designed to automate and orchestrate repetitive incident response tasks, integrate disparate security tools, and streamline workflows. This directly addresses the issues of manual log aggregation, uncoordinated communication, and slow response times.
Why the other options are wrong
- A. While important for prevention, it doesn't directly address the IRT's operational efficiency during an active incident.
- C. Hiring more people without addressing process and technology inefficiencies will likely just distribute the same manual burden.
- D. A new plan might define processes better but won't automate the manual work or disparate systems.
SOAR (Security Orchestration, Automation, and Response)
A platform that helps organizations automate and orchestrate security operations tasks, including incident response, threat intelligence, and vulnerability management.
- Automates repetitive tasks (e.g., log collection, threat lookups).
- Orchestrates workflows across multiple security tools.
- Improves incident response speed and consistency.
Memory trick: To make the IR team 'fly' through tasks, you need 'automation wings' and 'orchestration gears'.