基于SOAR的安全运营自动化关键技术构建及未来演进方向

Key technology construction and future evolution direction of security operation automation based on SOAR

针对现有的安全可视化编排及自动化响应技术,提出将复杂的APT威胁场景、漏洞、自动化响应验证、关键基础设施合规管理等安全能力纳入到现有SOAR(Security Orchestration Automation Response)的可视化编排及响应中,极大地丰富并完善了Gartner提出的SOAR的安全编排及自动化响应的概念场景,大幅提升安全运营的效能和成熟度;通过DevSecOps开放架构及OpenC2开放式管控接口,自适应支持不同设备的数据接入及安全响应管控,构建围绕SOAR为主体的安全运营生态体系;在此基础上,提出安全运营自动化未来演进方向,即构建多人协同的统一空间协同作战体系,通过多人协同定义并改进安全分析及响应模型,迅速完成“安全策略、保护、检测和响应”的信息循环及信息再利用。

Aiming at the existing security visual orchestration and automatic response technology,the paper proposes to integrate the complex security capabilities such as APT threat scenario,vulnerability,automatic response verification,and key infrastructure compliance management into the visual orchestration and automation response of the existing SOAR(Security Orchestration Automation Response),which complements and greatly enricates the conceptual scene of the SOAR proposed by Gartner,which significantly improves the effectiveness and maturity of security operations.Through DevSecOps open architecture and OpenC2 open management and control interface,it can adaptively support data access and security response control of different devices,and build a secure operation ecosystem around SOAR.On this basis,the future evolution direction of security operation automation is proposed,that is,to build a unified space cooperative combat system with multi-person collaboration,and quickly complete the information cycle and information reuse of"Policy,Protection,Detection and Response"by defining and improving the security analysis and response model with multi-person collaboration.