When a malicious email slips past perimeter tech defenses, you need to find it and respond in minutes, not two or three months. But no one has unlimited budget or staffing to sift through phishing alerts, verify threats, and help stop attacks in progress.
SOAR is an acronym for Security Orchestration Automation and Response. And it’s what Cofense™ does for phishing threats and attacks. And, according to researchers at ESG, 19% of enterprises have adopted SOAR technologies extensively, while 39% have dipped their toes in the water and 26% are currently working on SOAR-related projects.1
Why is SOAR soaring? Because organizations need to connect their layers of security systems and make the most of their limited, highly skilled security resources.
Phishing Alert! Alert! Alert!
Phishing isn’t going away. To the contrary, it’s still growing because it works. In fact, enterprises receive up to 150,000 security alerts a day2, many of them phishing alerts. When security teams are drowning in alerts and suffering from alert fatigue, they may miss actual attacks. The Cofense Phishing Defense Center (PDC) sees customers deal with widely fluctuating rates of crimeware—the same organization can go from 2% of reported emails verified as malicious to 20% or higher within a matter of weeks.
Even with a rate that high, 80% of reports are duds. Which is good, of course—false alarms being better than dangerous threats—but manual verification eats up lots of time. And, most organizations lack the needed resources to sift through phishing alerts, find genuine threats, and stop attacks in progress. In fact, many organizations use a “best effort” approach to sorting through their abuse mailbox.
Automation, Orchestration and Response
A SOAR platform is meant to connect your systems for broader coverage, but it does require configuration and skilled resources to manage it. But, if the majority of your threats are from phishing, do you need a full SOAR platform or could you augment a full-service SOAR with a phishing-specific solution?
Using a phishing SOAR lets you respond to the crush of phishing alerts with fewer skilled man hours and powers a faster, automated, and more coordinated response. Again, automation drives this advantage, along with strong integrations. You gain operational efficiency as you disrupt unfolding attacks.
Cofense TriageTM, our phishing response platform, uses its Noise Reduction feature to help automate the filtering of spam or commercial emails that get reported as threats. By eliminating the noise, you can verify at scale and much faster. Speeding up the analysis means speeding up any needed response—the task at which you want your incident responders to excel.
To be clear, Cofense believes the human factor is still a key ingredient. Which brings us to recent upgrades to Cofense Triage, namely the addition of SOAR functionality.
The Cofense Approach to Phishing SOAR Leverages Human Intelligence
The Cofense approach to phishing response begins with training users to recognize attacks and easily report suspicious emails. Remember, perimeter defenses like secure email gateways don’t catch everything—witness the resurgence of the ZeroFont exploit and the FBI’s report that business email compromise (BEC) scams are fleecing targets to the tune of $12 billion annually.
One of the upgrades to Cofense TriageTM is an improved ability to score user-reporters for accuracy. This, coupled with automated analysis, makes human intelligence more usable as you act against threats.
Cofense Triage speeds the response with greater orchestration, thanks to API integrations as well as Noise Reduction. Our platform offers out-of-the-box integration with nearly two dozen security solutions, including a fully documented REST API.
Besides automating email analysis, Cofense Triage delivers automated security playbooks and workflows. Threat actors tend to recycle proven tactics and procedures, so Cofense Triage lets you define criteria and, when it’s met, execute an automated response to mitigate risk, for example, key notifications, new help-desk tickets, or proxy-block requests.
Cofense VisionTM, a new addition to our phishing response arsenal, helps find phishing threats wherever they may be lurking. Vision stores, indexes, and enriches emails for faster querying and quarantining before any damage is done. You can quickly pinpoint a suspicious email throughout your organization, by querying based on sender, subject, date, attachment name, attachment hash, and more.
And once you find offending emails, you can dig deeper and root out the whole campaign. One click allows you to quarantine emails in Microsoft Exchange and Office365. One more click will allow you to UN-quarantine depending on your findings.
Getting More Value from Phishing SOAR
In an article on the evolution of SOAR, ESG Principal Analyst Jon Oltsik noted that companies are adding to core SOAR functionality with, among other things, integration and canned playbooks:
“Rather than simply trigger a discrete remediation action, SOC teams want to automate their standard operating procedures (SOPs) to the fullest extent possible,” he wrote. “This means aligning automated actions with runbooks in an easy and intuitive way.”3
Cofense is checking those boxes as we evolve Cofense Triage and introduce Cofense Vision. With the SOAR marketplace evolving, it’s the kind of innovation that transforms the acronym into value.
To learn more about Cofense phishing SOAR capabilities, sign up for a 1:1 live demo.
1. CSO.com, May 2018.
2. Swimlane.com, February 2018.
3. CSO.com, May 2018.
All third-party trademarks referenced by Cofense whether in logo form, name form or product form, or otherwise, remain the property of their respective holders, and use of these trademarks in no way indicates any relationship between Cofense and the holders of the trademarks.
Last week, the FBI announced it had busted a business email compromise (BEC) racket that raked in millions of dollars in fraudulent wire transfers secured through email-based cyberattacks. The Bureau, along with federal and overseas partners, arrested 74 people, seized over $2M, and disrupted and recovered another $14M in phony wire payments.
Calling it “one of the most advanced defenses against phishing,” CSO has included Cofense TriageTM in its Best Security Software for 2018. Our incident response and phishing defense platform helps to stop attacks in progress and minimize the risk of breach—in minutes, compared to the average detection time of 100+ days.
On the 19th of April, the Cofense Phishing Defense Center received an email crafted to appear to be from “Sberbank Russia.” In fact, it was a phishing email containing the Troldesh malware, a variant of Russian Ransomware first seen in mid-2015. The PDC hadn’t seen this variant for quite some time.
As we have continued to improve anti-phishing capabilities for clients over the past few years, we have seen a myriad of changes in phishing email composition, style, and approach. Throughout all those changes however, one thing has remained the same.
By Jerome Doaty, Zakari Grater, and Brenda Gooshaw Samson
Technology is an important part of any phishing defense, especially perimeter tech designed to filter emails. But these systems, even those billed as “next-gen email security platforms,” don’t catch everything. Some phishes always get through.
Most security teams today are pretty much in the same boat: limited budget, limited man power, and limited time to defend their network against escalating threats and attacks. Perhaps that’s why so many information security vendors claim to have the “silver bullet” to protect the customer’s environment and solve their problems.