Are we lost? Not at all! Where problems arise, solutions emerge. If the cloud and mobile working were a zero-sum game and all their advantages were lost due to the security loopholes they may open up, then mankind would have opened Pandora's box for the first time. Let us therefore turn away from Greek mythology and towards the solution.

First of all, we need to bear in mind three principles that are part of an effective cybersecurity solution, i.e. effective protection against possible hacker attacks. We are deliberately leaving out accompanying measures such as policies, security training or regular audits and scans. They undoubtedly have their justification and should receive our attention elsewhere.

Most modern security solutions use all available data to identify and combat threats(threads),vulnerabilities and securityincidents. Their "knowledge" is stored centrally, kept up to date centrally and used centrally. Regardless of whether Zero Trust Network Access (ZTNA) or Cloud Access Security Broker (CASB) or Secure Access Service Edge (SASE) or Extended Detection and Response (XDR) solutions are used, they are all based on the principle of ubiquitous access to information about cyber threats and the more or less centralized implementation of a defense strategy, see footnotes 1 to 4 below. Palo Alto, for example, successfully used this approach in its firewall solutions years ago, before the terms mentioned above were even invented.

Consequently, not only the "problem" but also the solution comes from the cloud.

SIEM platforms such as Splunk, Sumo Logic, Datadog, Logit and many more help to collect, aggregate and interpret data from the security solutions described above. They are essentially databases with corresponding analysis functions that actively inform security teams or Security Operations Centers (SOC) about threats.

SOAR platforms receive this (threat) data from SIEM solutions and carry out further measures. They further qualify and enrich the information, use cloud services to assess it and contain attacks by making changes to the configuration of the security solutions or by excluding the affected end devices or users. They are the actuators in an effective security concept.

So you need a SIEM platform and a SOAR platform, preferably from the same provider, and all is well? Yes, in very simple and standardized system landscapes this may be sufficient. But not in the complex reality of many companies. This is where SOAR solutions are needed that orchestrate entire action processes between several systems in order to implement the right decisions on a case-by-case basis. Good SOAR is a question of automation in the security environment, analogous to the automation of business processes.

A simple "if-then" process is no longer sufficient; instead, the data from users, attackers, affected systems or applications and possible causes must be interpreted and orchestrated with the help of well thought-out process steps so that a minimally invasive but effective solution can be found. The more data flows in a company, the more important it is to automate these data flows. They cannot be managed with human intervention in a sufficiently timely manner and with the necessary quality. Or do you want the attack to get out of hand until your security team or IT administration have understood the problem and devised a solution?

Successful companies need an intelligent and modern security solution that works as automatically as possible in order to reliably fend off hackers in a timely, effective and targeted manner. These solutions must fit into the budget and available resources - from small businesses to large corporations. Not every medium-sized company can afford a SOC, and not every corporation can find the competent employees for this task on the market.

An experienced Managed Security Service Partner is a smart move to ensure the necessary technical know-how, the desired advice and stringent implementation in regular operations. This allows companies to focus on their core business even in turbulent times, knowing that their resources are effectively protected.