An increasing number of organisations focusing on security orchestration approaches and solutions to automate the processes of their Security Operation Centre (SOC). There are hundreds of approaches and tools to support security orchestration, hence, practitioners find it hard to access a consolidated material on the available solutions and researchers are unable to figure out the gaps. Our team has tried to address this need by reporting a systematic horizon scan of the security orchestration approaches and tools – the report has been published in one of the most prestigious journal of computing, ACM Computing Survey – the work is led by Chadni Islam, and Data61’s Surya Nepal is the collaborator. The abstracts of the paper is below and interested readers are welcome to contact us for a copy of the paper.

“Organizations use diverse types of security solutions to prevent cyber-attacks. Multiple vendors provide security solutions developed using heterogeneous technologies and paradigms. Hence, it is a challenging rather impossible to easily make security solutions to work an integrated fashion. Security orchestration aims at smoothly integrating multivendor security tools that can effectively and efficiently interoperate to support security staff of a Security Operation Centre (SOC). Given the increasing role and importance of security orchestration, there has been an increasing amount of literature on different aspects of security orchestration solutions. However, there has been no effort to systematically review and analyze the reported solutions. We report a Multivocal Literature Review that has systematically selected and reviewed both academic and grey (blogs, web pages, white papers) literature on different aspects of security orchestration published from January 2007 until July 2017. The review has enabled us to provide a working definition of security orchestration and classify the main functionalities of security orchestration into three main areas – unification, orchestration, and automation. We have also identified the core components of a security orchestration platform and categorized the drivers of security orchestration based on technical and socio-technical aspects. We also provide a taxonomy of security orchestration based on the execution environment, automation strategy, deployment type, mode of task and resource type. This review has helped us to reveal several areas of further research and development in security orchestration.”