An enterprise incident response team is evaluating a newly deployed Security Orchestration, Automation, and Response (SOAR) playbook intended to contain compromised systems. The playbook automatically executes a script that isolates host network interfaces upon receiving high-severity endpoint alerts. Security engineers are concerned that automated execution against critical infrastructure, such as domain controllers or primary database hosts, could cause severe business disruptions in the event of a false positive. Which of the following workflow modifications best mitigates this risk while preserving automated containment capabilities for standard endpoints?
- Implement conditional branching that requires human-in-the-loop manual authorization before taking isolation actions against designated high-criticality assets.Cevap
- BAdjust the playbook logic to automatically suppress and clear all high-severity alerts that originate from critical infrastructure assets.
- CReclassify the automated host isolation script from a corrective control to a detective control by changing the SIEM log retention period.
- DConfigure the playbook to re-authenticate the asset's administrative service account credentials before determining if the system has permissions to be isolated.
Cevap
Implement conditional branching that requires human-in-the-loop manual authorization before taking isolation actions against designated high-criticality assets.
Implementing conditional branching with human-in-the-loop (HITL) approval for critical assets allows security operations to isolate standard endpoints automatically while preventing accidental outages of critical infrastructure during false positives.
Adım Adım Çözüm
Anahtar Kavram
SOAR Playbook Logic and Human-in-the-Loop (HITL) Governance
Tahmini Süre:1m 30s