ITU-T Recommendations

Nowadays, as network security strategies continue to evolve, the security architecture for cloud service providers (CSPs) or cloud service customers (CSCs) has changed from a simple combination of prevention and recovery to a new stage integrating detection, prevention, and response. Leading enterprises and organizations have attached greater importance to security orchestration, automation and response (SOAR). SOAR is regarded as the key technology to improve network elasticity and the efficiency of security operations for cloud computing, which can be detailed as follows:
1)By leveraging artificial intelligence (AI), it is possible to establish a security operation functionality in the cloud that includes threat analysis and controlled automated response, which could greatly improve the efficiency of security operations.
2)In cloud computing, SOAR has naturally a cost advantage.
3)With the development of cloud-native technology, there are new approaches to implementing managed and scalable incident response in cloud computing.
Recommendation ITU-T X.1651 describes the overview of SOAR for cloud computing, including the definition and the emerging background of SOAR, and analyses advantages of SOAR coping with security threats of cloud computing especially in incident responses. Then it also provides a framework of SOAR for cloud computing to improve the efficiency of security operations for both CSPs and CSCs.