"Automation" is one of the most deafening buzzwords in cybersecurity circles. Four out of five executives say their organizations are already implementing some form of this technology, according to a survey by Radware, and 57% indicate that they trust automated security systems "as much or more than" humans to protect the enterprise. What's more, 38% believe automated security systems will emerge as the primary resource for cyber defense within two years.

Decision-makers funding time-strapped security operations centers (SOCs) overwhelmed with the volume and velocity of alerts understandably like the sound of automation. Others point to plenty of repetitive and time-consuming tasks requiring speed and accuracy that have been offloaded to machines in other industries.

However, in watching security teams test and adopt different automation principles, it's clear to me that the most important success factor is getting our "appetite for automation" right. In other words, we must ask these questions: "Where can automation realistically make a difference in our operations?" "How much risk are we willing to take for the expected rewards of speed and efficiency?" Unless decisions are framed this way, approaches to automation risk being unfulfilling at best — or problematic and disappointing at worst.

Consider these examples to start a discussion on what degree of automation fits — particularly from a workflow perspective — within three common stages of the incident response process:

Identification
At the initial incident handling stage of "What just happened?" there is a premium on being able to gather and assimilate relevant data quickly. First responders manually managing an endless alert stream can reliably benefit from automation tools to distinguish false positives from the real thing faster. This process of pulling data from multiple disparate sources to provide context is often referred to as enrichment.

Let's illustrate with the use case of an executive receiving a potentially malicious e-mail. Traditionally, security staff would manually scrutinize the message's metadata, links, or attachments to find out what it contains, where it came from, and who appears to be the true sender. But automation can now perform this legwork, allowing experts to focus their time on making reasoned decisions about what, if any, action to take instead of tediously gathering all the data beforehand.

Even incremental automation steps usually deliver solid net gains. The biggest caveat, in my experience, is making sure the automation platform you select can readily interface via APIs with both your security tools and other existing investments, such as security information and event management software and configuration management databases. If you start needing multiple dashboards, it offsets any performance gain.

Containment
Here's where the right appetite becomes tricky, because containment requires action. When malware — or what looks like malware — hits, a number of steps must be executed to curtail what a suspicious file is trying to do, such as stealing data. If you take an "all-in" approach to automation during containment, you might be able to contain true attacks more quickly, but you also shoulder the risk of "breaking things."

When you move the slider toward more automated defense and empower machines to block and filter more things at top speed, it can result in business users experiencing broken browser links, blocked access to legitimate files, and overall diminished productivity. You have to weigh asset value, sensitivity of the data, and user role to decide if the automation you green-light will result in more security victories — or angry help-desk calls.

Try a few new things on the menu, carefully: Potential risk is the make-or-break factor for most enterprises here. In a large organization, there could be a case for fielding automated defenses in certain business units as test cases, or to protect the most sensitive users and data. Some firms ironically automate containment for low-risk incidents first, requiring human approvals in the process for more high-value targets until confidence is high in the automation's accuracy.

Remediation
This is where the risk-versus-reward balance matters most. Many vendor claims try to whet automation appetites in this stage with demos that show fully automated technologies seamlessly quarantining or patching machines, or kicking-off more complex steps across security and network management.

The logic and technical tripwires behind these highly automated concepts are generally sound, but demos are not the real world and you have to ask what will happen when the unexpected inevitably occurs. A product could conceivably "take matters into its own hands" (because, well, that's what automation does) during remediation and shut down production systems or email, while it installs a patch or purges all copies of a certain file. Needless to say, when automation performs at this scale, the CISO wants to be the hero — not the person receiving blame.

Approach security automation with enthusiasm, but use caution. Feed your more immediate appetites first. The safest path is to stair-step with automation; tackle enrichment first for measurable, early gains. Use that insight to guide containment, and what you learn along the way will help determine your tastes in automated remediation.

When SOC alerts are skyrocketing, analysts are racing, and breaches cloud the headlines, it is easy to think that big, bold technology moves are the way to go in changing the game. Automation is surely changing how we do security, but everyone's needs, resources, and risk tolerance are different.

Our wider goal as a community should be sharing how we reach and feed our appetites for security automation across our enterprises, so that different organizations can take notes, follow good examples, and avoid pitfalls.

Related Content:

Join Dark Reading LIVE for two days of practical cyber defense discussions. Learn from the industry’s most knowledgeable IT security experts. Check out the INsecurity agenda here.