Streamlining processes have become much easier over the years as tools and
software have been developed to automate
tedious and sometimes detailed procedures.
In this episode,
we're going to uncover soar as well as other automated processes and tasks.
We're also going to discuss the human element.
Humans make up nearly 93% of all incidents
that you're going to see within your environment,
within an organization.
This includes things like clicking on a
phishing link or ignoring policies or procedures.
You need to understand as a cybersecurity analyst,
not only the technical perspective, but also the human perspective
and how to get humans and our employees to do what they're supposed to be doing.
And if they're not to uncover those risks and identify how to best and most
efficiently deal with those problems that you
see as an analyst within your organization,
security orchestration,
automation and response or soar is the idea of taking automation to a new level.
We want to interact or collaborate with other tools and provide
different leverages that we can then utilize in an automated procedure.
In other words,
what we're really saying is that this incident occurs and
how does this technology automatically deal with that incident.
Now, this can be in the most fundamental level as a malware comes across on a client
and then the antivirus comes in,
it sees the malware and it stops it from
going forward any uh software that's intruded upon,
it gets rid of it, eradicates and then puts into isolation on your desktop.
They get anon more network level.
A lot of times what we're seeing is this traffic came into play,
it looks suspicious.
So it goes through the IP S the IP S flags it, we then prevent it from moving forward.
That's an automated process that stops malware from intruding upon our network.
It also provides us an alert which then you as an analyst
can then inspect that alert and figure out what's going on.
We see source uh interacting with different
technologies such as an endpoint detection and response
or an EDR solution.
We see it when encompassing different scripts where we automate
different processes that seem tedious and we create a script that
goes through and automatically does different perspectives of that process
that would otherwise take a human being hours within telecommunications.
I remember where we were setting up different radios for cellular sites
and those each radio had to go through and be configured specifically,
not only for the site,
but then the site to be configured with the back hall in order to function correctly.
And it took about an hour to go through and configure each radio to interact with the,
with the actual cell site
and then the cell site with the backhaul site.
And that kind of really kind of took a long time to facilitate. However,
if we created a script,
we literally had to only go in there and say this is the radio number,
this is the site ID and this is the switch that it's operating on.
We run this script and since everything was automated,
it went through and did everything in about 10 minutes now,
it may not seem like a lot on a 1 to 1 basis and you're going through and going. Oh, yeah.
Well, you know, it was took 10 minutes to an hour and a half task manually.
But it's more than that,
even if I was going to take a task that took 15 minutes and I
automated it and it took 10 minutes or let's even take it to reverse and say
it took 17 minutes for the automated process.
But if I did it myself manually, it would only take 15.
The problem is at the speed. The problem is the detailed associated with it.
I want you to imagine yourself as sitting at a desk
and your job all day long for eight hours a day, five days a week,
52 weeks a year is the same process of typing.
In the same words, with minor changes to it, day in and day out.
Not only is that tedious and mind numbing.
But you're bound to make mistakes and it's those mistakes that,
that scripting really solves if I can go in
and change three different numbers inside my script,
and it automatically goes through and configures the entire
for me
where I can get up, get a cup of coffee and maybe even do a different task.
I've not only made that process more efficient, I've made it more accurate,
thereby lessening human error,
but I've also freed you up as a security analyst
to do something else while that script is ongoing.
So even if it takes more time and in most cases, it doesn't,
I have increased
my accuracy on that specific task
and provided you the security analyst more time to perform other actions.
That's really where so comes into play with that orchestration,
automation and response.
Now I described the actual incident, well, not really the incident,
but I described a process where we're configuring an item
which is going to remove the human error from that.
What about the response element?
We talked about IP S we talked about an antivirus,
but we can go much more detail with that, with an EDR solution
or with a SIM solution where it's identifying
a specific incident that could be flagged as malware
or uh uh perceived as a threat within our
system and that provided automated response to that.
And that's really where so gets its power from
automated tasks are usually simple, repetitive. Uh We want to reduce the time.
I just described an automated task where I
was talking about using those cell phones or
the radios within those cell phone towers to
automate a repetitive task that went into play.
When we talk about scripting or we talk about automating any task.
We're really kind of removing that human element as much as possible.
Humans, like I said, 93% of all incidents within an organization
are from a human element making an error
uh usually on accident within an enterprise environment.
And if we could remove that human element as much as possible and make
those tedious tasks or those repetitive tasks
come into play with an automated script,
we removed that human element from it.
We've reduced the error rate. We've also increased our efficiency
and our human power,
meaning that our labor or our security analysts can then go to other tasks
that cannot be automated ie going through
and looking at a specific incident and making
a judgment on that incident of whether or not you need to proceed in a
certain viewpoint where automated tasks or A
I or machine learning just isn't capable.
At this point in time,
human interaction is usually encompassed with human error
and also encompassed with efficiency, standardization and predictability.
Uh I often refer to predictability as my nine year old who I predict will
always click on links that are flashy regardless if they're malware induced or not,
we can summarize that we're going to have a
certain number of employees within our organization which are
going to click on links from phishing emails on
a repetitive basis regardless of what we do.
Now, I say regardless,
but there are things that we can actually do to reduce that number.
We can provide training,
we can provide a formal and informal reminders of, hey, don't do this, right?
And so when we talk about interaction within a sore environment,
we're really trying to remove that human error.
We're not talking about the people that intentionally
go out of their way to cause harm
to our organization.
We're never going to be able to stop people like
that through training or through tools or technology 100%.
But what we can do is stop them from making human errors.
Ie accidentally clicking on a link they
shouldn't have or being fooled into clicking.
They shouldn't be clicking on
that standardized process within that.
If we provide a standardized process on how to do a specific task
ie to take a router and configure it in a specific way.
And we go a step by step procedures,
we can remove human error if they follow the
process and procedures that we laid out for them.
However, if I can script it in, that's going to remove it 100%. You have a problem when
time you introduce change to an environment,
ie I provide a new a
new router for our employees to utilize.
And I provide a new process which they must follow,
they're going to revert back to that original
process just because we've changed on them.
That's human error.
However,
I script that the script is never going to
remove from the initial intention that I put forward.
Now, intention is probably the wrong word.
But the initial programming that we put forward,
they're going to follow point AB CD and E it doesn't matter if they do it one time
or if they do it a million times as long as that script says to do it,
they're going to do it.
The only human error process comes into play is changing the actual
configuration points that we need to be changed within that process.
Throughout this episode, we've discussed so or security orchestration,
automation and response
and how it interacts with different formats or different tools such as EDR or SIMS,
your antivirus program or other tools and processes that we put into play.
This is an important part of your daily job and your job function
you need to understand as a security analyst,
not only the tools and techniques that you'll be utilizing,
but the processes and procedures that are inherent upon
your job and how it interacts within your organization.
As a security analyst in CYS A,
you're really going to have test questions that relate to
specific scenario based source acquisition
within the environment that you're utilizing
these are broad questions that over arch upon a relative general point of view,
meaning they're not going to go into detail about a specific
specific procedure or policy that may be intrinsic within your organization.
But you should expect to see certain things like if I can automate this process,
what would be the best way to do it?
Or
if I have a human interaction,
what would be the best way to limit human error
within this procedure or within this technical control and obviously
using so or an automated process would be the correct answer.
Those are the type of questions you should expect to see within the cys A exam.
But you also should expect to see questions inherent with the human error
perspective and how to remove that human error as much as possible.
Usually automation and scripting is going to be your
go to answer for those types of questions.