Technology and tools are constantly evolving.
Perhaps the fastest in the realm of cybersecurity,
we have to be vigilant to stay on top of new threats
and attacks and be sure to keep our tools up to date.
This episode gives a high level overview of scripting
API S web hooks and of course plugins.
In the last episode,
we talked about utilizing automation
across our different organizational environment
to enhance our sore environment.
In this episode,
we're going to go over specific technology and tools
that we could utilize in that smart environment,
tools and technology are ever evolving and perhaps the
most uh the fastest growing within the cybersecurity realm,
we have to be vigilant within our cybersecurity
tool framework to understand the different threats,
the threat actors,
the threat vectors and the attacks that they may be utilizing on an up to date basis.
Each company or organization that you work with
within your cyber career has a list of
different tools and technologies that you may utilize.
These come in the form of scripting API S web hooks or plugins.
And we're going to tackle each one of these on an individual basis.
Scripting offers the benefits to an organization and individuals
alike because it provides us an automated process.
In order to remove that human interaction we gave in our last episode, a
design of how scripting can be utilized in the cellar
network by configuring specific radios associated with a site.
And then again,
with the switch to provide us a streamlined effort and remove not
only redundancy but remove specific configuration
requirements within each automated process.
Scripting really provides an automated efficient process
that's standardized within your individual environment.
It's important to note with CYS A that you don't need to know how to script.
You just need to know what scripting is.
You may see questions specific to a,
what type of tool may I utilize to automate A T DS or ongoing procedure
that to remove human interaction?
The answer would obviously be something like scripting.
It provides flexibility as well where I can be flexible in how I use that scripting.
Uh but not just the reuse of the scripting but flexibility
as an I can script configuration process for a cellular network,
but I can also script a policy or configuration for a router or I can
script an automated process to look for a specific word or set of words,
or I can automate a process to open
the door automatically whenever somebody comes to it,
scripting really provides us an
process within our enterprise environment to do low hanging fruit or
to provide a way to automate something that is very tedious,
mind numbing and low on the priority trait.
We really don't want to use scripting to create a video game or create a
complex environment.
It really should be something that's very cut and dry
and standardized across the entire workflow application
programming interfaces or API you most often
see this associated with web applications.
It provides a simplified integration platform
where you can go through a
program or a web application and actually interact with it.
You see this usually on something like
NSIS
where it provides a go
interface.
But on a web interface, it's simplified, it's efficient,
it doesn't require a lot of expertise and it can be scalable,
meaning that you can change the way it looks, you can move things around,
maybe inject new information into the interface that you're utilizing.
I've seen this in different platforms where we have a website where
I can go through and look at different features across my network,
enterprise environment
and then I can set it up
appropriately. You can see this in EDR
solutions, you can see it in different programs. Most
I've seen it in something like
NSIS where they have the board that shows you
how many vulnerabilities are associated with your network.
And you can maneuver the different screens around as you see fit
S
really has a great API where the gooey interface
is really customizable to you the user depending on what
you want to look at specifically and that can change
from user to user by providing a very flexible platform
in order to interact with that web program or that web application.
Webhooks provide us real time communication is scalable, efficient,
flexible and has reduced Latency.
Now, I just read off all those words.
So you're probably thinking to yourself what in the world is a webhook
web hooks provide us a subset of API
where it provides us a simpler and more
automated approach compared to a traditional API.
Well API S require manual triggering through a process, meaning
I have to trigger it and go through and say, hey, this comes into play.
And if this happens then do this,
a web hook really provides us a format where I can literally drag and drop it
and it's typically straightforward in that manner,
right? They can take four of U RLS provided by receiving
and allow other applications to send and receive data,
meaning I can pull different data from
different applications to associate my web page.
So I want you to think about if I've got a S
solution where it provides me traffic monitoring on one window,
maybe my antivirus program is working at a specific client that I want to see.
Or maybe I've got a server that's using
an antivirus program as a client based firewall.
And maybe I want to grab all of that
into a single screen.
I can pull tidbits of different information across those three
different programs to hook into my singular web page.
This is a web hook and provides me a different flexibility depending on
the different applications that I want to utilize or hook into it.
Plugins provide us an enhanced functionality through the use of the web browser.
They're usually flexible and scalable,
meaning that I can grab them depending on what I want them to do.
I can create a plugin from an antivirus program such as
the defender or Norton, even
mcafee.
So that if I visit a website and maybe that website isn't
actually 100% secure or maybe it's an HTTP instead of HTTPS,
my uh my antivirus program will say, hey, this is an unsecured website.
Are you sure you want to utilize it?
This is an example of a plugin from a cyber perspective,
but it could go into more detail if you're downloading something.
Maybe your plugin tracks it and goes wait a
second before it even gets on a computer system,
your web browser is going wait.
That's a known problem. Don't download this and we'll actually attempt to block it.
That's a form of a plugin interlinked with
your web browser to provide additional security.
But it can be more than that.
We can see flexibility and Scalability where
the plugin can provide enhanced features.
Beyond just simple browsing,
we can see enhanced features such as
determining where your programs are associated from
a download page or provide us a
different complexities within the web browser itself.
You'll hear me seeing browser quite often because plugins and browsers always
go hand in hand depending on what you're trying to utilize.
They're very efficient and cost effective measures
from a cyber perspective where if I've got
a bunch of clients and they're all using the Microsoft browser that adds browser,
I may utilize my antivirus plugin across all clients across
my entire enterprise environment to provide that additional security feature,
single pane of glass or SPOG is a security operations technology
that is relatively new within this concept.
We take all the different aspects of our security operations and
then we can provide it into an easy to read,
easy to use concept that is presented to the user.
So you may see pogs utilized where I've got some information,
antivirus network information,
maybe my uh intrusion prevention system is providing the information and is
providing this window or a glimpse
across my entire network enterprise environment
that shows me exactly
what's going on at different specific points. Now, spog or
fog is often utilized within a security environment to provide me a heads up display
of the or a snapshot of what's going on within my enterprise environment,
making it easier to read
and kind of hits all the high points.
What we really want to try to avoid within
an spog environment or a single pane of glass
environment is where we've got too much information or
we have information that really isn't that useful.
Maybe
I want to know how much traffic is going outside my
environment by providing both a baseline of the hour by hour,
but also the real time environment where it's
providing me a elliptical wave across my screen
in one corner that says I'm doing normal
traffic capacity for the day within my environment.
This would be useful information.
What wouldn't be useful information is what one client
across my entire enterprise environment made
about 10,000 different clients is doing.
That's not really useful information for security analysts.
So the single pane of glass concept really takes in those different
security related mechanisms and provide it for an easy to read format.
We want to avoid providing an environment that is
too small to read by having too many windows,
but we also want to avoid having windows that are so jam packed full of information
that it's going to be over cumbersome to the actual user.
Single painted glass is a great concept when put in correct
where we've got 4
to 6 different windows associated with our environment.
But I would really avoid going over eight if at all practical.
Throughout this episode, we've identified scripting and API S.
We've also discovered different web hooks and plugins and
how they're essential for keeping our system secure.
We've identified what single pane of glass is and how it's utilized in our security
environment and why it could increase our
efficiency and outlook across our enterprise environment.
For our security perspective,
you really want to keep in mind for cys A,
what we're looking at the high level picture within an enterprise environment.
You're really stuck between that technical
role versus that management role and how
to identify the best practice for doing your job as an analyst.
What's going to streamline,
what we're trying to achieve and make it easiest for not only
you but other analysts to utilize the technology that we're providing.
Remember,
you're not going to be questions about specific technologies in scripting.
Ie we're not going to ask you to perform a script,
but we are going to ask you questions like if you utilize scripting,
what would be the best procedure for this perspective environment expect
a lot of scenario based questions that really kind of identify
the technology that you would utilize in the most efficient or
best pattern to utilize that technology for the specific scenario.