- Welcome to lesson 20, explain the importance of automation
and orchestration related to secure operations.
Now, we've been talking about automation
really since the very beginning of this course,
and over and over again talked about
the importance of automation.
And you've also been introduced
to orchestration a couple of times now.
So in this particular lesson, we're gonna focus in
on scripting, a little bit more about automation,
and some examples of orchestration.
Scripting is a set of instructions used
to automate a sequence of repetitive tasks.
Now, scripts are usually written in a scripting language
which is a type of programming language
designed for integrating and communicating
with other programming languages.
Now, the nice thing about scripting languages
they're typically easier to learn
and write than lower level programming languages.
The scripts are often going to be interpreted
rather than compiled, and that means that the scripts
are read and executed line by line
by the processor at runtime.
The scripts can be interactive or non-interactive.
Interactive meaning res, requiring a response
or they can just run straight through.
So let me introduce you to four scripting tools,
Python, PowerShell, Bash, and macros.
Python is an interpreted object oriented open source,
meaning can freely modified and adopted,
programming language with a really extensive
available library.
Now, Python is a favorite of security professionals used
for managing security devices and for doing all kinds
of assessments and testing.
It's also a favorite of our adversaries, so I would suggest
that you get at least a cursory understanding of Python.
Now, PowerShell is Microsoft's automation
and configuration management framework.
So you can drop to a command line.
It's a command line shell,
and it is an incredibly, incredibly powerful
scripting language.
Bash, we use in the Linux or Unix environment
is again, a command line shell or command line interface
and a scripting language, very much like PowerShell's
in the Microsoft environment.
And then a macro is going to be an automated input sequence
that imitates keystrokes or mouse actions.
So we can use all of those tools
for great scripting reasons, but so can our adversaries.
So I also wanna talk about adversarial scripting,
meaning scripting for bad opposed to scripting for good.
And talk about how our adversaries could use Python
or PowerShell or Bash or a macro.
So Python is an extremely useful programming language
because it's easy to learn and it can perform
multiple functions, but it's also going to be
the favorite language for writing attack codes and tools.
Attackers can use PowerShell
to direct the execution of a local script,
retrieve and execute remote resources
using various network protocols and encode payloads.
Bash can be used by our attackers to direct the execution
of a local script, retrieve and execute remote resources
using various network protocols,
and automate tasks from a Linux or Unix platform.
And attackers can use a macro virus
to infect a software program and to cause a series
of actions to begin automatically when a program is opened.
So the really interesting way to think about this slide
is here's all the ways we can use it for good,
and here's all the ways that these same scripting tools
and techniques can be used by our adversaries.
So let's take a look
at how our adversaries might use PowerShell
and VBA to initiate an attack.
So the attacker hides a PowerShell script
in a Microsoft office, macro written in VBA.
The victim receives a phishing email
with an attached document and probably
with a name that sounds really interesting.
The victim thinks,
"Oh, probably shouldn't open the document.
I don't know who it's from, but oh, I'm so curious."
And the victim opens the document.
The macro will execute and launches the PowerShell script
and then the victim system is potentially compromised.
So really keep in mind, right,
that scripting can be used for good and for evil.
Now, automation is the ability to execute a sequence
of tasks without human intervention.
The goal of automation, as we've talked about
numerous times now, is to improve quality of service,
increase agility, and reduce risk.
That automation reduces or eliminates manual dependencies
and human error, automation
can be a workforce multiplier for sure.
And automation techniques include scripting, robotics,
specialized software, and artificial intelligence.
Now, automation often does require an investment.
Sometimes even a significant investment.
So organizations really need to do
a cost-benefit analysis, right?
And consider cost complexity and ongoing maintenance.
So let's look at some automation use cases.
Automation can be used
for provisioning, threat intelligence,
system administration, vulnerability management,
compliance monitoring, workflow automation,
security and code testing and data analysis.
These are just some of many, right?
So for provisioning.
Demand generated resource allocation
to support scalability and elasticity.
For threat intelligence, right?
To gather and analyze data
from various sources and provide insight.
For system administration, to automate repetitive tasks
such as performance monitoring.
For vulnerability management,
to identify vulnerabilities, prioritize remediation,
and do the patching.
For compliance monitoring, to monitor for compliance
with standards and regulations.
For workflow automation,
to streamline business processes such as email routing
and updating a database.
For security and code testing,
to automate attacks against pre-production code
and continuous vulnerability testing
against production code.
And for data analysis,
to automate the process of data extraction,
transformation and report generation.
So automation truly is the the wave of the future, right?
It eliminates human error,
it takes these repetitive tasks away from humans,
it's more efficient,
and it allows human beings to really focus
on the tasks that truly need human intervention.
The orchestration is the integration of disparate tools
and platforms, often using bi-directional APIs
or application programming interfaces
for an automated response.
And we first started talking about automation
way back when we were talking about logging.
Now there's different types of orchestration.
Network orchestration is the automation and coordination
of networking tasks like configuration management
and optimization of network services and devices.
And actually network orchestration is often used
in SDN or our software-defined networking.
Now, one of my favorite tools is security orchestration
automation and response known as SOAR.
And we mentioned this earlier.
SOAR is and automation tool that reduces response time,
improves consistency, and amplifies the productivity
of incident response teams.
So what we do in SOAR is we actually create
these automated digital workflow incident response playbooks
that allows the organization to define
the incident analysis and response procedures.
Again, those all happen in this automated digital workflow.
So let me give you an example.
Let's say a phishing attack is detected, right?
Remember, SOAR is gonna have orchestration and automation.
So here are all the things that can happen.
That the email headers, content and attachments,
for perhaps that phishing attack
or whoever the user has been attacked
are analyzed for suspicious content.
So we can use product A to do that.
Then the links and the attachments, right,
in those phishing emails are detonated in a sandbox.
We use product B to do that.
Then the IP addresses and connections are analyzed,
maybe using a third product to do that.
Then the suspicious IP addresses are blocked.
That's a good thing to do at the firewall.
Maybe using yet another product or script to do that.
Then other user mailboxes are analyzed to see
if they've received similar emails,
perhaps using yet another product.
And lastly, affected users are automatically notified
and provided guidance, again perhaps using
yet one more product.
So this is a workflow.
We can make it a digital workflow
and if we have orchestration,
we can pull in all of these disparate tools
to be able to accomplish everything that's in this list.
And all of this could be done in an automated fashion
instead of a human being having to go
through sort of the drudgery of doing a lot of these things.
The human being can really do things
that require human intervention.
So that's an example of a SOAR response playbook.
And that my friends, brings us to a three-second challenge.
Five challenge questions, three seconds each.
You know how to do it.
Open source language that is favored
by both security practitioners and hackers
for ease of use and extensive library.
One, two, three.
That's Python.
And I really suggest
that you, at least learn the basics of Python.
Number two, a Linux shell command line interface.
One, two, three.
That's Bash.
You know, and Linux is used so often in security as well.
A lot of our appliances are Linux-based appliances.
So having again, at least a rudimentary understanding
of Linux will do well for you in the security area.
Number three, the integration
of disparate tools and platforms for an automated response.
One, two, three.
That's our orchestration.
Number four, the ability to execute a sequence
of tasks without human intervention.
One, two, three.
That's our automation.
And lastly, number five.
The automation and coordination of networking tasks.
One, two, three.
I'm gonna refer to that as network orchestration.
So that brings us to a security-in-action.
And this one's about automation.
Now, your organization is very focused
on identifying cost efficiencies.
So you suggested that the IT
and security teams investigate ways to automate tasks.
But the initial feedback or pushback was a lot
of concern about the cost of automation-related software
hardware integration, testing, and ongoing maintenance.
And the next step is gonna be a cost-benefit analysis.
So what are some of the financial benefits to be considered?
So a quick recap.
You know, we're really worried about cost right now.
We're really focused on cost.
So we're saying,
"Well, how about if we automate some of the tasks?"
But you know, the bean counters are saying,
"Well, what about the cost of automation-related software
and hardware and integration
and training and ongoing maintenance?"
Now the next step is a cost-benefit analysis.
What are some of the financial benefits to be considered?
So we've talked a lot about the operational benefits.
Now I want us to focus on the financial benefits.
So go ahead and put me on pause,
jot down some notes if you can, on financial benefits,
and then come on back and we'll do it together.
While automation has several financial benefits.
Automation can reduce operational cost
by eliminating or reducing the need
for human intervention in routine repetitive tasks.
Now, automated systems can often perform tasks more quickly
and accurately than people, so we have greater productivity.
Now, automated monitoring
and maintenance can reduce system downtime by identifying
and addressing issues more quickly than manual methods.
And we know downtime is very costly.
And lastly, automation can ensure consistency
and reduce errors, which would ultimately lead
to improved quality of products and services
which could potentially increase sales.
So we can reduce operational costs,
have greater productivity, reduce system downtime,
and potentially increase sales.
Those are all positive marks on those financial statements.
Being able to understand this and explain this,
that my friends, is definitely security in action.
There's your word cloud.
Make sure you're familiar with all these terms.
It was just a really short lesson
but we're gonna move over to a five-question quiz.