Tutor: Scripting. 2 2
In this lesson, we're going to talk about scripting 3 3
because it is so important 4 4
to be able to automate things. 5 5
Now, when it comes to automation, 6 6
one of the best places to use automation 7 7
is within the cloud. 8 8
Now, when you use cloud automation, 9 9
this is the completion of cloud-related administrative tasks 10 10
without human intervention. 11 11
Now, essentially, this allows us 12 12
to do lots and lots of things 13 13
without even being awake or noticing that it's happening, 14 14
we let the computers do it for us. 15 15
Now, when we deal with cloud automation, 16 16
this can occur through the graphical user interface, 17 17
through the command line, 18 18
or through APIs like we just talked about. 19 19
Now, let me give you a good example of this. 20 20
Here is a script. 21 21
This simple script is less than 50 lines of code. 22 22
Now, you don't have to read the whole script, 23 23
but if you want to pause the video and look at it, feel free. 24 24
Now, this script, what is it doing? 25 25
It's going to go through 26 26
and find every cloud instance in your AWS region. 27 27
In this case, it's set up for the US East 1 Region. 28 28
Now, this is going to be any instance that's owned 29 29
by your company, 30 30
and label this production within this environment. 31 31
Then, it's going to take a snapshot of them. 32 32
Now, that doesn't sound like a real big deal, right? 33 33
If I only have one instance in the cloud, 34 34
this isn't really helping me that much 35 35
because I could log in, 36 36
I could take my own snapshot, and move on. 37 37
But let's think if you were a large company, 38 38
let's say you worked for the US government, for instance, 39 39
they have hundreds and thousands of cloud instances 40 40
sitting in that region, 41 41
and so they can do this script 42 42
and set up so that once a day 43 43
it will go through and take snapshots for them. 44 44
Thousands of instances all at once. 45 45
This means no people have to think about it, 46 46
there's no manual labor, 47 47
and it's being done every single time 48 48
because the code will run 49 49
and do it seamlessly, every single time. 50 50
That's the benefit of doing automation. 51 51
Now, when it comes to cloud automation 52 52
this is really important 53 53
because if we don't have cloud automation and scripting, 54 54
we can't actually do things like rapid elasticity 55 55
because if I have to go and turn on a server myself 56 56
and then install the software and then deploy it, 57 57
that takes away all the benefits of this cloud elasticity. 58 58
And so scripting is inherently necessary 59 59
anytime you want to do orchestration 60 60
and be able to do cloud automation. 61 61
Now, what can you do with scripting? 62 62
I just showed you a very simple script 63 63
to be able to take a snapshot, 64 64
but you can do so much more. 65 65
Scripting can be used to provision resources, 66 66
add accounts, assign permissions, 67 67
and perform many other tasks, 68 68
including backup, recovery, and scaling. 69 69
It can provision, it can deprovision, 70 70
it can do all sorts of stuff. 71 71
It all depends on how creative you want to be 72 72
and how you want to create your scripts. 73 73
Now, when you create your script, 74 74
you have to include several different elements. 75 75
For instance, you have to have the parameters. 76 76
What will that script take as input? 77 77
You have to have the logic statements, 78 78
what things are going to alter the flow of the execution? 79 79
These are the if, then, else, do, while, 80 80
all those things, all come down to logic. 81 81
Then we have validation. 82 82
We have to be able to validate input that's coming in 83 83
that we're going to get through the script 84 84
and make sure it's good, 85 85
and then if we have something bad, 86 86
we need to handle those errors, 87 87
doing proper error handling. 88 88
And at the end of this, 89 89
we also need to do unit testing 90 90
because if I create a script, 91 91
I need to make sure I test it and it works flawlessly 92 92
because if I'm going to spin something up 93 93
and tell it to do it against a thousand instances 94 94
if I do it wrong on one, that's kind of bad. 95 95
But if I do it wrong on a thousand things, 96 96
that's really bad. 97 97
And it takes me a long time to clean that up. 98 98
Now, when you're creating scripting, 99 99
you have to do it in a language 100 100
and there are lots of different languages you can use. 101 101
For instance, you can write your scripts in JavaScript, 102 102
Python, Ruby, Go, 103 103
and there are numerous other ones out there. 104 104
Now, which one should you use? 105 105
Well, that depends on you and your use case. 106 106
For me, Python is by far my favorite language. 107 107
Most of the automation I do is written in Python. 108 108
It's easy to learn. 109 109
It's extremely useful for scripting 110 110
as a system administrator, 111 111
or as a cybersecurity analyst, 112 112
or as a penetration tester. 113 113
If you continue upward in the field of cybersecurity, 114 114
I would recommend that you take 115 115
at least a basic Python course 116 116
so you can learn how to use it in the real world 117 117
to make your job easier in the long run. 118 118
Now, for the exam, one quick tip. 119 119
You do not need to know how to create scripts, 120 120
that is not within the objectives of this exam, 121 121
but if you do decide to move on to the PenTest+ curriculum 122 122
and that certification after CISA, 123 123
be prepared to learn some basic scripting. 124 124
On that exam, 125 125
you do need to know Python, Ruby, PowerShell, and Bash. 126 126
You don't have to be an expert, 127 127
but you do need to be able to read those scripts 128 128
and understand what they're doing 129 129
because as a pen tester or a cybersecurity analyst, 130 130
you will be analyzing scripts often, 131 131
and sometimes even writing your own.