1 00:00:00,200 --> 00:00:01,800 In this section on the course, 2 00:00:01,800 --> 00:00:04,740 we'll be covering automation and orchestration. 3 00:00:04,740 --> 00:00:06,300 Automation refers to the process 4 00:00:06,300 --> 00:00:08,280 of automatically executing tasks 5 00:00:08,280 --> 00:00:10,080 without manual intervention, 6 00:00:10,080 --> 00:00:14,040 typically achieved using specialized software or scripts. 7 00:00:14,040 --> 00:00:15,630 Now it allows for repetitive tasks 8 00:00:15,630 --> 00:00:17,550 to be performed consistently and efficiently 9 00:00:17,550 --> 00:00:19,410 while reducing the chances of human error 10 00:00:19,410 --> 00:00:22,560 and freeing up time for more complex tasks. 11 00:00:22,560 --> 00:00:24,930 On the other hand, orchestration is a coordinated 12 00:00:24,930 --> 00:00:27,840 and sequenced execution of multiple automated tasks 13 00:00:27,840 --> 00:00:30,210 to achieve a specific outcome or workflow. 14 00:00:30,210 --> 00:00:32,130 Now, this involves an organization 15 00:00:32,130 --> 00:00:34,290 directing various automated processes, 16 00:00:34,290 --> 00:00:35,760 work together harmoniously, 17 00:00:35,760 --> 00:00:38,427 while ensuring that tasks are executed in the right order 18 00:00:38,427 --> 00:00:42,180 and the dependencies between them are managed appropriately. 19 00:00:42,180 --> 00:00:43,770 Basically, automation focuses 20 00:00:43,770 --> 00:00:45,840 on making individual tasks autonomous 21 00:00:45,840 --> 00:00:47,790 while orchestration looks at the bigger picture 22 00:00:47,790 --> 00:00:50,670 to ensure that all automated tasks come together seamlessly 23 00:00:50,670 --> 00:00:52,920 to achieve a broader goal. 24 00:00:52,920 --> 00:00:55,740 In recent years, the use of SOAR has become very popular. 25 00:00:55,740 --> 00:00:57,120 Now, when I talk about SOAR, 26 00:00:57,120 --> 00:00:59,610 I'm not talking about soaring like a bird. 27 00:00:59,610 --> 00:01:02,670 I'm talking about the SOAR for the acronym, 28 00:01:02,670 --> 00:01:05,519 security, orchestration, automation, and response, 29 00:01:05,519 --> 00:01:07,140 which is a class of security tools 30 00:01:07,140 --> 00:01:09,420 to help facilitate incident response, 31 00:01:09,420 --> 00:01:11,670 threat hunting, and security configurations 32 00:01:11,670 --> 00:01:13,830 by orchestrating and automating runbooks 33 00:01:13,830 --> 00:01:16,140 and delivering data enrichment. 34 00:01:16,140 --> 00:01:19,080 Basically, think of this as a SIEM, version 2.0. 35 00:01:19,080 --> 00:01:21,120 Now when you're dealing with SOAR, 36 00:01:21,120 --> 00:01:23,820 SOAR is primarily used for incident response, 37 00:01:23,820 --> 00:01:25,860 but there's a large part of it used 38 00:01:25,860 --> 00:01:27,450 for threat hunting as well. 39 00:01:27,450 --> 00:01:29,310 But really the number one place you're going 40 00:01:29,310 --> 00:01:31,350 to see SOAR used is incident response 41 00:01:31,350 --> 00:01:34,380 because you can automate so many of your actions. 42 00:01:34,380 --> 00:01:38,130 Now, as I said, I like thinking about it as SIEM 2.0. 43 00:01:38,130 --> 00:01:40,230 Essentially, it's a next generation SIEM 44 00:01:40,230 --> 00:01:41,970 since it takes security information 45 00:01:41,970 --> 00:01:45,270 and event monitoring systems and integrates it into SOAR. 46 00:01:45,270 --> 00:01:46,830 And when you put those two together, 47 00:01:46,830 --> 00:01:49,170 it really does become your next generation SIEM. 48 00:01:49,170 --> 00:01:51,870 Just like when you deal with the next generation firewall, 49 00:01:51,870 --> 00:01:54,510 they took it from dealing with layer three and layer four 50 00:01:54,510 --> 00:01:56,970 and brought it all the way up to seven layers. 51 00:01:56,970 --> 00:01:59,730 It made it just so much better and so much more capable. 52 00:01:59,730 --> 00:02:01,290 Well, the same thing is happening here 53 00:02:01,290 --> 00:02:03,450 when you integrate SOAR with your SIEM, 54 00:02:03,450 --> 00:02:05,850 you basically get an awesome product. 55 00:02:05,850 --> 00:02:07,200 It's going to give you the ability 56 00:02:07,200 --> 00:02:09,060 to scan security and threat data 57 00:02:09,060 --> 00:02:11,160 to be able to identify different things. 58 00:02:11,160 --> 00:02:13,530 You can then analyze it using machine learning, 59 00:02:13,530 --> 00:02:15,540 and then you can also automate the process 60 00:02:15,540 --> 00:02:17,730 of doing data enrichment to make sure that data 61 00:02:17,730 --> 00:02:21,600 inside SIEM is even more powerful for your analysts to use. 62 00:02:21,600 --> 00:02:23,160 And you can do incident response, 63 00:02:23,160 --> 00:02:24,900 so you can provision new resources. 64 00:02:24,900 --> 00:02:26,640 That means you can create new accounts, 65 00:02:26,640 --> 00:02:28,140 you can create new VMs, 66 00:02:28,140 --> 00:02:29,460 and if you're using VDI, 67 00:02:29,460 --> 00:02:31,950 you can actually delete someone's infected box 68 00:02:31,950 --> 00:02:34,560 and then create a new virtual machine for them to use, 69 00:02:34,560 --> 00:02:37,260 and all of this can be done using automated playbooks 70 00:02:37,260 --> 00:02:40,020 if you want to use this SOAR capability. 71 00:02:40,020 --> 00:02:41,460 Now, when we talk about this, 72 00:02:41,460 --> 00:02:43,140 I just mentioned the word playbook. 73 00:02:43,140 --> 00:02:44,400 What exactly is that? 74 00:02:44,400 --> 00:02:47,040 Well, a playbook is essentially a checklist of actions 75 00:02:47,040 --> 00:02:48,960 that you're going to perform to detect 76 00:02:48,960 --> 00:02:51,270 and respond a specific type of incident. 77 00:02:51,270 --> 00:02:52,627 So if you said, 78 00:02:52,627 --> 00:02:54,060 "Hey, look, I have an alert 79 00:02:54,060 --> 00:02:55,650 that says there's some phishing campaign 80 00:02:55,650 --> 00:02:57,630 and someone clicked on the link on this machine. 81 00:02:57,630 --> 00:03:00,300 Well, we're going to do steps 1 through 10, 82 00:03:00,300 --> 00:03:02,400 and then we're going to re-image the machine, 83 00:03:02,400 --> 00:03:04,560 and we're going to give them a new computer." 84 00:03:04,560 --> 00:03:06,540 That might be your steps. 85 00:03:06,540 --> 00:03:07,740 So for example, 86 00:03:07,740 --> 00:03:09,060 if you have somebody who clicked on a link 87 00:03:09,060 --> 00:03:10,020 in a phishing campaign, 88 00:03:10,020 --> 00:03:11,977 you might have steps one through five which says, 89 00:03:11,977 --> 00:03:14,460 "Go to the machine, isolate it from the network, 90 00:03:14,460 --> 00:03:15,780 do a virus scan to make sure 91 00:03:15,780 --> 00:03:17,790 they haven't infected themselves or anyone else, 92 00:03:17,790 --> 00:03:19,740 check the registry to make sure there's nothing 93 00:03:19,740 --> 00:03:20,940 in there for persistence, 94 00:03:20,940 --> 00:03:23,220 and then back up all the user data, 95 00:03:23,220 --> 00:03:24,750 refill them with a new computer, 96 00:03:24,750 --> 00:03:27,750 and then reinstall the image and put the data back on it." 97 00:03:27,750 --> 00:03:28,800 This is just an example of some 98 00:03:28,800 --> 00:03:30,180 of the actions that you might do. 99 00:03:30,180 --> 00:03:32,430 Now, these could be manual or automated, 100 00:03:32,430 --> 00:03:34,050 but in the case of a playbook, 101 00:03:34,050 --> 00:03:35,220 you're usually just talking about the steps 102 00:03:35,220 --> 00:03:36,690 that are involved. 103 00:03:36,690 --> 00:03:38,910 Now, if I can automate a lot of that, 104 00:03:38,910 --> 00:03:40,740 that has become a runbook. 105 00:03:40,740 --> 00:03:44,010 Now, a runbook is an automated version of a playbook, 106 00:03:44,010 --> 00:03:46,290 and it leaves clearly defined interaction points 107 00:03:46,290 --> 00:03:47,610 for human analysis. 108 00:03:47,610 --> 00:03:49,507 For example, my store might say, 109 00:03:49,507 --> 00:03:51,600 "If someone clicks the link in a phishing email, 110 00:03:51,600 --> 00:03:53,730 do these steps one through five. 111 00:03:53,730 --> 00:03:55,740 When you get to step two, pause, 112 00:03:55,740 --> 00:03:58,890 send it to an analyst who will then say re-image the machine 113 00:03:58,890 --> 00:04:00,690 or don't re-image the machine." 114 00:04:00,690 --> 00:04:02,490 These are the ways that we can use these things, 115 00:04:02,490 --> 00:04:05,070 and they all work together to create a better environment 116 00:04:05,070 --> 00:04:06,870 and to help reduce the workload of our analysts, 117 00:04:06,870 --> 00:04:07,770 because again, 118 00:04:07,770 --> 00:04:10,020 we only have so many cybersecurity professionals 119 00:04:10,020 --> 00:04:12,150 and if we have them all wasting their time 120 00:04:12,150 --> 00:04:14,700 on very minor things that could be automated, 121 00:04:14,700 --> 00:04:16,019 that's not very helpful to us. 122 00:04:16,019 --> 00:04:17,640 So instead, we want to make sure 123 00:04:17,640 --> 00:04:18,810 that we automate what we can, 124 00:04:18,810 --> 00:04:21,959 and SOAR allows us to do a lot of that automation. 125 00:04:21,959 --> 00:04:23,550 So in this section on the course, 126 00:04:23,550 --> 00:04:25,170 we're going to just focus on automation 127 00:04:25,170 --> 00:04:26,850 and orchestration by singularly focusing 128 00:04:26,850 --> 00:04:29,550 on domain 4 and objective 4.7. 129 00:04:29,550 --> 00:04:31,470 Objective 4.7 states that you must be able 130 00:04:31,470 --> 00:04:33,480 to explain the importance of automation 131 00:04:33,480 --> 00:04:37,020 and orchestration related to secure operations. 132 00:04:37,020 --> 00:04:39,120 First, we'll discuss when to automate 133 00:04:39,120 --> 00:04:40,440 and when to orchestrate. 134 00:04:40,440 --> 00:04:43,320 Here we'll learn to consider the complexity, cost, 135 00:04:43,320 --> 00:04:45,540 amount of single points of failures involved, 136 00:04:45,540 --> 00:04:48,300 and technical debt, ongoing supportability, 137 00:04:48,300 --> 00:04:49,710 whether the things that you're considering 138 00:04:49,710 --> 00:04:51,870 is a repeatable process that doesn't frequently change, 139 00:04:51,870 --> 00:04:53,520 and things like that when determining 140 00:04:53,520 --> 00:04:56,280 if we should automate or orchestrate a particular process 141 00:04:56,280 --> 00:04:58,140 in our organization. 142 00:04:58,140 --> 00:04:59,790 Next, we'll look at the benefits 143 00:04:59,790 --> 00:05:01,800 of automation and orchestration. 144 00:05:01,800 --> 00:05:03,300 Some of these benefits include things 145 00:05:03,300 --> 00:05:05,280 like becoming more efficient and saving time 146 00:05:05,280 --> 00:05:06,660 by enforcing baselines, 147 00:05:06,660 --> 00:05:09,060 standardizing your infrastructure configuration, 148 00:05:09,060 --> 00:05:10,920 scaling in a more secure manner, 149 00:05:10,920 --> 00:05:13,530 better employee retention, faster reaction times, 150 00:05:13,530 --> 00:05:15,390 and using automation and orchestration 151 00:05:15,390 --> 00:05:17,550 as a workforce multiplier. 152 00:05:17,550 --> 00:05:20,550 Then we'll discuss how you can automate support tickets. 153 00:05:20,550 --> 00:05:22,740 This can be done to create the tickets, 154 00:05:22,740 --> 00:05:24,780 perform minor actions on the tickets, 155 00:05:24,780 --> 00:05:27,510 and to escalate the tickets when required. 156 00:05:27,510 --> 00:05:29,340 After that, we'll look at automating 157 00:05:29,340 --> 00:05:31,680 your organization's onboarding process. 158 00:05:31,680 --> 00:05:33,210 Whenever you hire a new employee, 159 00:05:33,210 --> 00:05:35,340 there are several functions that need to be performed, 160 00:05:35,340 --> 00:05:37,260 including provisioning the user's account, 161 00:05:37,260 --> 00:05:38,910 provisioning new resources for the user, 162 00:05:38,910 --> 00:05:40,410 and numerous processes, 163 00:05:40,410 --> 00:05:42,450 and most of these things can be automated 164 00:05:42,450 --> 00:05:44,550 or orchestrated within your organization. 165 00:05:44,550 --> 00:05:47,010 Next, we'll explore how you can automate security 166 00:05:47,010 --> 00:05:48,120 in your organization. 167 00:05:48,120 --> 00:05:50,610 For example, you can set up guardrails, 168 00:05:50,610 --> 00:05:54,360 security groups, enable or disable services and access, 169 00:05:54,360 --> 00:05:56,520 then also modify the user's permissions, 170 00:05:56,520 --> 00:05:59,940 all by using automation and orchestration techniques. 171 00:05:59,940 --> 00:06:01,470 Then we'll review methods 172 00:06:01,470 --> 00:06:03,210 to automate your applications development 173 00:06:03,210 --> 00:06:04,740 within your organization. 174 00:06:04,740 --> 00:06:07,290 Here we'll be focused on the continuous integration 175 00:06:07,290 --> 00:06:11,070 and continuous deployment process known as CI/CD. 176 00:06:11,070 --> 00:06:13,320 After that, we'll look at different integrations 177 00:06:13,320 --> 00:06:15,090 and APIs that we can use 178 00:06:15,090 --> 00:06:17,400 to automate workflows across multiple systems 179 00:06:17,400 --> 00:06:20,460 and even across numerous softwares a service products. 180 00:06:20,460 --> 00:06:22,800 And finally, we'll take a short quiz to see 181 00:06:22,800 --> 00:06:24,540 what you learned during this section of the course 182 00:06:24,540 --> 00:06:26,370 and review each one of those quiz questions 183 00:06:26,370 --> 00:06:27,660 to fully ensure that you can explain 184 00:06:27,660 --> 00:06:29,043 why each answer was right. 185 00:06:29,880 --> 00:06:32,130 So let's dive into the world of automation 186 00:06:32,130 --> 00:06:34,530 and orchestration in this section of the course.