In this section on the course,
we'll be covering automation and orchestration.
Automation refers to the process
of automatically executing tasks
without manual intervention,
typically achieved using specialized software or scripts.
Now it allows for repetitive tasks
to be performed consistently and efficiently
while reducing the chances of human error
and freeing up time for more complex tasks.
On the other hand, orchestration is a coordinated
and sequenced execution of multiple automated tasks
to achieve a specific outcome or workflow.
Now, this involves an organization
directing various automated processes,
work together harmoniously,
while ensuring that tasks are executed in the right order
and the dependencies between them are managed appropriately.
Basically, automation focuses
on making individual tasks autonomous
while orchestration looks at the bigger picture
to ensure that all automated tasks come together seamlessly
to achieve a broader goal.
In recent years, the use of SOAR has become very popular.
Now, when I talk about SOAR,
I'm not talking about soaring like a bird.
I'm talking about the SOAR for the acronym,
security, orchestration, automation, and response,
which is a class of security tools
to help facilitate incident response,
threat hunting, and security configurations
by orchestrating and automating runbooks
and delivering data enrichment.
Basically, think of this as a SIEM, version 2.0.
Now when you're dealing with SOAR,
SOAR is primarily used for incident response,
but there's a large part of it used
for threat hunting as well.
But really the number one place you're going
to see SOAR used is incident response
because you can automate so many of your actions.
Now, as I said, I like thinking about it as SIEM 2.0.
Essentially, it's a next generation SIEM
since it takes security information
and event monitoring systems and integrates it into SOAR.
And when you put those two together,
it really does become your next generation SIEM.
Just like when you deal with the next generation firewall,
they took it from dealing with layer three and layer four
and brought it all the way up to seven layers.
It made it just so much better and so much more capable.
Well, the same thing is happening here
when you integrate SOAR with your SIEM,
you basically get an awesome product.
It's going to give you the ability
to scan security and threat data
to be able to identify different things.
You can then analyze it using machine learning,
and then you can also automate the process
of doing data enrichment to make sure that data
inside SIEM is even more powerful for your analysts to use.
And you can do incident response,
so you can provision new resources.
That means you can create new accounts,
you can create new VMs,
and if you're using VDI,
you can actually delete someone's infected box
and then create a new virtual machine for them to use,
and all of this can be done using automated playbooks
if you want to use this SOAR capability.
Now, when we talk about this,
I just mentioned the word playbook.
What exactly is that?
Well, a playbook is essentially a checklist of actions
that you're going to perform to detect
and respond a specific type of incident.
So if you said,
"Hey, look, I have an alert
that says there's some phishing campaign
and someone clicked on the link on this machine.
Well, we're going to do steps 1 through 10,
and then we're going to re-image the machine,
and we're going to give them a new computer."
That might be your steps.
So for example,
if you have somebody who clicked on a link
in a phishing campaign,
you might have steps one through five which says,
"Go to the machine, isolate it from the network,
do a virus scan to make sure
they haven't infected themselves or anyone else,
check the registry to make sure there's nothing
in there for persistence,
and then back up all the user data,
refill them with a new computer,
and then reinstall the image and put the data back on it."
This is just an example of some
of the actions that you might do.
Now, these could be manual or automated,
but in the case of a playbook,
you're usually just talking about the steps
that are involved.
Now, if I can automate a lot of that,
that has become a runbook.
Now, a runbook is an automated version of a playbook,
and it leaves clearly defined interaction points
for human analysis.
For example, my store might say,
"If someone clicks the link in a phishing email,
do these steps one through five.
When you get to step two, pause,
send it to an analyst who will then say re-image the machine
or don't re-image the machine."
These are the ways that we can use these things,
and they all work together to create a better environment
and to help reduce the workload of our analysts,
because again,
we only have so many cybersecurity professionals
and if we have them all wasting their time
on very minor things that could be automated,
that's not very helpful to us.
So instead, we want to make sure
that we automate what we can,
and SOAR allows us to do a lot of that automation.
So in this section on the course,
we're going to just focus on automation
and orchestration by singularly focusing
on domain 4 and objective 4.7.
Objective 4.7 states that you must be able
to explain the importance of automation
and orchestration related to secure operations.
First, we'll discuss when to automate
and when to orchestrate.
Here we'll learn to consider the complexity, cost,
amount of single points of failures involved,
and technical debt, ongoing supportability,
whether the things that you're considering
is a repeatable process that doesn't frequently change,
and things like that when determining
if we should automate or orchestrate a particular process
in our organization.
Next, we'll look at the benefits
of automation and orchestration.
Some of these benefits include things
like becoming more efficient and saving time
by enforcing baselines,
standardizing your infrastructure configuration,
scaling in a more secure manner,
better employee retention, faster reaction times,
and using automation and orchestration
as a workforce multiplier.
Then we'll discuss how you can automate support tickets.
This can be done to create the tickets,
perform minor actions on the tickets,
and to escalate the tickets when required.
After that, we'll look at automating
your organization's onboarding process.
Whenever you hire a new employee,
there are several functions that need to be performed,
including provisioning the user's account,
provisioning new resources for the user,
and numerous processes,
and most of these things can be automated
or orchestrated within your organization.
Next, we'll explore how you can automate security
in your organization.
For example, you can set up guardrails,
security groups, enable or disable services and access,
then also modify the user's permissions,
all by using automation and orchestration techniques.
Then we'll review methods
to automate your applications development
within your organization.
Here we'll be focused on the continuous integration
and continuous deployment process known as CI/CD.
After that, we'll look at different integrations
and APIs that we can use
to automate workflows across multiple systems
and even across numerous softwares a service products.
And finally, we'll take a short quiz to see
what you learned during this section of the course
and review each one of those quiz questions
to fully ensure that you can explain
why each answer was right.
So let's dive into the world of automation
and orchestration in this section of the course.