1
00:00:00,000 --> 00:00:01,770
In this lesson, we'll discuss ways

2
00:00:01,770 --> 00:00:05,280
that you can begin automating security in your organization.

3
00:00:05,280 --> 00:00:06,780
In today's digital landscape,

4
00:00:06,780 --> 00:00:09,720
security management is a cornerstone of business operations

5
00:00:09,720 --> 00:00:11,970
that can bring efficiency, consistency,

6
00:00:11,970 --> 00:00:14,850
and enhance protection due to automation of cybersecurity

7
00:00:14,850 --> 00:00:16,620
in your organization.

8
00:00:16,620 --> 00:00:19,380
Security automation involves using technology to perform

9
00:00:19,380 --> 00:00:20,700
competitive security tests

10
00:00:20,700 --> 00:00:22,950
that are crucial for our organization's protection,

11
00:00:22,950 --> 00:00:26,430
but often time consuming or prone to human error.

12
00:00:26,430 --> 00:00:27,510
This approach ensures

13
00:00:27,510 --> 00:00:30,630
that defenses are consistently maintained and updated,

14
00:00:30,630 --> 00:00:34,200
and security threats are responded to swiftly.

15
00:00:34,200 --> 00:00:36,270
Automating security involves the use of

16
00:00:36,270 --> 00:00:39,180
configurations of guardrails, security groups,

17
00:00:39,180 --> 00:00:42,720
service access management, and permissions.

18
00:00:42,720 --> 00:00:45,300
First, we have implementing guardrails.

19
00:00:45,300 --> 00:00:47,850
Guardrails are automated safety controls

20
00:00:47,850 --> 00:00:49,080
that companies put in place

21
00:00:49,080 --> 00:00:52,350
to protect against insecure infrastructure configurations.

22
00:00:52,350 --> 00:00:54,120
These guardrails are used to ensure

23
00:00:54,120 --> 00:00:56,010
that the organization's security protocols

24
00:00:56,010 --> 00:00:57,990
are being fully adhered to.

25
00:00:57,990 --> 00:00:59,790
Initially, guardrails are configured

26
00:00:59,790 --> 00:01:02,040
according to the company's security standards.

27
00:01:02,040 --> 00:01:04,590
They are designed to be automatically enforced

28
00:01:04,590 --> 00:01:07,170
security policies to prevent any deviations

29
00:01:07,170 --> 00:01:09,540
that could introduce potential vulnerabilities.

30
00:01:09,540 --> 00:01:11,430
Guardrails also can be configured

31
00:01:11,430 --> 00:01:13,260
to continuously monitor the infrastructure

32
00:01:13,260 --> 00:01:15,540
by checking your configuration and network traffic

33
00:01:15,540 --> 00:01:17,520
against the established guardrails.

34
00:01:17,520 --> 00:01:20,130
When a potential security violation is detected,

35
00:01:20,130 --> 00:01:21,840
the system will generate an alert

36
00:01:21,840 --> 00:01:23,820
and take predefined corrective actions

37
00:01:23,820 --> 00:01:26,190
without waiting for human intervention.

38
00:01:26,190 --> 00:01:27,930
These actions could involve things like

39
00:01:27,930 --> 00:01:29,670
revoking a user's permissions,

40
00:01:29,670 --> 00:01:31,380
reconfiguring an affected component,

41
00:01:31,380 --> 00:01:33,960
or isolating a potential infected workstation

42
00:01:33,960 --> 00:01:35,340
from the network.

43
00:01:35,340 --> 00:01:38,280
Second, we have the management of security groups.

44
00:01:38,280 --> 00:01:40,710
Security groups acts as a virtual firewall

45
00:01:40,710 --> 00:01:42,660
for your cloud-based server instances

46
00:01:42,660 --> 00:01:44,700
and their associated resources.

47
00:01:44,700 --> 00:01:46,860
These security groups offer the ability

48
00:01:46,860 --> 00:01:49,890
to specify which incoming and outgoing network traffic

49
00:01:49,890 --> 00:01:53,280
is allowed to or from the given cloud-based server.

50
00:01:53,280 --> 00:01:55,530
Automation can be used to assign instances

51
00:01:55,530 --> 00:01:57,120
to an appropriate security group

52
00:01:57,120 --> 00:01:59,970
with predefined traffic rules based on factors such as

53
00:01:59,970 --> 00:02:02,310
the cloud-based service function, location,

54
00:02:02,310 --> 00:02:03,960
or associated project.

55
00:02:03,960 --> 00:02:07,110
Overtime, threats evolve and our systems can be configured

56
00:02:07,110 --> 00:02:09,990
to dynamically adjust their security group configurations,

57
00:02:09,990 --> 00:02:12,900
to respond to new vulnerabilities or attack strategies.

58
00:02:12,900 --> 00:02:15,810
Our automated systems can also help us analyze traffic

59
00:02:15,810 --> 00:02:17,400
to and from our instances

60
00:02:17,400 --> 00:02:19,290
to ensure that they meet the criteria

61
00:02:19,290 --> 00:02:21,450
that has been established by our security group settings

62
00:02:21,450 --> 00:02:25,080
to prevent any unauthorized access attempts from occurring.

63
00:02:25,080 --> 00:02:27,480
Third, we have enabling and disabling

64
00:02:27,480 --> 00:02:29,310
of services and access.

65
00:02:29,310 --> 00:02:31,350
Another crucial area to consider.

66
00:02:31,350 --> 00:02:32,520
Automating security

67
00:02:32,520 --> 00:02:34,800
is the automation of service access management

68
00:02:34,800 --> 00:02:37,200
to prevent unnecessary exposure to risk

69
00:02:37,200 --> 00:02:39,690
and to maintain operational efficiency.

70
00:02:39,690 --> 00:02:42,300
Automation tools can be used to regularly review

71
00:02:42,300 --> 00:02:44,850
who has access to what, so that we can ensure

72
00:02:44,850 --> 00:02:46,770
that our employees only have access

73
00:02:46,770 --> 00:02:48,750
necessary for their current role.

74
00:02:48,750 --> 00:02:51,090
Service access management can be improved

75
00:02:51,090 --> 00:02:53,220
to have near instant reaction times

76
00:02:53,220 --> 00:02:54,720
by implementing automations

77
00:02:54,720 --> 00:02:57,600
that can monitor for any unusual activity.

78
00:02:57,600 --> 00:02:59,580
If a system detects unusual activity,

79
00:02:59,580 --> 00:03:02,940
it can automatically restrict or disable access to services

80
00:03:02,940 --> 00:03:05,370
until a human analyst can fully investigate

81
00:03:05,370 --> 00:03:08,730
the unusual activity and determine if it is suspicious,

82
00:03:08,730 --> 00:03:11,550
malicious, or just benign in nature.

83
00:03:11,550 --> 00:03:14,700
Another use of service access management automation

84
00:03:14,700 --> 00:03:18,540
is to enable or disable a given instance or service base

85
00:03:18,540 --> 00:03:19,920
on predefined schedule

86
00:03:19,920 --> 00:03:22,260
if the service is not continuously needed.

87
00:03:22,260 --> 00:03:24,420
This helps to reduce the window of opportunity

88
00:03:24,420 --> 00:03:25,920
for a potential cyber attack

89
00:03:25,920 --> 00:03:27,870
since the service can only be attacked

90
00:03:27,870 --> 00:03:30,330
if it is running on a given machine.

91
00:03:30,330 --> 00:03:33,540
Fourth, we have the automations for managing permissions.

92
00:03:33,540 --> 00:03:35,370
Managing permissions is about ensuring

93
00:03:35,370 --> 00:03:37,770
that individuals have the appropriate level of access

94
00:03:37,770 --> 00:03:40,140
to a system based on their assigned role.

95
00:03:40,140 --> 00:03:43,170
This is often done by using role-based access controls,

96
00:03:43,170 --> 00:03:45,060
known as RBAC.

97
00:03:45,060 --> 00:03:47,370
Automating role-based access controls

98
00:03:47,370 --> 00:03:48,720
help to assign and manage

99
00:03:48,720 --> 00:03:50,820
your system permissions consistently.

100
00:03:50,820 --> 00:03:52,440
Using this kind of automation,

101
00:03:52,440 --> 00:03:53,940
your system can grant rights

102
00:03:53,940 --> 00:03:56,940
based on a given role within your organization.

103
00:03:56,940 --> 00:03:59,070
Automatic provisioning and deprovisioning

104
00:03:59,070 --> 00:04:01,680
allows a system to update the user's permissions

105
00:04:01,680 --> 00:04:05,970
whenever a user joins, moves, or leaves an organization.

106
00:04:05,970 --> 00:04:08,310
By automating permission updates accordingly,

107
00:04:08,310 --> 00:04:11,310
we can ensure that there is no unauthorized access

108
00:04:11,310 --> 00:04:13,650
to our organization's sensitive information.

109
00:04:13,650 --> 00:04:15,750
You can also use automated routines,

110
00:04:15,750 --> 00:04:18,240
to perform regular checks on permission settings

111
00:04:18,240 --> 00:04:20,700
to verify compliance with internal policies

112
00:04:20,700 --> 00:04:22,590
and external regulation,

113
00:04:22,590 --> 00:04:26,670
and also to make any necessary adjustments needed overtime.

114
00:04:26,670 --> 00:04:29,550
So remember, security automations

115
00:04:29,550 --> 00:04:31,530
are not just about reducing the workload

116
00:04:31,530 --> 00:04:33,210
of your organization's security team,

117
00:04:33,210 --> 00:04:35,670
but it is really about achieving higher levels

118
00:04:35,670 --> 00:04:37,230
of precision and reactivity

119
00:04:37,230 --> 00:04:38,820
to your security management process

120
00:04:38,820 --> 00:04:41,220
to help strengthen your organization's defense

121
00:04:41,220 --> 00:04:45,240
against increasingly sophisticated cyber threat actors.

122
00:04:45,240 --> 00:04:46,920
To operate at the speed of cyber

123
00:04:46,920 --> 00:04:48,840
our organization's most embrace automation

124
00:04:48,840 --> 00:04:51,000
to safeguard our assets, our data,

125
00:04:51,000 --> 00:04:52,833
and our operational continuity.