1
00:00:06,540 --> 00:00:09,840
- Welcome to lesson 20, explain
the importance of automation

2
00:00:09,840 --> 00:00:14,040
and orchestration related
to secure operations.

3
00:00:14,040 --> 00:00:16,260
Now, we've been talking about automation

4
00:00:16,260 --> 00:00:18,420
really since the very
beginning of this course,

5
00:00:18,420 --> 00:00:20,340
and over and over again talked about

6
00:00:20,340 --> 00:00:22,170
the importance of automation.

7
00:00:22,170 --> 00:00:23,507
And you've also been introduced

8
00:00:23,507 --> 00:00:26,280
to orchestration a couple of times now.

9
00:00:26,280 --> 00:00:28,770
So in this particular
lesson, we're gonna focus in

10
00:00:28,770 --> 00:00:32,220
on scripting, a little
bit more about automation,

11
00:00:32,220 --> 00:00:34,383
and some examples of orchestration.

12
00:00:35,754 --> 00:00:38,160
Scripting is a set of instructions used

13
00:00:38,160 --> 00:00:41,730
to automate a sequence
of repetitive tasks.

14
00:00:41,730 --> 00:00:44,700
Now, scripts are usually
written in a scripting language

15
00:00:44,700 --> 00:00:46,200
which is a type of programming language

16
00:00:46,200 --> 00:00:48,660
designed for integrating and communicating

17
00:00:48,660 --> 00:00:50,730
with other programming languages.

18
00:00:50,730 --> 00:00:52,800
Now, the nice thing
about scripting languages

19
00:00:52,800 --> 00:00:54,480
they're typically easier to learn

20
00:00:54,480 --> 00:00:57,630
and write than lower level
programming languages.

21
00:00:57,630 --> 00:00:59,490
The scripts are often
going to be interpreted

22
00:00:59,490 --> 00:01:02,100
rather than compiled, and
that means that the scripts

23
00:01:02,100 --> 00:01:05,310
are read and executed line by line

24
00:01:05,310 --> 00:01:07,860
by the processor at runtime.

25
00:01:07,860 --> 00:01:10,020
The scripts can be interactive
or non-interactive.

26
00:01:10,020 --> 00:01:12,750
Interactive meaning res,
requiring a response

27
00:01:12,750 --> 00:01:15,033
or they can just run straight through.

28
00:01:16,110 --> 00:01:19,020
So let me introduce you
to four scripting tools,

29
00:01:19,020 --> 00:01:23,114
Python, PowerShell, Bash, and macros.

30
00:01:23,114 --> 00:01:27,300
Python is an interpreted
object oriented open source,

31
00:01:27,300 --> 00:01:29,790
meaning can freely modified and adopted,

32
00:01:29,790 --> 00:01:32,010
programming language
with a really extensive

33
00:01:32,010 --> 00:01:33,330
available library.

34
00:01:33,330 --> 00:01:36,519
Now, Python is a favorite of
security professionals used

35
00:01:36,519 --> 00:01:40,500
for managing security devices
and for doing all kinds

36
00:01:40,500 --> 00:01:42,240
of assessments and testing.

37
00:01:42,240 --> 00:01:45,060
It's also a favorite of our
adversaries, so I would suggest

38
00:01:45,060 --> 00:01:49,170
that you get at least a cursory
understanding of Python.

39
00:01:49,170 --> 00:01:51,900
Now, PowerShell is Microsoft's automation

40
00:01:51,900 --> 00:01:54,420
and configuration management framework.

41
00:01:54,420 --> 00:01:55,740
So you can drop to a command line.

42
00:01:55,740 --> 00:01:57,030
It's a command line shell,

43
00:01:57,030 --> 00:02:00,540
and it is an incredibly,
incredibly powerful

44
00:02:00,540 --> 00:02:02,580
scripting language.

45
00:02:02,580 --> 00:02:06,600
Bash, we use in the
Linux or Unix environment

46
00:02:06,600 --> 00:02:09,990
is again, a command line shell
or command line interface

47
00:02:09,990 --> 00:02:12,480
and a scripting language,
very much like PowerShell's

48
00:02:12,480 --> 00:02:14,160
in the Microsoft environment.

49
00:02:14,160 --> 00:02:17,513
And then a macro is going to
be an automated input sequence

50
00:02:17,513 --> 00:02:21,213
that imitates keystrokes or mouse actions.

51
00:02:23,160 --> 00:02:24,960
So we can use all of those tools

52
00:02:24,960 --> 00:02:29,250
for great scripting reasons,
but so can our adversaries.

53
00:02:29,250 --> 00:02:31,980
So I also wanna talk about
adversarial scripting,

54
00:02:31,980 --> 00:02:35,460
meaning scripting for bad
opposed to scripting for good.

55
00:02:35,460 --> 00:02:38,100
And talk about how our
adversaries could use Python

56
00:02:38,100 --> 00:02:40,773
or PowerShell or Bash or a macro.

57
00:02:42,870 --> 00:02:45,750
So Python is an extremely
useful programming language

58
00:02:45,750 --> 00:02:48,270
because it's easy to
learn and it can perform

59
00:02:48,270 --> 00:02:51,990
multiple functions, but
it's also going to be

60
00:02:51,990 --> 00:02:55,983
the favorite language for
writing attack codes and tools.

61
00:02:57,060 --> 00:02:59,220
Attackers can use PowerShell

62
00:02:59,220 --> 00:03:01,890
to direct the execution of a local script,

63
00:03:01,890 --> 00:03:04,380
retrieve and execute remote resources

64
00:03:04,380 --> 00:03:08,043
using various network
protocols and encode payloads.

65
00:03:09,390 --> 00:03:12,435
Bash can be used by our
attackers to direct the execution

66
00:03:12,435 --> 00:03:16,239
of a local script, retrieve
and execute remote resources

67
00:03:16,239 --> 00:03:18,690
using various network protocols,

68
00:03:18,690 --> 00:03:22,650
and automate tasks from
a Linux or Unix platform.

69
00:03:22,650 --> 00:03:25,350
And attackers can use a macro virus

70
00:03:25,350 --> 00:03:28,740
to infect a software program
and to cause a series

71
00:03:28,740 --> 00:03:32,760
of actions to begin automatically
when a program is opened.

72
00:03:32,760 --> 00:03:35,220
So the really interesting
way to think about this slide

73
00:03:35,220 --> 00:03:38,580
is here's all the ways
we can use it for good,

74
00:03:38,580 --> 00:03:41,820
and here's all the ways that
these same scripting tools

75
00:03:41,820 --> 00:03:45,243
and techniques can be
used by our adversaries.

76
00:03:46,650 --> 00:03:47,580
So let's take a look

77
00:03:47,580 --> 00:03:50,633
at how our adversaries
might use PowerShell

78
00:03:50,633 --> 00:03:53,493
and VBA to initiate an attack.

79
00:03:54,420 --> 00:03:57,060
So the attacker hides a PowerShell script

80
00:03:57,060 --> 00:04:00,753
in a Microsoft office,
macro written in VBA.

81
00:04:01,770 --> 00:04:04,140
The victim receives a phishing email

82
00:04:04,140 --> 00:04:06,180
with an attached document and probably

83
00:04:06,180 --> 00:04:09,377
with a name that sounds
really interesting.

84
00:04:09,377 --> 00:04:11,137
The victim thinks,

85
00:04:11,137 --> 00:04:12,960
"Oh, probably shouldn't open the document.

86
00:04:12,960 --> 00:04:15,690
I don't know who it's from,
but oh, I'm so curious."

87
00:04:15,690 --> 00:04:17,793
And the victim opens the document.

88
00:04:18,780 --> 00:04:23,367
The macro will execute and
launches the PowerShell script

89
00:04:23,367 --> 00:04:27,180
and then the victim system
is potentially compromised.

90
00:04:27,180 --> 00:04:28,950
So really keep in mind, right,

91
00:04:28,950 --> 00:04:32,523
that scripting can be used
for good and for evil.

92
00:04:33,870 --> 00:04:37,350
Now, automation is the
ability to execute a sequence

93
00:04:37,350 --> 00:04:40,080
of tasks without human intervention.

94
00:04:40,080 --> 00:04:42,930
The goal of automation,
as we've talked about

95
00:04:42,930 --> 00:04:46,170
numerous times now, is to
improve quality of service,

96
00:04:46,170 --> 00:04:49,290
increase agility, and reduce risk.

97
00:04:49,290 --> 00:04:52,920
That automation reduces or
eliminates manual dependencies

98
00:04:52,920 --> 00:04:54,930
and human error, automation

99
00:04:54,930 --> 00:04:57,720
can be a workforce multiplier for sure.

100
00:04:57,720 --> 00:05:01,260
And automation techniques
include scripting, robotics,

101
00:05:01,260 --> 00:05:05,280
specialized software, and
artificial intelligence.

102
00:05:05,280 --> 00:05:07,707
Now, automation often does
require an investment.

103
00:05:07,707 --> 00:05:10,140
Sometimes even a significant investment.

104
00:05:10,140 --> 00:05:12,270
So organizations really need to do

105
00:05:12,270 --> 00:05:14,010
a cost-benefit analysis, right?

106
00:05:14,010 --> 00:05:18,513
And consider cost complexity
and ongoing maintenance.

107
00:05:20,010 --> 00:05:22,257
So let's look at some
automation use cases.

108
00:05:22,257 --> 00:05:23,520
Automation can be used

109
00:05:23,520 --> 00:05:25,200
for provisioning, threat intelligence,

110
00:05:25,200 --> 00:05:27,840
system administration,
vulnerability management,

111
00:05:27,840 --> 00:05:30,750
compliance monitoring,
workflow automation,

112
00:05:30,750 --> 00:05:34,140
security and code testing
and data analysis.

113
00:05:34,140 --> 00:05:36,540
These are just some of many, right?

114
00:05:36,540 --> 00:05:37,440
So for provisioning.

115
00:05:37,440 --> 00:05:39,660
Demand generated resource allocation

116
00:05:39,660 --> 00:05:42,180
to support scalability and elasticity.

117
00:05:42,180 --> 00:05:43,500
For threat intelligence, right?

118
00:05:43,500 --> 00:05:45,210
To gather and analyze data

119
00:05:45,210 --> 00:05:48,150
from various sources and provide insight.

120
00:05:48,150 --> 00:05:51,270
For system administration,
to automate repetitive tasks

121
00:05:51,270 --> 00:05:53,460
such as performance monitoring.

122
00:05:53,460 --> 00:05:54,900
For vulnerability management,

123
00:05:54,900 --> 00:05:58,800
to identify vulnerabilities,
prioritize remediation,

124
00:05:58,800 --> 00:06:00,780
and do the patching.

125
00:06:00,780 --> 00:06:03,630
For compliance monitoring,
to monitor for compliance

126
00:06:03,630 --> 00:06:06,480
with standards and regulations.

127
00:06:06,480 --> 00:06:07,950
For workflow automation,

128
00:06:07,950 --> 00:06:11,070
to streamline business
processes such as email routing

129
00:06:11,070 --> 00:06:13,290
and updating a database.

130
00:06:13,290 --> 00:06:14,730
For security and code testing,

131
00:06:14,730 --> 00:06:17,280
to automate attacks
against pre-production code

132
00:06:17,280 --> 00:06:19,350
and continuous vulnerability testing

133
00:06:19,350 --> 00:06:20,940
against production code.

134
00:06:20,940 --> 00:06:22,410
And for data analysis,

135
00:06:22,410 --> 00:06:25,470
to automate the process
of data extraction,

136
00:06:25,470 --> 00:06:28,740
transformation and report generation.

137
00:06:28,740 --> 00:06:32,040
So automation truly is the
the wave of the future, right?

138
00:06:32,040 --> 00:06:34,380
It eliminates human error,

139
00:06:34,380 --> 00:06:37,740
it takes these repetitive
tasks away from humans,

140
00:06:37,740 --> 00:06:39,090
it's more efficient,

141
00:06:39,090 --> 00:06:41,370
and it allows human beings to really focus

142
00:06:41,370 --> 00:06:44,343
on the tasks that truly
need human intervention.

143
00:06:45,660 --> 00:06:48,660
The orchestration is the
integration of disparate tools

144
00:06:48,660 --> 00:06:51,240
and platforms, often
using bi-directional APIs

145
00:06:51,240 --> 00:06:53,310
or application programming interfaces

146
00:06:53,310 --> 00:06:55,050
for an automated response.

147
00:06:55,050 --> 00:06:58,170
And we first started
talking about automation

148
00:06:58,170 --> 00:07:00,370
way back when we were
talking about logging.

149
00:07:01,230 --> 00:07:04,110
Now there's different
types of orchestration.

150
00:07:04,110 --> 00:07:07,410
Network orchestration is the
automation and coordination

151
00:07:07,410 --> 00:07:10,470
of networking tasks like
configuration management

152
00:07:10,470 --> 00:07:14,040
and optimization of network
services and devices.

153
00:07:14,040 --> 00:07:16,710
And actually network
orchestration is often used

154
00:07:16,710 --> 00:07:19,233
in SDN or our software-defined networking.

155
00:07:20,400 --> 00:07:23,220
Now, one of my favorite tools
is security orchestration

156
00:07:23,220 --> 00:07:25,470
automation and response known as SOAR.

157
00:07:25,470 --> 00:07:27,210
And we mentioned this earlier.

158
00:07:27,210 --> 00:07:30,570
SOAR is and automation tool
that reduces response time,

159
00:07:30,570 --> 00:07:34,440
improves consistency, and
amplifies the productivity

160
00:07:34,440 --> 00:07:36,540
of incident response teams.

161
00:07:36,540 --> 00:07:38,640
So what we do in SOAR
is we actually create

162
00:07:38,640 --> 00:07:42,720
these automated digital workflow
incident response playbooks

163
00:07:42,720 --> 00:07:44,096
that allows the organization to define

164
00:07:44,096 --> 00:07:47,610
the incident analysis
and response procedures.

165
00:07:47,610 --> 00:07:50,970
Again, those all happen in this
automated digital workflow.

166
00:07:50,970 --> 00:07:52,470
So let me give you an example.

167
00:07:53,820 --> 00:07:56,610
Let's say a phishing
attack is detected, right?

168
00:07:56,610 --> 00:07:59,580
Remember, SOAR is gonna have
orchestration and automation.

169
00:07:59,580 --> 00:08:02,160
So here are all the
things that can happen.

170
00:08:02,160 --> 00:08:05,253
That the email headers,
content and attachments,

171
00:08:06,180 --> 00:08:07,932
for perhaps that phishing attack

172
00:08:07,932 --> 00:08:10,020
or whoever the user has been attacked

173
00:08:10,020 --> 00:08:12,180
are analyzed for suspicious content.

174
00:08:12,180 --> 00:08:15,120
So we can use product A to do that.

175
00:08:15,120 --> 00:08:17,640
Then the links and the attachments, right,

176
00:08:17,640 --> 00:08:20,279
in those phishing emails
are detonated in a sandbox.

177
00:08:20,279 --> 00:08:23,070
We use product B to do that.

178
00:08:23,070 --> 00:08:26,340
Then the IP addresses and
connections are analyzed,

179
00:08:26,340 --> 00:08:29,280
maybe using a third product to do that.

180
00:08:29,280 --> 00:08:32,340
Then the suspicious IP
addresses are blocked.

181
00:08:32,340 --> 00:08:34,410
That's a good thing to do at the firewall.

182
00:08:34,410 --> 00:08:37,923
Maybe using yet another
product or script to do that.

183
00:08:38,940 --> 00:08:41,460
Then other user mailboxes
are analyzed to see

184
00:08:41,460 --> 00:08:42,917
if they've received similar emails,

185
00:08:42,917 --> 00:08:45,450
perhaps using yet another product.

186
00:08:45,450 --> 00:08:49,110
And lastly, affected users
are automatically notified

187
00:08:49,110 --> 00:08:51,570
and provided guidance, again perhaps using

188
00:08:51,570 --> 00:08:53,520
yet one more product.

189
00:08:53,520 --> 00:08:55,620
So this is a workflow.

190
00:08:55,620 --> 00:08:58,170
We can make it a digital workflow

191
00:08:58,170 --> 00:08:59,850
and if we have orchestration,

192
00:08:59,850 --> 00:09:02,940
we can pull in all of
these disparate tools

193
00:09:02,940 --> 00:09:06,450
to be able to accomplish
everything that's in this list.

194
00:09:06,450 --> 00:09:10,230
And all of this could be
done in an automated fashion

195
00:09:10,230 --> 00:09:12,060
instead of a human being having to go

196
00:09:12,060 --> 00:09:15,030
through sort of the drudgery
of doing a lot of these things.

197
00:09:15,030 --> 00:09:16,860
The human being can really do things

198
00:09:16,860 --> 00:09:18,840
that require human intervention.

199
00:09:18,840 --> 00:09:21,393
So that's an example of
a SOAR response playbook.

200
00:09:22,470 --> 00:09:25,080
And that my friends, brings us
to a three-second challenge.

201
00:09:25,080 --> 00:09:26,760
Five challenge questions,
three seconds each.

202
00:09:26,760 --> 00:09:28,170
You know how to do it.

203
00:09:28,170 --> 00:09:29,700
Open source language that is favored

204
00:09:29,700 --> 00:09:32,610
by both security practitioners and hackers

205
00:09:32,610 --> 00:09:35,550
for ease of use and extensive library.

206
00:09:35,550 --> 00:09:37,053
One, two, three.

207
00:09:38,070 --> 00:09:39,090
That's Python.

208
00:09:39,090 --> 00:09:40,350
And I really suggest

209
00:09:40,350 --> 00:09:43,926
that you, at least learn
the basics of Python.

210
00:09:43,926 --> 00:09:48,420
Number two, a Linux shell
command line interface.

211
00:09:48,420 --> 00:09:49,953
One, two, three.

212
00:09:51,240 --> 00:09:52,260
That's Bash.

213
00:09:52,260 --> 00:09:54,870
You know, and Linux is used
so often in security as well.

214
00:09:54,870 --> 00:09:57,900
A lot of our appliances
are Linux-based appliances.

215
00:09:57,900 --> 00:10:01,080
So having again, at least
a rudimentary understanding

216
00:10:01,080 --> 00:10:04,683
of Linux will do well for
you in the security area.

217
00:10:06,748 --> 00:10:08,671
Number three, the integration

218
00:10:08,671 --> 00:10:13,320
of disparate tools and platforms
for an automated response.

219
00:10:13,320 --> 00:10:15,360
One, two, three.

220
00:10:15,360 --> 00:10:16,953
That's our orchestration.

221
00:10:18,000 --> 00:10:21,000
Number four, the ability
to execute a sequence

222
00:10:21,000 --> 00:10:23,313
of tasks without human intervention.

223
00:10:24,330 --> 00:10:26,220
One, two, three.

224
00:10:26,220 --> 00:10:27,930
That's our automation.

225
00:10:27,930 --> 00:10:30,000
And lastly, number five.

226
00:10:30,000 --> 00:10:33,873
The automation and coordination
of networking tasks.

227
00:10:34,740 --> 00:10:37,560
One, two, three.

228
00:10:37,560 --> 00:10:40,503
I'm gonna refer to that
as network orchestration.

229
00:10:42,180 --> 00:10:44,007
So that brings us to a security-in-action.

230
00:10:44,007 --> 00:10:46,470
And this one's about automation.

231
00:10:46,470 --> 00:10:48,054
Now, your organization is very focused

232
00:10:48,054 --> 00:10:51,090
on identifying cost efficiencies.

233
00:10:51,090 --> 00:10:52,830
So you suggested that the IT

234
00:10:52,830 --> 00:10:56,970
and security teams investigate
ways to automate tasks.

235
00:10:56,970 --> 00:11:00,330
But the initial feedback
or pushback was a lot

236
00:11:00,330 --> 00:11:04,230
of concern about the cost of
automation-related software

237
00:11:04,230 --> 00:11:08,430
hardware integration, testing,
and ongoing maintenance.

238
00:11:08,430 --> 00:11:12,120
And the next step is gonna
be a cost-benefit analysis.

239
00:11:12,120 --> 00:11:16,200
So what are some of the financial
benefits to be considered?

240
00:11:16,200 --> 00:11:17,910
So a quick recap.

241
00:11:17,910 --> 00:11:19,397
You know, we're really
worried about cost right now.

242
00:11:19,397 --> 00:11:21,364
We're really focused on cost.

243
00:11:21,364 --> 00:11:22,447
So we're saying,

244
00:11:22,447 --> 00:11:26,640
"Well, how about if we
automate some of the tasks?"

245
00:11:26,640 --> 00:11:29,017
But you know, the bean
counters are saying,

246
00:11:29,017 --> 00:11:32,280
"Well, what about the cost of
automation-related software

247
00:11:32,280 --> 00:11:33,728
and hardware and integration

248
00:11:33,728 --> 00:11:36,780
and training and ongoing maintenance?"

249
00:11:36,780 --> 00:11:40,350
Now the next step is a
cost-benefit analysis.

250
00:11:40,350 --> 00:11:44,010
What are some of the financial
benefits to be considered?

251
00:11:44,010 --> 00:11:47,190
So we've talked a lot about
the operational benefits.

252
00:11:47,190 --> 00:11:50,100
Now I want us to focus on
the financial benefits.

253
00:11:50,100 --> 00:11:51,570
So go ahead and put me on pause,

254
00:11:51,570 --> 00:11:54,090
jot down some notes if you
can, on financial benefits,

255
00:11:54,090 --> 00:11:56,440
and then come on back
and we'll do it together.

256
00:11:58,079 --> 00:12:01,253
While automation has
several financial benefits.

257
00:12:01,253 --> 00:12:04,440
Automation can reduce operational cost

258
00:12:04,440 --> 00:12:06,210
by eliminating or reducing the need

259
00:12:06,210 --> 00:12:10,383
for human intervention in
routine repetitive tasks.

260
00:12:11,550 --> 00:12:15,150
Now, automated systems can
often perform tasks more quickly

261
00:12:15,150 --> 00:12:18,633
and accurately than people, so
we have greater productivity.

262
00:12:19,890 --> 00:12:21,300
Now, automated monitoring

263
00:12:21,300 --> 00:12:25,350
and maintenance can reduce
system downtime by identifying

264
00:12:25,350 --> 00:12:28,380
and addressing issues more
quickly than manual methods.

265
00:12:28,380 --> 00:12:31,200
And we know downtime is very costly.

266
00:12:31,200 --> 00:12:34,800
And lastly, automation
can ensure consistency

267
00:12:34,800 --> 00:12:37,530
and reduce errors, which
would ultimately lead

268
00:12:37,530 --> 00:12:40,260
to improved quality of
products and services

269
00:12:40,260 --> 00:12:42,900
which could potentially increase sales.

270
00:12:42,900 --> 00:12:45,270
So we can reduce operational costs,

271
00:12:45,270 --> 00:12:48,870
have greater productivity,
reduce system downtime,

272
00:12:48,870 --> 00:12:51,360
and potentially increase sales.

273
00:12:51,360 --> 00:12:55,500
Those are all positive marks
on those financial statements.

274
00:12:55,500 --> 00:12:58,140
Being able to understand
this and explain this,

275
00:12:58,140 --> 00:13:00,750
that my friends, is
definitely security in action.

276
00:13:00,750 --> 00:13:01,860
There's your word cloud.

277
00:13:01,860 --> 00:13:04,320
Make sure you're familiar
with all these terms.

278
00:13:04,320 --> 00:13:05,585
It was just a really short lesson

279
00:13:05,585 --> 00:13:09,423
but we're gonna move over
to a five-question quiz.