Automation: Execution of tasks without manual involvement.
Orchestration: Coordination of multiple automated tasks for a specific outcome or workflow.
Security Orchestration, Automation, and Response (SOAR): Primarily used for incident response, can also do threat-hunting. Integrates with SIEM. SOAR goes beyond SIEM by automatically responding to alerts (Orchestration and Automation), not just collecting and analyzing them.
Playbook: Checklist of actions for specific incident responses.
Runbook: Automated versions of playbooks with human interaction points. A Playbook is the process or checklist; the Runbook is the actual automated script or tooling that executes the playbook steps.
Things to Assess:
Repeatable and stable processes are prime candidates for automation/orchestration.
The two key aspects that tend to be automated are:
Benefits: Eliminate any tedious manual tasks, Reduce the likelihood of errors, Provide new employees with a structured, consistent experience.
Areas that can be automated: Creating Documentation Records, Scheduling Training, Provisioning Equipment, Managing Access Rights, Distributing Various Checklists, Collecting Feedback.
User Provisioning: Creation and management of user accounts and access rights to internal systems.
Resource Provisioning: Allocating necessary tools and resources for new employees to perform their jobs.
Security Automation: Involves use of technology to handle repetitive security tasks and maintain consistent defenses.
Guardrails: Automated safety controls to protect against insecure infrastructure configurations.
Security Groups: Cloud-based server firewalls that control incoming and outgoing network traffic.
Service Access Management: Crucial area to prioritize in security automation for risk reduction and operational efficiency.
Managing Permissions: Involves ensuring individuals have correct access level for their designated role.
Use of technology to manage, test, and deploy new applications or features with minimal human intervention.
Continuous Integration (CI): Practice in software development where developers merge code changes frequently into a single place.
Continuous Delivery: Maintains deployable code with automation, but stops short of pushing changes to production automatically (deployment is done manually).
Continuous Deployment: Automates process of deploying code changes form testing to production after completion of the build stage. Rollback capability is crucial for continuous deployment.
Integration: Process of combining different subsystems or components into one comprehensive system to ensure that they function properly together.
Application Programming Interface (API): Set of rules and protocols that are used for building and integrating application software.
Representational State Transfer (REST): Architectural style that uses standard HTTP methods and status code, uniform resource ids, and MIME types. Lets you interact in a stateless manner. Usually uses JSON.
Simple Object Access Protocol (SOAP): Protocol that defines a strict standard with a set structure for the message. Usually in XML. More robust and secure than REST.