02
Standardizing
and
Streamlining
Security
In this chapter you will learn:
■ Streamlining and standardizing security operations
■ Integrating security technologies and tools
■ The role of automation technologies in modern security
operations
■ Best practices for employing orchestration technologies
■ Best practices for building automation workflows and
playbooks
2.1 Streamlining Security Operations
• Security processes can be tedious and repetitive. Automation helps.
• The goal is not to move the entire security process to full automation but rather to
create the conditions that enable the analyst to focus brainpower on complex
activities.
• Automation, in the context of security operations, refers to the application of
technologies that leverage standards and protocols to perform specific, common
security functions for a fixed period or indefinitely.
• The use of specifications and standards means that troubleshooting becomes more
effective, more accurate, and less costly, while allowing for easy auditing of systems.
Automation and Orchestration
• Orchestration is the step beyond automation that aims to provide an instrumentation
and management layer for systems automation.
• Automation allows a sequence of tasks to be programmed into a tool, such as an API
or a script, and orchestration is a level above automation that provides overall
instrumentation, control, and management for automated processes.
Security Orchestration, Automation, and
Response
• Getting disparate security systems to work nicely together to respond to suspicious
activity is not a trivial task, so a market for security orchestration, automation, and
response (SOAR) tools has emerged to meet this need.
• SOAR tools are “technologies that enable organizations to collect security threats data
and alerts from different sources, where incident analysis and triage can be performed
leveraging a combination of human and machine power to help define, prioritize and
drive standardized incident response activities according to a standard workflow.”
• SOAR tools enable teams to automate frequent tasks within a particular technology as
well as coordinate actions from different systems using repeatable workflows.
Orchestration Playbooks
• Playbooks are workflows that help you visualize and execute processes across your
security footprint in accordance with your orchestration rules.
• They can also referred to as runbooks. All playbooks must have a few key
components:
The first is the initiating condition.
Next are the process steps.
Finally, an end state must be defined for the playbook.
• In some cases, the outcome for one playbook is the initiating activity for another. This
is the concept of chaining, in which multiple playbook actions originate from a single
initiating condition.
2.2 Process Standardization
• Standardizing IT and security processes in the infrastructure is bound to produce both
efficiency and, hopefully, effectiveness. It’s not just a matter of performing a task well;
it’s a matter of making sure it’s the right task in the first place and that it’s producing
quality results that make a difference.
• Standardization ensures that everyone is performing an activity the same way and
that it is formally defined, repeatable, and documented.
• The primary reason for standardizing processes in your security management program
is to ensure that they are both efficient in terms of resource usage, such as time,
money, and materials, and effective in terms of quality results.
• One of the ways that processes can be standardized is through automation.
Identification of Tasks Suitable for
•
Automation
Identifying areas for automation helps to support the efficiency and effectiveness of
security processes and management. Any task that is tedious, time-consuming, or
repetitive is ripe for automation. Critical tasks that require human intervention and
decision-making should be manually performed.
• The criteria an organization may establish to determine if a task, process, or activity
should be included in its automation efforts.:
Simplicity of a task or activity
Time, labor, or other resources spent performing an activity manually
Activities performed in a repetitive manner
Requirements for human decision-making
Need to minimize human interaction with the process for efficiency or to reduce
errors
Integration of disparate technologies or security tools
Minimizing Human Engagement
• One of the primary reasons for automation and orchestration is to minimize the human
factor in security operations.
• The primary reasons for minimizing human intervention in security processes are to
reduce errors, perform tasks more efficiently, and better utilize people for other critical
tasks that require human decision-making or human intervention.
Team Coordination to Manage and
Facilitate
• An organization needs to beAutomation
able to hire the right people who are adequately trained
to perform all tasks, while at the same time efficiently and effectively scheduling their
workload around the priorities of the organization.
• Process automation may eliminate the need for personnel to perform many repetitive
tasks, but you will still need to keep qualified people on staff who can maintain and
develop automation tools as well as understand how to perform the tasks in case
those automated processes fail and require manual intervention.
2.3 Technology and Tool Integration
• Integrating technologies together, which may use widely disparate interfaces,
commands, utilities, data formats, and protocols, can be very difficult at best, and
impossible at worst.
• There are many different techniques for integrating all of these disparate
management tools and utilities, including using data exchange formats and protocols
that are common to different applications.
• Scripting can greatly assist in automating processes and tasks in bridging the gap
between different management utilities.
• You should make every effort possible to leverage common protocols and data formats
used by technologies and tools to assist in automation and orchestration efforts. When
making the decision to purchase and implement new technologies, keep
interoperability and integration with other security technologies in mind.
Scripting
• Commands can be run interactively, meaning that you can type in a command,
execute it, and get results back. However, these commands can also be included in
what is known as a script, which is typically a text file with the commands stored in
the file sequentially, in a specific logical order.
• When the script is executed, the commands contained in the script are automatically
executed one by one, in what is known as a batch.
• Scripting can greatly assist in automating processes and tasks in bridging the gap
between different management utilities.
• Scripts may be written to automatically carry out a series of commands that an
administrator might find tedious to type in one by one.
Application Programming Interface
• APIs are becoming the primary mechanism for both standard user interactions and
systems administration for a number of reasons.
• APIs simplify how systems integrate with each other, because they provide a standard
language with which to communicate while maintaining strong security and control
over the system owner’s data.
• They are constructed to facilitate communications and data exchange between
disparate applications. They will typically use programming languages, data formats,
and protocols common to or supported by each application.
• There are two popular ways to exchange information on the internet. Simple Object
Access Protocol (SOAP). APIs designed with SOAP use Extensible Markup Language
(XML) as the message format and transmit through HTTP or SMTP. The second is
Representational State Transfer (REST).
Application Programming Interface
• A REST API is an application programming interface (API) that conforms to the design
principles of the representational state transfer (REST) architectural style.
• REST interactions are characterized by six principles, also known as architectural
constraints.
Client/server
Stateless
Cacheable
Uniform interface
Layered system
Code on demand
Webhooks
• Webhooks are simple messages and data that are transferred back and forth between
applications.
• These messages are usually automated on-demand as applications request or send
data to and from each other.
• Webhooks can also be used to send instructions back and forth between applications
so that, in a truly automated and properly orchestrated environment, the user only has
to control various applications from a single interface.
• APIs are most often triggered manually through some user interaction, and webhooks
are almost always automatic.
• Webhooks are also much smaller pieces of code and are less complex than APIs.
Plug-Ins
• A plug-in is a piece of code developed to provide additional functionality or enhanced
functionality to an application.
• Plug-ins are just smaller pieces of code written to be compatible with a larger
application to provide additional functionality.
• A good example in the security tool realm is Nessus, the vulnerability scanner.
2.4 Orchestrating Threat Intelligence Data
• Putting new threat intelligence into operation is often a manual and time-consuming
process.
• These activities, which include searching for new indicators across various systems,
are especially well-suited for automation.
• Once the threat data is analyzed, analysts can share threat intelligence products
automatically to response teams and lead the enforcement of new rules across the
entire network.
• Improvements such as changes to firewall rules can often be managed by the team’s
SIEM and SOAR platforms.
Data Enrichment
• Investigation into the source and meaning behind observables is a core skill of any
detection analyst, incident responder, threat hunter, or threat intelligence analyst.
• Enrichments are the actions that lead to additional insights into data, and they involve
a set of tasks that can be a draw on resources.
• We can make it easier for analysts to initiate an enrichment request means more time
for them to focus on really challenging tasks.
• Enrichment may even occur as the initial data is delivered, meaning that the analyst
sees the original data coupled with useful context to make a far more informed
decision.
Single Pane of Glass
• This concept essentially means that the various data feeds and sources of security
information that flow into an organization should be parsed, correlated, and analyzed
to a certain degree before the user even sees them.
• Single pane of glass (SPOG) refers to a dashboard or platform that provides
centralized, enterprise-wide visibility into various sources of information and data to
create a comprehensive, single source of truth in an organization.
Use of
Automation
Protocols and
Standards
The concept of SOAR is the
overall integration and
orchestration of disparate
security tools and data under
one central management
interface. Automation
protocols and standards, such
as SCAP simply help facilitate
an organization’s
implementation of SOAR.
Security Content Automation Protocol
• SCAP uses specific standards for exchanging security data, such as the results of the
assessment and reporting of vulnerabilities in the information systems of an
organization, for instance.
• SCAP incorporates about a dozen different components that standardize everything
from the asset reporting format (ARF) to Common Vulnerabilities and Exposures (CVE),
to the Common Vulnerability Scoring System (CVSS).
• SCAP leverages baselines developed by NIST and its partners that define minimum
standards for security management.