Automation and Orchestration

Automation

Automatic execution of tasks without manual involvement

Orchestration

Coordination of the automated tasks for a specific outcome or workflow (multiple automated tasks for a goal)

Security, Orchestration, Automation, Response (SOAR)

Incident response and threat hunting. Automated. Next generation SIEM. Incident response may be Performed immediately to provision resources

Playbook

Checklist of actions for responding and detecting a specific incident

Runbook

Automated versions of playbooks with human interaction points

Complexity

Works best in repetitive tasks, ensuring a better return on investment. Must be considered for automation or orchestration. If it uses numerous complex tasks, orchestrate. If it’s just one repetitive task, automate

Cost

Requires a large upfront initial investment to hire a service provider or a team of developers for implementation

Single points of failure

Identify during automation or orchestration implementation in the network. Use redundancy for backups

Technical debt

Can accumulate if not regularly maintained or updated. Cost and complexity of poorly implemented software needing future adjustments

Ongoing Supportability

Long-term support ability is crucial for adapting automation for evolving technology

Benefits of Automation and Orchestration

Increase efficiency and time savings, enforcing baselines, implementing standard infrastructure configurations, dynamic resource scaling in a secure manner with security compliance, increasing employee retention since automating tasks unlocks job fulfillment by eliminating tedious tasks, decreased reaction times to security incidents and anomalies, being a workforce multiplier that amplifies staff capabilities

Ticket Creation

Involves the automatic generation of tickets when users or customers report issues or requests. First a ticket is submitted from a user, automation tool generates tickets based on predefined criteria. Automation system captures relevant information, the ticket is categorized based on need, tickets are prioritized based on predefined criteria, automation notifications are sent to relevant team

Ticket Escalation

Critical aspect of support ticket management that ensures that complex or high priority issues are addressed promptly and by the appropriate personnel. First, escalation criteria is defined, automation rules for escalation are made, executes predefined actions for escalation, will continuously monitor and track progress, system triggers ticket closure and notify user

User Provisioning

Involves creating and managing user accounts and access rights. Ensures new employees have necessary access to systems, applications, and resources. Process includes information collection, make an account based on given information, assigning roles and access, send notifications, conducting synchronization and updates

Resource Provisioning

Allocating the necessary tool and resources that new employees need to do their job. Determine role, initiate procurement workflows for the equipment, configure resources for the user’s roles, verification process for successful allocation confirmation, audit and track allocated resources for inventory, feedback on resource suitability

Security Automation

Involves use of technology to handle repetitive security tasks and maintain consistent defenses

Guardrails

Automated safety controls to protect against insecure infrastructure configurations. Enforce security policies, monitor infrastructure, and automatically act on security violations

Security Groups

Act as cloud based server firewalls the control incoming and outgoing network traffic. Can be adapted to evolving threats

Service Access Management

A crucial area to prioritize in security automation for real reduction and operational efficiency. Automatic access review, automated restriction of action when needed.

Managing Permissions

Involves ensuring that individuals have the appropriate level corresponding to designated role, use RBAC (Role Based Access Control)

Continuous Integration (CI)

Practice in software development where developers merge code changes frequently in one place. Automated tests follow code integration for efficiency

Release

Process of finalizing and preparing new software or updates

Deployment

Involves automated process of software releases to users

Continuous Delivery

Maintains deployable code with automation. Part of the release process, only automates deployment up to a certain stage, NOT a full deployment to live

Continuous Deployment

Automates the process of deploying code changes from testing to production after completion of the build stage

Integration

Combining subsystems or components into a single, functioning system

API (Application Programming Interface)

Set of rules and protocols used for building and integrating application software

REST (Representational State Transfer)

Architectural style that uses standard HTTP methods, status codes, URIs, and MIME types for interactions

SOAP (Simple Object Access Protocol)

More robust. has a structured message format in XML. Known for robustness, additional security features, and transaction compliance. Suitable for enterprise-level web services with complex transactions and regulatory compliance requirements

CURL

Tool to transfer data to and form a server using one of the supported protocols