Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Operations

2/8/2018
10:30 AM
Joshua Goldfarb
Joshua Goldfarb
Commentary
Connect Directly
Twitter
RSS
E-Mail vvv
50%
50%

20 Signs You Need to Introduce Automation into Security Ops

Far too often, organizations approach automation as a solution looking for a problem rather than the other way around.

I've always been a big fan of efficiency. During the period in my career where I built a number of different security operations and incident response programs, I always tried to identify areas where valuable analyst cycles were being spent on time sinks. These time sinks typically involved manual, labor-intensive, often repetitive tasks. If a time sink did not add value to security operations, its value was not worth the time investment, and it could be eliminated. If a time sink was deemed to be essential to security operations, it was an ideal candidate for automation.

Today, talk of automation is everywhere in security. Automation can be a great way to bring about efficiencies, but only if it is done right. Far too often, organizations approach automation as a solution looking for a problem rather than the other way around. How can organizations approach automation intelligently and identify areas that are good candidates for automation? To answer this question, I offer 20 additional questions:

Image Credit: DuMont Television/Rosen Studios. Public domain, via Wikimedia Commons.
Image Credit: DuMont Television/Rosen Studios. Public domain, via Wikimedia Commons.

  1. Does your strategic intelligence come in the PDF format? We all need to understand the risks and threats to our organizations at a strategic level, but combing through pages and pages of free-form text isn't the best way to arrive at something actionable that adds value.
  2. Do you make the rounds of several different security news and information sites each day? A noble effort for sure. But first take time to understand exactly what you are looking for and how to integrate into the security workflow.
  3. Where do you get your intelligence? If you mainly source it from emails and portals that require a manual login, it's time to examine what can be done to automate this activity.
  4. How much time do you spend manually cutting and pasting indicators and other such data each day? 
  5. Do you constantly flip between multiple tools and screens? Sometimes this is unavoidable. But other times, technology can help alleviate the "swivel chair" effect.
  6. Do you find yourself manipulating data in Excel (or another such tool) when vetting, qualifying, and/or investigating alerts? 
  7. How often do you cut and paste queries between tools? This is one of the classic time sinks.
  8. How often do you cut and paste query results into and out of incident tickets? 
  9. Do you need to visit numerous log or data sources to get the visibility you need when investigating an alert? This is probably a good opportunity to think about consolidation.
  10. What do I mean by question 9? Is there a more generalized data source that can subsume the data provided by numerous highly specialized data sources?
  11. Do you find yourself running the same queries over and over again? 
  12. Do you know what is on your network, and how it is expected to communicate? Or do you find yourself needing to identify that manually, time and time again?
  13. When a vulnerability is announced, do you find yourself manually performing a set intersect between the vulnerability announcement, your asset database, endpoint data, log data, and network data?
  14. Do you find yourself repeatedly running manual reports for management and executives? Better to take time to understand what they are looking for and to figure out how to get it to them automatically.
  15. Do you find yourself perpetually renewing that consulting contract? Technology has its limitations, and consultants can certainly help in certain situations. But these should be stopgap measures rather than permanent solutions.
  16. When performing vendor risk assessment, do you find yourself buried under a pile of spreadsheets? 
  17. When customers attempt to assess the risk you as a vendor introduce to them, do you find yourself filling out what seems to be the same spreadsheet over and over again?
  18. Do standards and regulations compel you to sit for days on end with auditors and consultants? Perhaps it's worth thinking about automating the way in which you manage and navigate this process.
  19. When wrapping up an incident investigation, do you have to manually check if systems have been remediated and that the issue has indeed been eradicated?
  20. Do you find yourself manually generating post-incident reports on a continual basis? 

There is certainly no shortage of opportunity to introduce automation into the security operations and incident response workflow. Although a blanket approach to automation is seldom productive, targeting automation to specific manual, labor-intensive, and repetitive processes can introduce large efficiencies into a security organization. If done right, the effort will pay large dividends in time and cost savings.

 

Josh (Twitter: @ananalytical) is an experienced information security leader who works with enterprises to mature and improve their enterprise security programs.  Previously, Josh served as VP, CTO - Emerging Technologies at FireEye and as Chief Security Officer for ... View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Threaded  |  Newest First  |  Oldest First
Navigating Security in the Cloud
Diya Jolly, Chief Product Officer, Okta,  12/4/2019
US Sets $5 Million Bounty For Russian Hacker Behind Zeus Banking Thefts
Jai Vijayan, Contributing Writer,  12/5/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: Our Endpoint Protection system is a little outdated... 
Current Issue
Navigating the Deluge of Security Data
In this Tech Digest, Dark Reading shares the experiences of some top security practitioners as they navigate volumes of security data. We examine some examples of how enterprises can cull this data to find the clues they need.
Flash Poll
Rethinking Enterprise Data Defense
Rethinking Enterprise Data Defense
Frustrated with recurring intrusions and breaches, cybersecurity professionals are questioning some of the industrys conventional wisdom. Heres a look at what theyre thinking about.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-19719
PUBLISHED: 2019-12-11
Tableau Server 10.3 through 2019.4 on Windows and Linux allows XSS via the embeddedAuthRedirect page.
CVE-2019-19720
PUBLISHED: 2019-12-11
Yabasic 2.86.1 has a heap-based buffer overflow in the yylex() function in flex.c via a crafted BASIC source file.
CVE-2019-19707
PUBLISHED: 2019-12-11
On Moxa EDS-G508E, EDS-G512E, and EDS-G516E devices (with firmware through 6.0), denial of service can occur via PROFINET DCE-RPC endpoint discovery packets.
CVE-2019-19708
PUBLISHED: 2019-12-11
The VisualEditor extension through 1.34 for MediaWiki allows XSS via pasted content containing an element with a data-ve-clipboard-key attribute.
CVE-2019-19709
PUBLISHED: 2019-12-11
MediaWiki through 1.33.1 allows attackers to bypass the Title_blacklist protection mechanism by starting with an arbitrary title, establishing a non-resolvable redirect for the associated page, and using redirect=1 in the action API when editing that page.