Streamlining processes have become much easier over the years, as tools and software have been developed
to automate tedious and sometimes detailed procedures.
In this episode, we're going to uncover saw as well as other automated processes and tasks, but we're
also going to discuss the human element.
Humans make up nearly 93% of all incidents that you're going to see within your environment, within
an organization.
This includes things like clicking on a phishing link or ignoring policies or procedures you need to
understand as a cybersecurity analyst, not only the technical perspective, but also the human perspective
and how to get humans and our employees to do what they're supposed to be doing.
And if they're not, to uncover those risks and identify how to best and most efficiently deal with
those problems that you see.
As an analyst within your organization, security, orchestration, automation and response, or Saw
is the idea of taking automation to a new level.
We wanted to interact or collaborate with other tools and provide different leverages that we can then
utilize in an automated procedure.
In other words, what we're really saying is that this incident occurs.
And how does this technology automatically deal with that incident?
Now, this can be in the most fundamental level as a malware comes across on a client.
And then the antivirus comes in and sees the malware and it stops it from going forward.
Any software that's intruded upon it gets rid of it eradicates, and then puts into isolation on your
desktop.
It can on a more network level.
A lot of times what we're seeing is this traffic came into play.
It looks suspicious.
So it goes through the IPS, the IPS flags it.
We then prevent it from moving forward.
That's an automated process that stops malware from intruding upon our network.
It also provides us alerts, which then you as an analyst can then inspect that alert and figure out
what's going on.
We see saws interacting with different technologies, such as an endpoint detection and response or
an EDR solution.
We see it encompassing different scripts where we automate different processes that seem tedious, and
we create a script that goes through and automatically does different perspectives of that process that
would otherwise take a human being.
Hours within telecommunications.
I remember where we were setting up different radios for cellular science, and those each radio had
to go through and be configured specifically not only for the site, but then the site had to be configured
with the backhaul in order to function correctly, and it took about an hour to go through and configure
each radio to interact with the with the actual cell site, and then the cell site with the backhaul
site.
And that kind of really kind of took a long time to facilitate.
However, if we created a script, we literally had to only go in there and say, this is the radio
number, this is the site ID, and this is the switch that it's operating on.
We run the script, and since everything was automated and went through and did everything in about
ten minutes.
Now, it may not seem like a lot on a one for one basis, and you're going through and going, oh yeah,
well, you know, it was took ten minutes to an hour and a half task manually, but it's more than that.
Even if I was going to take a task that took 15 minutes and I automated it and it took ten minutes,
or let's even take it to reverse and say it took 17 minutes for the automated process.
But if I did it myself manually, it would only take 15.
The problem isn't the speed, the problem is the detailed associated with it.
I want you to imagine yourself sitting in a desk and your job all day long for eight hours a day, five
days a week, 52 weeks a year is the same process of typing in the same words, with minor changes to
it day in and day out.
Not only is that tedious and mind numbing, but you're bound to make mistakes, and it's those mistakes
that that scripting really solves.
If I can go in and change three different numbers inside my script and it automatically goes through
and configures the entire site for me where I can get up, get a cup of coffee, and maybe even do a
different task.
I've not only made that process more efficient, I've made it more accurate, thereby lessening human
error.
But I've also freed you up as a security analyst to do something else while that script is ongoing.
So even if it takes more time and in most cases it doesn't, I have increased my accuracy on that specific
task and provided you, the security analyst, more time to perform other actions, that's really where
Soar comes into play with that orchestration, automation and then response.
Now, I described the actual incident well, not really the incident, but I described a process where
we're configuring an item which is going to remove the human error from that.
But what about the response element?
We talked about IPS.
We talked about an antivirus, but we can go much more detail with that with an EDR solution or with
a SIM solution where it's identifying a specific incident that can be flagged as malware or, uh, A
perceived as a threat within our system and then provided automated response to that.
And that's really where Saw gets its power from.
Automated tasks are usually simple, repetitive.
We want to reduce the time.
I just described an automated task where it was talking about using those cell phones or the radios
within those cell phone towers, to automated a repetitive task that went into play.
When we talk about scripting or we talk about automating any task, we're really kind of removing that
human element as much as possible.
Humans like I said, 93% of all incidents within an organization are from a human element making an
error, usually on accident within an enterprise environment.
And if we can remove that human element as much as possible and make those tedious tasks or those repetitive
tasks come into play with an automated script, we've removed that human element from it.
We've reduced the error rate.
We've also increased our efficiency and our human power, meaning that our labor or our security analysts
can then go do other tasks that cannot be automated, i.e. going through and looking at a specific incident
and making a judgment on that incident of whether or not you need to proceed in a certain viewpoint
where automated tasks or AI or machine learning just isn't capable at this point in time.
Human interaction is usually encompassed with human error.
It also encompassed with efficiency, standardization, and predictability.
I often refer to predictability as my nine year old, who I predict will always click on links that
are flashy, regardless if they're malware induced or not.
We can surmise that we're going to have a certain number of employees within our organization, which
are going to click on links from phishing emails on a repetitive basis, regardless of what we do.
Now, I say regardless, but there are things that we can actually do to reduce that number.
We can provide training.
We can provide formal and informal reminders of, hey, don't do this right.
And so when we talk about interaction within a store environment We're really trying to remove that
human error.
We're not talking about the people that intentionally go out of their way to cause harm to our organization.
We're never going to be able to stop people like that through training or through tools or technology
100%.
But what we can do is stop them from making human errors, i.e. accidentally clicking on a link they
shouldn't have, or being fooled into clicking.
They shouldn't be clicking on that standardized process.
Within that, if we provide a standardized process on how to do a specific task, i.e. to take a router
and configure it a specific way and we go a step by step procedures, we can remove human error if they
follow the process and procedures that we laid out for them.
However, if I can script it in, that's going to remove it 100%.
You have a problem when anytime you introduce change to an environment i.e. I provide a new a new router
for our employees to utilize and I provide a new process which then they must follow.
They're going to revert back to that original process just because we've changed on them.
That's human error.
However, I script that the script is never going to remove from the initial intention that I put forward.
Now, intention is probably the wrong word, but the initial programming that we put forward, they're
going to follow point A, B, C, D, and E.
It doesn't matter if they do it one time or if they do it a million times.
As long as that script says to do it, they're going to do it.
The only human error process comes into play is changing the actual configuration points that we need
to be changed within that process.
Throughout this episode, we've discussed Saw or security, orchestration, automation and response,
and how it interacts with different formats or different tools such as EDR or SEMs, your antivirus
program, or other tools and processes that we put into play.
This is an important part of your daily job and your job function.
You need to understand as a security analyst, not only the tools and techniques that you'll be utilizing,
but the processes and procedures that are inherent upon your job and how it interacts within your organization
as a security analyst.
And Cisa, you're really going to have test questions that relate to specific scenario based store acquisition
within the environment that you're utilizing.
These are going to be broad questions that overarch upon a relative general point of view, meaning
they're not going to go into detail about a specific procedure or policy that may be intrinsic within
your organization, but you should expect to see some things, like if I can automate this process,
what would be the best way to do it?
Or if I have a human interaction, what would be the best way to limit human error within this procedure
or within this technical control?
And obviously using Soar or an automated process would be the correct answer.
Those are the type of questions you should expect to see within the Cisa exam, but you also should
expect to see questions inherent with the human error perspective and how to remove that human error
as much as possible.
Usually, automation and scripting is going to be your go to answer for those types of questions.