Technology and tools are constantly evolving.
Perhaps the fastest in the realm of cybersecurity.
We have to be vigilant to stay on top of new threats and attacks, and be sure to keep our tools up
to date.
This episode gives a high level overview of scripting APIs, webhooks, and of course, plugins.
And the last episode we talked about utilizing automation across our different organizational environment
to enhance our store environment.
And this episode we're going to go over specific technology and tools that we could utilize in that
sworn environment.
Tools and technology are ever evolving, and perhaps the most the fastest growing within the cybersecurity
realm.
We have to be vigilant within our cybersecurity tool framework to understand the different threats,
the threat actors, the threat vectors, and the attacks that they may be utilizing on an up to date
basis.
Each company or organization that you work with within your cyber career has a list of different tools
and technologies that you may utilize.
These come in the form of scripting APIs, webhooks or plugins, and we're going to tackle each one
of these on an individual basis.
Scripting offers the benefits for an organization and individuals alike, because it provides us an
automated process in order to remove that human interaction.
We gave in our last episode a design of how scripting can be utilized in the entire network by configuring
specific radios associated with a site, and then again with the switch to provide us a streamlined
effort and remove not only redundancy, but remove, uh, specific configuration requirements within
each automated process.
Uh, scripting really provides an automated, efficient process that's standardized within your individual
environment.
It's important to note within CSA that you don't need to know how to script.
You just need to know what scripting is.
You may see questions specific to, hey, what type of tool may I utilize to automate a tedious or ongoing
procedure that to remove human interaction?
The answer would obviously be something like scripting.
It provides flexibility as well, where I can be flexible in how I use that scripting.
But not just the reuse of the scripting, but flexibility.
As in I can script configuration process for a cellular network, but I can also script a policy or
configuration for a router, or I can script an automated process to look for a specific word or set
of words.
Or I can automate a process to open the door automatically whenever somebody comes to it.
Scripting really provides us an integrated process within our enterprise environment to do low hanging
fruit, or to provide a way to automate something that is very tedious, mind numbing, and low on the
priority tree.
We really don't want to use scripting to create a video game or create a complex environment.
It really should be something that's very cut and dry and standardized across the entire workflow.
Application programming interfaces, or API you most often see this associated with web applications.
It provides a simplified integration platform to where you can go through a program or a web application
and actually interact with it.
You see this usually on something like Nessus, where it provides this, that GUI interface, but on
a web interface, it's simplified, it's efficient, it doesn't require a lot of expertise, and it
can be scalable, meaning that you can change the way it looks.
You can move things around, maybe inject new information into the interface that you're utilizing.
I've seen this in different platforms, where we have a website where I can go through and look at different
features across my network enterprise environment, and then I can set it up appropriately.
You can see this in EDR solutions.
You can see it in different programs.
Most notably, I've seen it in something like Nessus, where they have the board that shows you how
many vulnerabilities are associated with your network, and you can maneuver the different screens around
as you see fit.
Sam really has a great API where the GUI interface is really customizable to you, the user, depending
on what you want to look at specifically, and that can change from user to user by providing a very
flexible platform in order to interact with that web program or that web application.
Webhooks provide us real time communication, is scalable, efficient, flexible, and has reduced latency.
Now I just read off all those words, so you're probably thinking to yourself, what in the world is
a webhook?
Webhooks provide us a subset of API where it provides us a simpler and more automated approach compared
to a traditional API.
While APIs require manual triggering through a process, meaning I have to trigger it and go through
and say, hey, this comes into play, and if this happens, then do this.
A webhook really provides us a format where I can literally drag and drop it, and it's typically straightforward
in that manner, right?
They commonly take form of URLs provided by receiving application and allow other applications to send
and receive data.
Meaning I can pull different data from different applications to associate my web page.
So I want you to think about if I've got a CRM solution where it provides me traffic monitoring on one
window, maybe on my antivirus program is working at a specific client that I want to see.
Or maybe I've got a server that's using an antivirus program as a client based firewall, and maybe
I want to grab all of that into a single screen.
I can pull tidbits of different information across those three different programs to hook into my singular
web page.
This is a web hook and provides me a different flexibility depending on the different applications that
I want to utilize or hook into it.
Plugins provide us an enhanced functionality through the use of the web browser.
They're usually flexible and scalable, meaning that I can grab them depending on what I want them to
do.
I can create a plugin from an antivirus program such as Bitdefender or Norton, even McAfee, so that
if I visit a website and maybe that website isn't actually 100% secure, or maybe it's an HTTP instead
of Https, my my antivirus program will say, hey, this is an unsecured website, are you sure you
want to utilize it?
This is an example of a plugin from a cyber perspective, but it could go into more detail if you're
downloading something, maybe your plugin tracks it and goes wait a second before it even gets on the
computer system.
Your browser is going, wait, that's a known problem.
Don't download this and will actually attempt to block it.
That's a form of a plugin interlinked with your web browser to provide additional security, but it
can't be more than that.
We can see flexibility and scalability where the plugin can provide enhanced features beyond just simple
browsing.
We can see enhanced features such as determining where your programs are associated from a download
page, or provide us a different complexities within the web browser itself.
You'll hear me see browser quite often, because plugins and browsers almost go hand in hand depending
on what you're trying to utilize.
They're very efficient and cost effective measures from a cyber perspective, where if I've got a bunch
of clients and they're all using the Microsoft browser, that edge browser, I may utilize my antivirus
plugin across all clients, across my entire enterprise environment to provide that additional security
feature.
Single pane of glass, or Spog, is a security operations technology that is relatively new.
Within this concept, we take all the different aspects of our security operations, and then we can
provide it into an easy to read, easy to use concept that is presented to the user.
So you may see Spogs utilize where they've got SIM information, antivirus network information.
Maybe my, uh, intrusion prevention system is providing me information and is providing this window
or a glimpse across my entire network enterprise environment that shows me exactly what's going on at
different specific points.
Now, Spock or Spock is often utilized within a security environment to provide me a heads up display
of the or a snapshot of what's going on within my enterprise environment, making it easier to read
and kind of hits all the high points.
What we really want to try to avoid within Spock environment, or a single pane of glass environment
is where we've got too much information, or we have information that really isn't that useful.
Maybe I want to know how much traffic is going outside my environment by providing both a baseline of
the hour by hour, but also the real time environment where it's providing me a elliptical wave across
my screen in one corner that says I'm doing normal traffic capacity for the day within my environment.
This would be useful information.
What wouldn't be useful information is what one client across my entire enterprise environment, made
up of 10,000 different clients, is doing.
That's not really useful information for a security analyst.
So the single pane of glass concept really takes in those different security related mechanisms and
provide it for an easy to read format.
We want to avoid providing an environment that is too small to read by having too many windows, but
we also want to avoid having windows that are so jam packed full of information that it's going to be
over cumbersome to the actual user.
Single pane of glass is a great concept when put in correctly, where we've got 4 to 6 different windows
associated with our environment, but I would really avoid going over eight if at all.
Practical.
Throughout this episode, we've identified scripting and APIs We've also discovered different webhooks
and plugins and how they're essential for keeping our systems system secure.
We've identified what single pane of glass is and how it's utilized in our security environment, and
why it could increase our efficiency and outlook across our enterprise environment.
For security perspective.
You really want to keep in mind for Cisa what we're looking at, the high level picture within an enterprise
environment, you're really stuck between that technical rule versus that management rule and how to
identify the best practice for doing your job as an analyst, what's going to streamline what we're
trying to achieve and make it easiest for not only you, but other analysts to utilize the technology
that we're providing?
Remember, you're not going to get questions about specific technologies in scripting, i.e., we're
not going to ask you to perform a script, but we are going to ask you questions like if you utilize
scripting, what would it be the best procedure for this perspective environment?
Expect a lot of scenario based questions that really kind of identify the technology that you would
utilize in the most efficient or best pattern to utilize that technology for the specific scenario.