The very common type of web attack today is credential stuffing. The attackers take stolen passwords from data breaches and use tools to automatically log in to every matching account on other websites to take over those accounts to steal money or the or data. Cybercrime has become a business, and for any growing business, it is all about scale and efficiency. Credential stuffing is only a viable attack because of the large-scale automation that technology makes possible.
To counter these kinds of attacks cybersecurity professionals need to get adapted to and focus on the automation and orchestration of security event management and incident response. The reasons for driving automation can be:
- Nonviability or difficulty in retaining skilled security resources
- The complexity of current IT infrastructure, the volume of security tools and technologies, and security alerts generated per day
- Number, type, and complexity of the attacks, attackers using automatic tools for speed and success of attacks
- It is difficult for humans to perceive, visualize, calculate, and understand the interconnections between different security logs and alerts to identify stealthy attacks
“There are risks and costs to a program of action — but they are far less than the long range cost of comfortable inaction.” John F. Kennedy, 35th President of the United States
What is Security Operations Automation?
Security automation is the automatic execution of security operations tasks without human intervention. These are security tasks involved in detecting, analyzing, preventing, or remediating cyber-attacks and contributes to the overall organization’s security posture and plays a proactive role in future security strategies.
Security automation streamlines a series of repetitive, manual tasks into cohesive and automated workflows. To make security operations more efficient and less prone to human errors. This will help make better and faster decisions to improve organizations security posture
Automation Best Practices
- Start with low-hanging fruits – Automation requires how security operations are getting performed, processes, procedures, and workflows. This also requires careful planning and assessment of daily operational tasks, workflows, etc. Also, identification of time-consuming repetitive tasks. Instead of going big bang on automation which requires a heavy budget and takes time to show results. Start with automating tasks that are simple yet time-consuming. This will show the automation results faster than the big bang approach
The automation maturity model and automation journey, Copyright Microsoft Corporation
The above picture depicts the security automation journey and how it improves the effectiveness of the security operations team once you start associating IOC with the assets and prioritize the alerts based on the asset attribution and not the global threat priority.
- Know the task those need accuracy but they are repetitive and hence prone to human error – The task those need eyeball on glass makes analyst dull and they may skip the alert or abnormal behavior signals or the tasks that need the persistence to make sure the entire IT estate is covered following are list example tasks that can be automated :
- Security monitoring
- Alert prioritization
- Incident response
- Alert escalation
- Identity and access management
- Patch implementation
- Vulnerability assessment
- Automation Training – Provide the proper training basic and advanced level on the automation tool to your security team so they can configure, customize the standard workflows available in the tool as per your organization requirements as well as define additional workflows as needed
- Automation is not overnight work, needs time to stabilize in your organization – Once the workflows are configured tested, and migrated to production there are chances that they need to alter, fine-tune or new workflows need to be added and hence for initial six months at least one automation tools expert should be part of the security operations team.
- Automation will not replace security experts, they need to be there – You can automate repetitive tasks but everchanging security threats and attack type need human intervention to qualify the incident as well as complex incidents and issues which requires deep thinking, advance problem solving and making decision confidently needs security expert to use their intelligence, expertise, and experience.
Advantages of Automation
- Reduced incident response and resolution time – The number of alerts analyzed by security is ever-increasing, threat landscape evolves constantly and this makes the security team overwhelmed and starts missing on the false positive and false negative threats it also reduces the efficiency over time. Automating the process of detecting, investigating, and escalating security alerts can make the security team free to concentrate on responding to real threats.
- Decreases the possibility of human error – The human mind cannot concentrate on the repetitive and mundane task and hence humans are prone to make some errors, this may result in identifying Indicator Of Compromise (IOC) at the early stages of attack hence using automation and removing human involvement in at least one area, can reduce the chances of error as the same rules and procedures are followed every time
- Make better and faster decisions to improve organizations’ security posture – Along with the alert details, the automation system can provide additional information to prioritize, further analysis, and mitigation strategies. By identifying and differentiating between opportunistic scans and other benign sources of security alerts, the security team can reduce time to make decisions to resolve the issue faster.
- Scares security skilled resources can be utilized for making strategic work – Since the mundane, routine tasks will be managed by the automation, the security team can spend time on assessing the security posture, tools effectiveness, contributing to make security awareness program effective, participate in future business requirements and provide inputs on how security can be added as a part of the design. This will help businesses to get new services rolling out a faster and secure way.
- To boost job satisfaction and talent retention by utilizing people’s potential – To retain scarce skilled security professionals, they need to be provided with the challenges that can make use of their knowledge, intelligence, and potential. The repetitive task of analyzing security events will soon burn them out. The automation will take care of the mundane task to provide an opportunity for security professionals to handle more challenging tasks and feel adding value to being creative. This will in turn provide job satisfaction.
