安全自动化是连接工具以执行的过程 SecOps无需人工干预即可完成相关任务. 安全人才缺口和威胁的快速扩散之间, 保持领先于攻击者对组织来说是一个挑战, automation can be used to help strengthen your defense 和 response capabilities.
注意不要把这个和 安全业务流程, which is the connective layer between tools to create streamlined workflows. 而不是, automation is the first step security professionals need to take to automatically h和le a single task. 本页详细介绍了安全自动化的基础知识, 包括它是什么, 你为什么需要它, 它对你有什么帮助, 以及它实际的样子.
The concept of automation isn’t new—just take a look at your banking app, 策划新闻提要, 或者当你阅读这些文字时，你的计算机上正在发生备份. Though you likely benefit from automation in a whole range of areas in your personal life, it is also often used alongside orchestration in many security tools today to streamline series of repetitive, 将手工任务转换为内聚的自动化工作流.
安全流程需要一长组任务, 其中许多需要从一个系统跳到另一个系统来收集英特尔. This lengthy process can take hours (if not days) to complete, depending on the incident. 然而, 使用安全自动化和编排, 你的每一个工具都是相连的, 意味着指定的任务可以自动完成. This removes a majority of the manual 努力 so your team can focus on bigger threats 和 more proactive security measures.
自动化涵盖了安全的各个方面. On the defensive side, it covers prevention, detection, response, remediation. 在进攻方面, red teams 和 attackers can utilize automation to perform vulnerability assessments or gain a leg up on their targets. 安全监测、 入侵检测系统, 管理检测和响应 services all utilize a form of security automation to detect anomalies 和 aggregate data.
如今的安全团队已经不堪重负, they need solid solutions to help them tackle the complex threat l和scape. 安全自动化工具有助于解决以下一些常见问题:
优秀的安全人才难能可贵, 当你找到它的时候, 你想优化你最有才华的员工花时间做的事情. Employees will feel more engaged if they contribute more meaningfully 和 strategically to the organization 和 feel challenged. Automating rote tasks 如 sifting through thous和s of alerts means they can shift their attention toward more strategic, 有趣的, 有价值的任务, 如 威胁狩猎进行更深入的取证和战略规划.
人们可能擅长分析和批判性思维, but can be error-prone when it comes to manually processing large volumes of data 和 making quick, 准确的决定. This is especially true if you have many different security systems that teams need to jump between in order to detect, 分析, 对突发事件做出反应. 当 事件响应 时间慢慢地停了下来, 攻击者占了上风, 把公司的声誉和福利置于危险之中.
These days, teams have more threats to deal with, endpoints to consider, tools that beep. If alerts have become the norm, they could overwhelm your team 和 lead to missed intrusions. You can fully optimize your resources by streamlining the alerting process with security automation. 如果调查, 升级, 威胁的响应过程是自动化的, fewer alerts will come your way—和 these will be the ones you need to take seriously.
Disparate systems that don’t talk to each other or present data in an easy-to-digest format make it difficult to investigate incidents as quickly as possible. Automating routine investigatory tasks means you can 应用 human analysis where it matters 和 not have to dig through logs to pinpoint minute details.
孤立的系统使得很难获得数据的全貌, 优先级的任务, 在团队之间共享信息, 快速访问数据. 使用自动化和编排, you can consolidate your security 努力s into a central hub that gives you a quick look into potential threats 和 boosts the efficiency of your response.
如果你的团队花了很多时间在重复上, 低价值的任务, 您的工具之间缺乏集成, 或者您缺乏开发资源来构建集成和自动化, it could be time to see where security automation 和 orchestration could fit into your business.
As a starting point, consider introducing automation to the five following areas:
尽管安全自动化提供了很多好处, 如果你不习惯把所有事情自动化，也没关系. Human insight is needed when you have to piece together conclusions 和 make a rational judgment call. You may also want to avoid automation for tasks that are highly sensitive or require reason beyond what a machine can correlate.
例如, orchestration 和 automation can h和le the process of collecting password failure data 和 alerts from security systems, but a human should decide whether the password failure attempts are from a brute-force attack or someone who forgot their password. He or she should also react accordingly by either blocking the IP or helping the user.
Automation can also eliminate the tedious work of flagging potential phishing emails 和 triggering a response, but this should only occur after an actual person confirms the authenticity or inauthenticity of the email.
Security automation can alleviate many of today’s biggest security issues 和 offer your team operational efficiencies that can benefit you now 和 in the long run.