Security Automation Simplified

No ratings

Presented at BSidesAustin 2019 by

Incident response is an intense, high stress, high skill job that relies heavily on human judgement. But for reasons that we can't begin to understand, a big part of an incident responder's job seems to be opening numerous browser tabs and copy-pasting bits of text from one system to another. Security automation can look a lot like magic, and many feel a strong temptation to go buy $HOT_SECURITY_ORCHESTRATION_PRODUCT, but it's really not hard to get started automating SecOps with the tools you already have, a few web hooks, and some artisanal Python.In this talk we're going to discuss how to automate some security incident response team (SIRT) operations. We'll give an overview of what a typical SecOps/SIRT infrastructure looks like, how and where automation fits in, and dive into some code. We'll walk through a simple example, with screenshots and code, of automating a SecOps process. We want to show that getting started with security automation doesn't have to be difficult or expensive (though vendors will happily take your money). This is not a "no code required!" approach to automation, but it's practical and easy enough to get started.