Automation and orchestration

Automation does repeatable tasks without people; orchestration links automated tasks into workflows. The objective lists use cases, benefits, and the risks of automating too much or too carelessly.

Use cases and benefits

• User provisioning and resource provisioning.
• Guardrails that block insecure configurations automatically.
• Security groups and ticket creation from alerts.
• Escalation when an alert isn't handled in time.
• Enabling or disabling services and access.
• Continuous integration and testing.
• Integrations and APIs between tools.

Benefits: efficiency and time saving, enforcing baselines, standard infrastructure configurations, scaling securely, employee retention (less tedious work), faster reaction time, and acting as a workforce multiplier.

Other considerations

Key terms

Security orchestration, automation, and response (SOAR)

A platform that runs playbooks to automate and coordinate security response across tools.

Playbook

A documented, often automated sequence of steps for responding to a specific type of event.

Guardrails

Automated controls that prevent or correct insecure configurations as they're made.

Workforce multiplier

The effect of automation letting a small team accomplish far more work.

Technical debt

The future cost of maintaining quick or poorly designed solutions.

Single point of failure (automation)

One automated component whose failure stops many dependent processes.

Continuous integration and testing

Automatically building and testing code each time changes are committed.

Automated escalation

Automatically routing an unresolved alert or ticket to the next level after a set time.

Enforcing baselines through automation

Using tools to apply and maintain approved configurations automatically across systems.

Application programming interface (API) integration

Connecting tools through their APIs so they can share data and trigger actions.