Skip to content 
Today’s sharp and swift threat-strewn landscape leaves no space for network or firewall automation to be reactive and isolated. Here are 5 Key elements for a comprehensive security automation
Security has always been a major concern for most organizations. But in the last two or three years, enterprises have witnessed, unfortunately even on a first-hand level, that even a small breach can suffice to wreak significant damage to uptime, resilience, company reputation, and customer experience. The results add to the pain – they range from significant dents in operational expenditures to financial liabilities and even huge legal ramifications that can roll on for decades. On average, it takes an organization more than six months to detect a security breach. Containment, eradication, and the effort of bringing back the network and business back on track are areas that take even longer.
No wonder that most large companies have started taking security extra seriously today. They are injecting a fair share of their budget on monitoring and modernizing their security solutions. But is that enough? Do they really have a strategy in place, or are they just taking actions that are isolated and tactical? A security strategy works only when it is holistic. And proactive! It cannot merely revolve around automating rules and ACLs in firewalls. It should be pervasive, long-sighted, and nimble enough to spot and fix even the remotest or smallest-looking loop-hole well before it rears its sly head. The strategy should be well-spackled and should be built around 3 main principles.
1. Prevent: As the proverb goes – Prevention is better than cure. Taking steps to prevent undesired traffic to enter your network and isolating your network from the external world are steps that are now more crucial than ever. It helps your organization avoid any untoward incidents, and equips you in keeping your network secure.
2. Detect: Constant monitoring of your network at milliseconds’ or even microseconds’ level of granularity is imperative for timely detection of any breaches. The network scope has increased – not just on-premise, but also hybrid multi-cloud, SaaS. Organizations need to detect breaches as quickly as possible and across the network footprint to prevent any substantial loss of data.
3. Eradicate: Fast eradication contains and diminishes the impact of the breach. Appropriate and precise alerting and notification mechanisms will help to pinpoint the issues and aid in rapid resolution.
So how does one achieve this confident and robust stance on security that syncretizes these three frontiers? Consider the five-box check on security.
5 Critical elements of a comprehensive security strategy
A single unified solution
Time is of the utmost essence when dealing with a security mishap or attack of any scale. A right security solution has to handle many aspects.
- An easy, intuitive interface to define policies
- Constant-monitoring to detect security breaches
- Alerts and Reporting-capabilities to notify the administrator on any issue
- Remediation-methodologies for quick resolution of issues
- Ease in conducting post mortem of the security breach to avoid recurrence (Here Audit logs make a big difference)
Most organizations use a multitude of tools to enforce security. For a practical solution, every tool has to communicate with every other tool. That means all tools should have open APIs and SDKs, which is rarely the case. Operating these numerous tools, which are built on their favorite platforms with varied capabilities, is unwieldy. Add the burden of managing usability, and maintenance – and it is suddenly an uphill task that can eat precious time and attention. Network administrators need to spend their valuable seconds analyzing their network and defining policies. They should be doing critical work instead of being trapped in the installation and maintenance of tools.
Also, security people spend a lot of time chasing false-alerts, sifting through access-logs, patching the systems, running scans, and creating painful audit reports for compliance.
An ideal solution should address these tight spots. It should provide a hierarchical and role-based access control to prevent unauthorized changes in devices. In-depth and User-based analytics can also strengthen the teams to understand the problem more effectively and create better policies. Artificial Intelligence (AI) and Machine Learning (ML) further help in predicting future security issues that may develop on-the-move.
Low-code policy designer
An often-overlooked but salient area in security automation, that can suck away time and resources is that of security design. Writing security policies and methods of procedures could be tough. They will usually be extremely-detailed and prone to frequent changes with the detection of new threats, modifications in business policies, or changes in application requirements. Creating and defining policies should be made easy with an intuitive graphical user interface. A complicated interface would not only make it challenging to alter policies but would also lead to the introduction of avoidable definition-errors. Organizations should spend their valuable time on “what” policies to enforce rather than on “how” the policies should be defined.
There should also be adequate version-control on the policy to match the DevOps methodology. And, it should be easy to reuse some of the policies with minimum customization for other segments of the network.
Continuous monitoring and feedback
Network Analytics plays an important role in threat detection and prevention. A sturdy and swift solution should constantly monitor the entire length and breadth of the network. The network devices communicate in a variety of ways – SNMP, SNMP Trap, Syslog, Telemetry. It is essential to monitor all network devices for threat prevention and detection continuously. Devices that are non-compliant to the company’s rules and policies should be immediately flagged and notified to the administrator to take corrective actions. Continuous validation of the expected network state with the current network state will quickly indicate any perceived threat. AI and ML could also be used to predict when a security breach could potentially occur and help admins take necessary precautionary measures. In the end, the more the data that can be collected in a short time, the better will be threat prevention.
Another important aspect is to monitor the recommended OS versions on each of these devices. The solution should continuously detect any older versions and automatically upgrade to the recommended version.
Closed Loop automation framework
Closed loop automation (CLA) is like granite. It can cement the overall security posture in an airtight manner. It only grows stronger with time. There are no nooks or overlooked spots with CLA. Everything is well-covered and strongly-secured. CLA is essential for quick threat prevention and eradication. CLA regularly monitors the status of the collected data with the expected network behavior. CLA enables network teams to react fast and react right.
A change in network state could trigger one of the two actions.
1. Auto-remediate – If the change is small or a pre-defined resolution is available, the CLA could automatically resolve the issue for you. Once done, it may send you an audit report and even allow you to roll-back the changes.
2. Alert & Notify – Not all organizations are comfortable with auto-remediation. Any tool making changes by itself without approval can tend to be a cause for worry. What if the solution misbehaves and brings down the entire network? What if the resolution steps that were earlier defined turn out to be incorrect and stir up a massive outage? In most cases, the CLA framework would alert the administrator on a possible issue, present with resolution steps, and seek his or her approval before it applies the fix.
CLA framework is an integral component to ensure complete, detailed, and end-to-end security automation. CLA analyses the voluminous data collected and provides the following benefits
- Prevents threats by fixing non-compliance in network
- Immediately notifies on a possible threat
- Neutralizes the threat using auto-remediation capabilities
Multi-vendor and multi-entity capability
Security is all about the weakest link in the chain. One small area missed can cost a lot of downtime, chaos, errors, lawsuits, and money. Security automation, when done with the right strategy, encompasses all entities in the network. Security Policies should stitch together all network elements – routers, switches, firewalls, load-balancers, or ticketing/billing solutions like ServiceNow and Jira. All network components have a critical role to play to prevent, detect, and eradicate security threats. The security automation framework, therefore, should have the capability to communicate with these diverse devices using the API of their choice. The framework should have open APIs to be invoked from other network entities.
It is all about taking everything into the security fold. Firewall automation is just one of the many steps in ensuring complete network security. Organizations should plan well in advance and take steps to integrate their entire network and enforce a holistic security policy.
