CoreQ Academy3.6 Given a scenario, use automation to secure the enterprise.
Automation enforces security at scale: scripts, IaC, event triggers, SOAR playbooks and standards like SCAP that make checks machine-readable.
Scripting and scheduling
- Scripting
- Automating repetitive security tasks.
- PowerShell
- Windows and Microsoft cloud automation.
- Bash
- Linux and Unix automation.
- Python
- Cross-platform automation and integrations.
- Cron/scheduled tasks
- Running jobs on a schedule.
- Event-based triggers
- Running automation when events occur, e.g. a new public bucket triggers remediation.
Infrastructure and configuration
- Infrastructure as code (IaC)
- Declarative, reviewable infrastructure.
- Configuration files
- Machine-readable settings.
- Yet Another Markup Language (YAML)
- Indentation-based configuration format.
- Extensible Markup Language (XML)
- Tag-based format used by SAML, SCAP and many enterprise tools.
- JavaScript Object Notation (JSON)
- Key-value format used by APIs and cloud policies.
- Tom's Obvious, Minimal Language (TOML)
- Simple configuration format with sections and key-value pairs.
APIs and AI
- Cloud APIs/software development kits (SDKs)
- Programmatic control of cloud resources for automated checks and fixes.
- Web hooks
- HTTP callbacks that notify other systems of events in real time.
- Generative AI
- AI assistance in automation work.
- Code assist
- AI suggestions for scripts and detections; review before use.
- Documentation
- AI-drafted runbooks and documentation for human review.
Response automation
- Containerization
- Packaging automation and tools consistently.
- Automated patching
- Scheduled, tested patch deployment with rollback.
- Auto-containment
- Automatically isolating hosts or disabling accounts on high-confidence detections.
- Security orchestration, automation, and response (SOAR)
- Platforms that connect tools and run response workflows.
- Runbooks
- Step-by-step operational procedures, often partly automated.
- Playbooks
- Response plans for specific incident types, automated in SOAR.
- Vulnerability scanning and reporting
- Automated discovery and reporting of vulnerabilities.
- Workflow automation
- Automating approvals, tickets and handoffs.
Security Content Automation Protocol (SCAP)
- Security Content Automation Protocol (SCAP)
- NIST suite of standards for automated, machine-readable security checks.
- Open Vulnerability Assessment Language (OVAL)
- Language describing how to test a system for a vulnerability or configuration state.
- Extensible Configuration Checklist Description Format (XCCDF)
- Format for security checklists and benchmarks and their results.
- Common Platform Enumeration (CPE)
- Standard naming for products and versions.
- Common vulnerabilities and exposures (CVE)
- Standard vulnerability identifiers.
- Common Vulnerability Scoring System (CVSS)
- Standard severity scoring.
Check your understanding
Loading quiz…
Original CoreQ Academy material, mapped to objective 3.6 of the publicly available CompTIA SecurityX CAS-005 exam objectives (Exam objectives V5, document version 7.0). Not affiliated with or endorsed by CompTIA. Contains no exam questions.