Security: Automate And/Or Die?

I see a lot of people advocating the “no automatic denies” and “only deny with manual approval” approach. To me that’s the equivalent of running an IPS (intrusion prevention system) in monitor-only mode, a.k.a the IDDS mode (I don’t do ).

The reality is every company relies heavily on automated denial controls: anti-malware, anti-spam, proxy server category updates, DLP, etc. Even patching is an automatic deny type of control because it stops the exploit without human intervention.

And since these systems are vendor designed and applied, doesn’t that mean we trust our nameless and faceless vendors with our environment more than we trust our own employees? What kind of message are we sending to our people when we agree to allow our vendors to place automatic controls but we won’t allow our own staff to do so? That we trust our own people’s skills, knowledge and judgement fully? Probably not.

At the financial institution where I work we rely heavily on automatic controls, both the vendor controls and ones we’ve devised. Yes, both occasionally block traffic, transactions and users inappropriately but the “wins” are far more than the “loses”. And during pen tests our custom-designed controls always pick up the attacks before the high-priced vendor systems, sometimes by a couple of days.

In an operating environment where the door only needs pried open a sliver, to rely on manual approvals is to sit by helplessly and watch as the data leaves the company or as the infection spreads. We would much rather apologize for the occasional inappropriate block than have a mess we need to disclose and cleanup.

I’ve worked with large banks where their response time to a security event is measured in many hours and they think that’s great because it’s down from days. Our response time is in milliseconds and occasionally even that is not fast enough because we triggered on a secondary event rather than the primary.

Totally agree with view points of the benefits of automation and the need to scale the integration of various prevent/detect/respond processes. The blog does not talk about the foundational elements to get there. I do believe that APIs are going to be the foundation for any security automation. APIs provide a consistent way to interact, collect data and make real-time policy actions and eliminate any errors due to manual processes. Similar to what SNMP did for the network management did for IT Operations, APIs will do wonders for Security and IT Operations and automate the heck out of the disparate tools and processes.