In most organizations, we have an IT operations and a security team.
These teams have traditionally disjointed roles and responsibilities.
The IT operations are involved with hardening systems,
managing the infrastructure, and deploying and maintaining systems.
While the security operations team would track ongoing threats,
intrusion detection and prevention,
and carry out any firewall‑management activities.
With these two disjointed teams,
we can use Ansible as the common automation language for
everyone across your organization.
So specifically,
Ansible Tower can be the common language between all of your security tools.
This will lead to repetitive work and ability to respond to
security events in a standardized way.
Then activities, such as system hardening, are something everyone can do.
So with automation,
we can rapidly identify systems that require patches or
reconfiguration so we can more easily apply patches or change
system settings according to the defined baselines,
in a consistent manner, across a large number of different systems.
For example,
you might want to make changes to your SSH config on all of your devices,
so here we can use automation to check and configure the SSH daemon
to not allow authentication using empty passwords.
On the network side of things, for network management,
you might want to configure an access‑control list or a filter
to restrict ACL or filter management access to devices that are
only from the management network.
And here, we can use automation to do all of this.
What I really like is you can create new Ansible
Playbooks from specific security profiles,
and the creation of playbooks can be kicked off directly from security scans.
These playbooks can then be used to implement
remediation more rapidly and consistently.
A unified and standard response to security can be
done with pre‑approved policies.
This will bring in consistently configuring resources
according to pre‑approved playbooks,
and all of this can be done in a repeatable fashion.
This provides a faster and more efficient and streamlined
way to automate the processes for identification, triage,
and response to security events,
so we can use security‑focused content collections of roles and
modules that are dedicated to security functions.
Pre‑approved policies and playbooks will certainly
reduce the chance of misconfiguration, which is the cause of a lot of breaches.
To centralize credential management,
Tower offers role‑based access control and native integration into
enterprise identity access management systems,
such as Active Directory and privileged‑access management solutions.
By implementing identity management and access control
for your automation platform processes,
helps to ensure that only authorized people can execute automation tasks.
Change control is critical for understanding who modified,
who made the changes,
and when they were changed throughout the system's lifecycle.
So Tower has very good auditing features that ease auditing and
troubleshooting and automatically records action logs.
You can also use a log aggregator that can collect logs and then send
them to a back end for later security analysis.
So as a recommended starting point,
you could try to get started with the security‑automation tasks.
I would start with a single project and don't try
to automate everything at once.
You could choose a single project with a limited set of tasks,
then choose repetitive tasks, automate tasks that are performed repeatedly,
including patch management, security‑vulnerability identification,
and remediation, along with policy enforcement.
My personal approach would be to start with patching,
applying patches for critical issues and known
vulnerabilities as soon as possible.
So with automation,
we can test patch system for functionality before
placing them back into production.
So once you're happy with these basics as a starting point,
then you can move out to your security integrations and integrate
automation with your firewall and your IDS/IPS.