In this lesson, we're going to talk
about upgrades and compliance and how we use automation
and orchestration to do that.
Now, as our networks become increasingly more complex
and integral to our organizational operations,
the traditional manual methods of maintaining
and securing our network infrastructures
are simply inadequate.
Automation is really what we need to use here
as a crucial tool to facilitate efficiency
and accuracy inside
of our upgrades across large scale networks.
And also we're going to use this
to help get stringent adherence
to our different compliance standards
through automation and orchestration.
Both of these things are things we really need
to consider in our high velocity
and high availability environments.
First, let's take a look at the role of automation inside
of our network upgrade process.
Now, when we use automation,
this is going to play a critical role in the upgrading
of our network components by helping us
to streamline our processes, reducing the chances
of human error, and to ensure consistency
across the network.
Whether we're trying to install security patches,
firmware updates, or new features to our network devices,
by using these automated scripts and tools, we can schedule
and execute the updates during off peak hours,
so they'll minimize downtime and disruption
to our otherwise busy business operations.
Now, another thing that we're going to use automation
for is version control
and consistency, especially when we're dealing
with large networks, we need to ensure that all
of our devices are running the correct software versions
and this can be a really hard thing to do
when you have hundreds or thousands
or hundreds of thousands of endpoints on your network.
So by using automation tools, we can conduct regular scans
of the network, verify the software versions
against our standard requirements and our baseline,
and then anybody who is not at that baseline,
we can automatically update those devices
to the newer software
and remove that older, outdated software for us.
And this helps maintain consistency
and security across the entire network.
The third big area for automation
is doing automated testing and validation.
After you do an upgrade,
you want to make sure you test your systems
to ensure everything is working properly.
Well, instead of me doing a simple ping command
to see if the network connectivity is up, I may have a suite
of tools by running an automation script that does lots
of different things, including checking routing tables,
making sure our ARP caches are clear,
making sure the DNS caches are accurate
and all sorts of other things that we want to do.
By using automation, we can perform systematic testing
of our network functionalities and our performance
after an upgrade to ensure that no issues are left
and that we've identified anything that needs to be fixed.
Now the next thing we need to talk about
is the compliance section.
Now, when it comes to compliance,
what we are doing is trying to make sure
that our systems are networks
and our software are all operating in accordance
with the rules, regulations,
and laws that we are subject to based on where we live
or what contracts we've entered into.
Now when it comes to automation, you can use automation
to help continuously monitor your network configurations
and compare them against your compliance standards.
So if you accept credit cards
and you're subject to the terms of PCIDSS,
you're going to want to make sure your systems
are meeting those requirements and you can do a weekly scan
or a quarterly scan to verify that through automation.
By doing this, you're going to be able
to identify any deviations and they can be flagged
and rectified immediately.
And this makes sure you're in compliance
and don't run afoul of any regulations or laws
because they can't have significant penalties
for your organization.
Another use of automation is in policy enforcement.
And policy enforcement goes hand in hand with compliance
because if you have a compliance requirement
that says something like you must use 15 character
or longer passwords, the way you implement that is
through a security policy
that's going to be installed all over your systems.
Well, using automation, you can write that policy once
and apply it to all of your systems at the same time.
Another use for this is anytime you find a device that tries
to connect to your network that's not in compliance
with the security policy,
you can automatically quarantine it
and then through orchestration, you can update that system
and that will minimize the risk that that system poses
until it can be patched up
and then brought back onto the production network.
Another great area in terms of compliance
that we can use automation in is gathering up all
of our logs and all of our evidence
because when we go through a compliance audit,
the auditors are going to ask
to see your records and your data.
By using these automation tools, you can generate
and preserve the logs of all your network activities,
your upgrades and compliance measures,
and then you can present all of that
during a compliance audit to the auditors
to ensure you can pass the audit without any issues.
So now that we've covered some of the basics
of automation and orchestration
and their use inside of things like upgrades
and compliance, I want to talk a little bit
about some real world use cases
that you may apply this stuff to.
Now, the first one is automated patch management.
If you're dealing with a lot of endpoints on your network,
each of those represents a unique vulnerability
to your network and its systems.
Now to ensure that you're going to be the most secure you
can be, you want to make sure
that all these systems are effectively patched
and maintained to the appropriate level
to make sure there's no known vulnerabilities
on your network.
For example, I used to run a network
that had over 15,000 endpoints across seven countries.
That was a really big network
and it was really hard to conduct patch management
at that scale.
Even with the use of automation, we were still lucky
to get up to 99 or 99.9% complete on our patching
'cause there are always systems
that are offline or hard to reach.
But by using automation, we could usually get to 95
or 99% patch compliance within about 24 hours.
And then we would spend the last week
or two trying to get those last handful of machines
that we couldn't find that were not taking the patch
for some reason or another.
So using automation in terms
of patch management is a great thing to do
and it's really going to save you a ton of time and effort.
Another big use case here is compliance monitoring,
and I talked about the fact that you want
to do continuous compliance monitoring.
And for a person to do that 24 hours a day,
7 days a week is just not realistic.
But our tools when we use orchestration
and automation don't get tired and they don't take vacation.
So we can use automation tools like Chef and Puppet
and DNA Center to provide continuous monitoring
and management of our network configurations
and then enforce any standard configurations that we want
and automatically correct any deviations back
to the baseline and providing us
with real-time compliance reporting
and data gathering so we know the status of our networks.
So remember, when it comes to automation in terms
of your network upgrades and compliance, you want
to use automation wherever possible
because it's efficient, it's accurate,
and it's reliable when conducting network management
on your behalf.
By embracing this world of automation,
your organization can save time and money
and even better, have a more secure network
that is safe from data breaches
because you are patching for all known vulnerabilities.
The best use cases for automation are things you're going to do
on a daily basis or a weekly basis,
and that are repetitive, boring tasks that have
to be done at scale.
Those are the kind of things where automation is king.
For example, if I wanted to patch five computers,
I can do that manually,
but if I need to patch 5,000 computers,
I really have to use automation
or I'm never going to get it done.