Security Automation Fundamentals

GASAE · 20 questions

• A city CIO confuses SOAR orchestration with simple scheduled scripts for password resets. What terminology distinction should security leaders teach?
• A county security lead asks when to use detection-as-code instead of ad-hoc SIEM clicks. What strategy vocabulary applies?
• A transit authority defines policy-as-code as preventive guardrails, not as IR playbooks. What terminology clarity is that?
• A school district glossary standardizes playbook, runbook, and workflow for auditors. What fundamentals practice is that?
• A housing authority separates enrichment automation from containment automation in architecture diagrams. What layering practice is that?
• A city ranks ticket types by volume times toil to choose the first SOAR candidates. What selection method is that?
• A county rejects automating rare executive-targeted IR until human playbooks stabilize. What candidate-selection judgment is that?
• A public-health SOC prioritizes automating indicator enrichment before full host isolation. What investment ordering is that?
• A parks department refuses to automate any action that can brick seasonal point-of-sale terminals. What selection filter is that?
• A library IT group pilots security automation on a single branch before enterprise rollout. What selection practice is that?
• A city writes an automation design doc covering triggers, inputs, outputs, and failure modes before go-live. What planning practice is that?
• A county maps owners, on-call, and rollback for every new automated containment action. What deploy-planning practice is that?
• A transit team stages security automation in detect-only mode for two weeks before enforce. What deployment approach is that?
• An emergency-management agency load-tests IR automation before hurricane season. What planning practice is that?
• A court IT group requires peer review of automation pull requests the same as application code. What change-control practice is that?
• A city applies CI/CD to detection content with lint, unit tests, and staged promote. What DevOps practice is that?
• A county uses infrastructure pipelines so security logging sinks deploy with every new app. What DevOps alignment is that?
• A water utility treats automation failures as incidents with blameless postmortems. What reliability culture practice is that?
• A 311 platform team versions automation configs and forbids undocumented production hotfixes. What DevOps discipline is that?
• A city CISO ties the automation backlog to OKRs for mean time to respond. What roadmap practice is that?