June 2021 Summaries

Tines, a company offering both cloud and self-hosted solutions, faced the challenge of deploying changes to their web application without causing downtime. They explored common solutions like using nginx wrappers, Docker Swarm, or dedicated application proxies but sought a simpler approach. By modifying their docker-compose configuration and implementing a bash script, they achieved zero-downtime deployments through nginx's reload function, allowing new containers to start while old ones continue servicing requests until they are phased out. This straightforward solution, tested extensively and used in production for over six months, aligns with Tines' preference for simple engineering solutions over complex dependencies, allowing them to focus on customer-centric product improvements.

Incident Response teams face the challenge of alert fatigue due to the high volume of alerts from various sources like SIEM, EDR, and abuse inboxes. To address this, automation plays a crucial role, and integrating alerts into a centralized Case Management System can be a significant first step. Tines, a platform that integrates with tools like Jira, The Hive, and ServiceNow, facilitates this process by automatically creating cases from alerts. In an extension of a previous integration with CrowdStrike, Tines now enables the creation of Jira tickets for new detections, allowing analysts to perform response actions such as containing a device at the click of a button. By setting up permissions carefully, Tines can read and update detection statuses, enrich Jira tickets with detailed information from CrowdStrike, and use VirusTotal to assess the severity of threats. This approach helps streamline incident management by reducing manual tasks, allowing analysts to make quicker decisions based on enriched data, and offering the potential for further automation and integration with other threat intelligence sources.

Tines, an automation platform developed by its founders to address the challenges they faced as senior security operators, is extensively used and tested internally by the Tines team, who are both its developers and primary users. The platform, which enables seamless integration with other tools to manage repetitive manual tasks, has been implemented in over 100 use cases within the company, ranging from engineering and security monitoring to sales, marketing, and recruitment processes. Tines also fosters a creative and engaging work culture through initiatives like the 'You Did What With Tines' (#YDWWT) competition, which encourages employees to showcase innovative automation stories. Examples include automating PTO requests and enhancing fantasy baseball strategies, illustrating the platform's flexibility beyond traditional security applications. By providing hands-on training to new team members and emphasizing the benefits of automation, Tines ensures that its employees have more rewarding workdays and are well-equipped to tackle their responsibilities efficiently.

In a blog post, Julia Grabos, a software engineer at Tines, shares her experiences and insights about her role in the company. Recently graduated with a degree in Computer Science from University College Cork, Julia highlights her passion for creativity and problem-solving within the workplace. She discusses her multifaceted role, which encompasses working on both the frontend and backend of the product, and emphasizes the importance of using Tines' own automation tools, a practice known as "dogfooding," to enhance their operations. Julia finds particular satisfaction in developing the Community Edition tenant provisioning mechanism, which allows her to both use and improve the features she creates, enhancing customer satisfaction. Influenced by her team’s focus on people-oriented approaches and automation, she strives for clean and efficient code. Outside of work, Julia enjoys online gaming with friends and maintaining personal fitness at the gym.

The text discusses the significant contributions of volunteers in the Information Security community and highlights Tines' efforts to support and nurture this collaborative spirit. Tines emphasizes its mission to ease the lives of security and operations teams, which inspired the launch of their free Community Edition automation platform. The company also sponsors various initiatives and tools, such as urlscan, Sooty, PhishStats, and Mihari, all aimed at enhancing cybersecurity efforts. Tines has developed services like Phish.ly and TinesBot to analyze suspicious emails and distribute threat intelligence, respectively. The text underscores the critical role of shared intelligence and collaboration in developing effective security strategies and encourages community engagement and idea sharing for further support.

In a landscape where phishing is involved in a significant majority of data breaches, traditional security measures like email detection software and employee training are proving inadequate against the sheer volume of attacks. To address this, automation tools such as Tines, a no-code security automation platform, and Phish.ai, a real-time phishing analysis service, are being employed to enhance detection and response times. These tools streamline the process by automating the collection and analysis of suspicious URLs, reducing errors and analyst fatigue. By integrating Phish.ai with Tines, companies can efficiently deduplicate and classify URLs, perform real-time analysis, and prioritize incidents, freeing analysts to focus on more strategic efforts. The automation process not only improves efficiency but also allows for additional actions such as blocking domains and removing malicious emails, ultimately aiding in more effective threat mitigation and brand protection.

In the Tines platform, the approach to enhancing security team processes begins with understanding their current methods, aiming to identify opportunities for automation, often through a practice known as 'rubber ducking'. The 'Send to Story' feature is central to this strategy, enabling teams to streamline workflows by sending data to sub-stories, akin to programming functions, thus avoiding redundant tasks and fostering standardization. Recent upgrades to this feature include supporting multiple exit actions, dynamic story name assignments, and team-specific access, which enhance flexibility and control. To expedite adoption, Tines offers public and private templates, and encourages annotating storyboards to clarify functionality and expected data exchanges. Furthermore, maintaining standardized exit formats and being cautious with multiple exit actions are recommended to prevent redundancies and excess notifications. Ultimately, 'Send to Story' simplifies complexity and promotes process consistency across teams, with new features and best practices facilitating its implementation.