ภาษาสคริปติ้ง (Scripting Languages) ช่วยปรับปรุงความปลอดภัยเครือข่ายอย่างไร

Scripting Language ใน Network Security คืออะไร

Scripting Languages (Python, Bash, PowerShell, Perl, Ruby, Lua) เป็นภาษาโปรแกรมระดับสูงที่ ตีความ (Interpreted) รันทีละบรรทัด ไม่ต้อง Compile ก่อน ใช้สำหรับ Automation, Rapid Prototyping, Glue Code, และ Tool Development ใน Network Security

บทบาทหลักใน Network Security

1. Automation & Orchestration (อัตโนมัติและประสานงาน)

• Log Parsing & Analysis: Parse Firewall/IDS/Proxy Logs → Extract IOCs, Anomalies (Python: regex, pandas, loguru)
• Vulnerability Scanning: Schedule Nmap, Nuclei, OpenVAS → Parse Results → Ticket Creation (Jira, ServiceNow)
• Config Audit/Compliance: SSH/API ไป Router/Switch/Firewall → Check Config vs Baseline (CIS Benchmarks)
• Certificate Management: Monitor Expiry, Auto-renew (Let's Encrypt/Certbot), Deploy
• User Provisioning/Deprovisioning: Onboard/Offboard → AD/LDAP, VPN, SaaS Apps (SCIM)

2. Incident Response & Forensics

• Triage Automation: Enrich Alerts (VirusTotal, AbuseIPDB, GreyNoise, Shodan) → Auto-assign Severity
• Evidence Collection: Remote Memory Dump (WinPmem, LiME), Disk Image (dd/ewf), Log Collection (KAPE, Velociraptor)
• Timeline Analysis: Parse Windows Event Logs (EVTX), Prefetch, Shimcache, Amcache, SRUM (Python: python-evtx, dfir-ntfs)
• IOC Sweeping: Scan Network/Endpoints สำหรับ Hash, IP, Domain, URL, Registry Keys

3. Threat Hunting & Detection Engineering

• Hypothesis-driven Hunts: Query SIEM (Splunk SPL, KQL, Elastic DSL) → Python/Jupyter Notebook สำหรับ Visualization & Stats
• Sigma Rule Development: เขียน Rule แบบ Vendor-agnostic → Convert ไป SIEM ทุกตัว (sigmac)
• Threat Intel Processing: Ingest STIX/TAXII, MISP, OpenCTI → Enrich, Deduplicate, Generate Detection Rules
• Malware Analysis Automation: Submit to Cuckoo/Joe Sandbox/ANY.RUN → Extract IOCs → Generate Signatures

4. Penetration Testing & Red Teaming

• Custom Exploits/PoCs: เขียน Exploit เองเมื่อ Public Exploit ไม่ทำงาน/ไม่มี (Python, Ruby - Metasploit Modules)
• Post-Exploitation: Enumeration (BloodHound, SharpHound), Lateral Movement (PsExec, WMI, SMB, WinRM), Persistence
• C2 Framework Development: Custom C2 (Sliver, Covenant, Mythic) → Profile, Malleable C2
• Phishing Automation: Gophish, King Phisher, Custom Templates, Tracking

5. Security Tool Development

• Custom Scanners: Nuclei Templates, Custom Checks (Logic Bugs, Business Logic Flaws)
• Internal Tools: Asset Inventory, Shadow IT Discovery, Cloud Asset Sync (AWS/Azure/GCP APIs)
• Integration/Glue: Connect SIEM → SOAR → Ticketing → ChatOps (Slack/Teams Bot)

ภาษายอดนิยมและจุดแข็ง

ตัวอย่างจริง: Python Script สำหรับ Network Security

1. Network Service Scanner (Simple)

#!/usr/bin/env python3
import socket, concurrent.futures, sys

def scan_port(host, port, timeout=1):
    try:
        with socket.create_connection((host, port), timeout=timeout):
            return port
    except:
        return None

def main():
    target = sys.argv[1] if len(sys.argv) > 1 else "192.168.1.1"
    ports = range(1, 1025)
    print(f"Scanning {target}...")
    with concurrent.futures.ThreadPoolExecutor(max_workers=100) as executor:
        futures = {executor.submit(scan_port, target, p): p for p in ports}
        for future in concurrent.futures.as_completed(futures):
            port = future.result()
            if port:
                print(f"[OPEN] {target}:{port}")

if __name__ == "__main__":
    main()

2. Log Parser: Detect Brute-force SSH

#!/usr/bin/env python3
import re, collections, sys
from datetime import datetime, timedelta

# Parse /var/log/auth.log
pattern = re.compile(r'(\w{3}\s+\d+\s+\d+:\d+:\d+).*sshd.*Failed password for (\S+) from ([\d.]+)')
window = timedelta(minutes=10)
threshold = 5

attempts = collections.defaultdict(list)

with open('/var/log/auth.log') as f:
    for line in f:
        m = pattern.search(line)
        if m:
            dt_str, user, ip = m.groups()
            dt = datetime.strptime(f"{datetime.now().year} {dt_str}", "%Y %b %d %H:%M:%S")
            attempts[(ip, user)].append(dt)

for (ip, user), times in attempts.items():
    times.sort()
    for i in range(len(times)):
        if i + threshold <= len(times) and times[i+threshold-1] - times[i] < window:
            print(f"[ALERT] Brute-force: {ip} -> {user} ({threshold}+ attempts in {window})")
            break

3. Automated Cert Expiry Check

#!/usr/bin/env python3
import ssl, socket, sys
from datetime import datetime, timezone

def check_cert(host, port=443):
    ctx = ssl.create_default_context()
    with ctx.wrap_socket(socket.socket(), server_hostname=host) as s:
        s.settimeout(5)
        s.connect((host, port))
        cert = s.getpeercert()
    exp = datetime.strptime(cert['notAfter'], '%b %d %H:%M:%S %Y %Z').replace(tzinfo=timezone.utc)
    days = (exp - datetime.now(timezone.utc)).days
    status = "🔴 EXPIRED" if days < 0 else "🟠 SOON" if days < 30 else "🟢 OK"
    print(f"{status} {host}:{port} - Expires in {days} days ({exp.date()})")

if __name__ == "__main__":
    for host in sys.argv[1:] or ["google.com", "github.com", "internal.company.com"]:
        check_cert(host)

Scripting vs Programming ใน Security

Best Practices สำหรับ Security Scripting

1. Input Validation: Sanitize ทุก Input (Shell Injection, SQLi, Path Traversal)
2. Secrets Management: ไม่ Hardcode Credentials → ใช้ Vault, Keyring, Env Vars, AWS Secrets Manager
3. Error Handling: Try/Except, Logging, Graceful Degradation, No Sensitive Data ใน Logs
4. Code Signing / Integrity: Sign Scripts (GPG, Cosign), Verify ก่อนรัน
5. Version Control: Git, Signed Commits, Code Review (Pull Requests)
6. Testing: Unit Tests (pytest), Integration Tests, Static Analysis (Bandit, Semgrep, ShellCheck)
7. Documentation: Docstrings, README, Usage Examples, Changelog
8. Least Privilege: รันด้วย User ที่มีสิทธิ์ต่ำสุด (Non-root, Constrained Language Mode PS)

การเรียนรู้แนะนำ (Learning Path)

1. Python Basics: Automate the Boring Stuff, Python for Everybody (Coursera)
2. Python for Security: "Black Hat Python" (Justin Seitz), "Violent Python" (TJ O'Connor), SANS SEC573
3. PowerShell for Security: "PowerShell for Penetration Testing", "Blue Team PowerShell", SANS SEC505
4. Bash/Linux: "Linux Command Line" (William Shotts), OverTheWire Bandit, Linux Journey
5. Practice: TryHackMe (Scripting Rooms), Hack The Box, Advent of Code, Build Your Own Tools

สรุป

Scripting Language เป็น Force Multiplier สำหรับ Network Security Professional

• Python: ภาษาหลัก (Primary) — ใช้ได้ทุกอย่าง
• PowerShell: บังคับสำหรับ Windows/AD/Azure Environment
• Bash: บังคับสำหรับ Linux/Container/Cloud/Infra
• Go/Rust: เมื่อต้องการ Performance, Distribution, Production-grade Tools

"The best scripting language is the one you know best and gets the job done securely."