5 Tips for Implementing a Successful SecOps Strategy
July 24, 2017

Pete Cheslock
Threat Stack

What is SecOps? Is it a team, a job title, or a methodology?

Depending on the size of your company, it could be a mix of all three. When smaller companies implement SecOps methodologies, security is everyone's job. Larger companies have entire teams devoted to helping them achieve "SecOps" — making it hard to create a blanket term for the industry.

In broad brush strokes, SecOps is a seamless collaboration between your IT security and IT operations teams. The goal is to streamline security processes, and ensure that every piece of code that makes it into production is as secure as possible.

If you've ever thought of revamping your company's current security operations to make it more agile, or if you've been thinking about building out a SecOps function, here are 5 tips you should keep in mind:

1. Have a plan

When setting out to integrate your security and operations teams, make sure you have a plan in place so you're able to get your SecOps program off the ground and running. In order to pull together a fleshed-out plan, here are some questions you should ask yourself:

■ What are you trying to accomplish?

Advice: Don't try to do everything at once. Focus on one or two things and make sure they are specific, measurable, achievable, relevant, and timely.

■ What is your team going to execute on?

Advice: Be very clear who on your team will do what by when. Ideally, you should create a list of action items that read like a playbook that can be implemented right away.

■ What can you use to help accomplish your goal?

Advice: Most of the time starting a SecOps program involves moving around internal resources, so you might not need to ask for extra resources or budget.

2. Designate stakeholders

Next, make sure you pick the right people to help you get your SecOps program off the ground. I recommend taking a top-down, bottom up approach. You'll need to pitch the C-suite (and other executive decision makers) on exactly how SecOps will benefit the company's security posture (and bottom line).

Next, you'll need to get the developers and security team on your side, as they'll be the people doing a lot of heavy lifting behind this change. It may not be an easy conversation for you to begin, but once you've elaborated on what SecOps can do for your company, the decision to embrace it will become much easier.

3. Train your new team

Traditionally, Security, Dev, and Ops teams are siloed. In some cases your Dev and Ops teams have no idea what their security counterparts are doing, and vice versa. This means when you begin integrating the teams, there will be a significant learning curve for all parties involved. To get your teams up to speed (and ready to implement your SecOps strategy), I recommend you do the following in your first team meeting:

■ Have a security pro share what their day-to-day work is like

■ Have a member of the Dev and/or Ops team share what their day-to-day is like

■ Provide an overview of SecOps use cases (like testing codes for vulnerabilities)

■ Breakdown the new strategy, and list action items so everyone understand the new process, and what they're responsible for

4. Put processes in place

Just like with any new project, you're likely to run into a few problems early on. To make sure your new plan isn't thrown off-course, you should implement processes so that people working together will know how to handle any curveball that comes their way.

Example:

If developer A deploys code, your team should be able to answer:

■ What tool they used to scan for vulnerabilities in the code

■ Who reviewed alerts from the vulnerability scan

■ Who is giving feedback to developer A

Seems simple, right? However, the best way to make sure everyone is on board is to communicate workflows with your team. Provide them with an end-to-end description of tasks, the processes you want to implement, and then repeat and iterate ad infinitum.

Though this sounds like a lot of upfront work, this will save you a great deal of time and legwork later on. It'll also reduce errors that happen when tasks fall through the cracks, and keep everyone on the same page.

5. Know How to Measure Success

You've put this new plan in place — now you should be able to prove that it's working! Chances are your executive team will be wondering how effective this new methodology is. Since you implemented it, chances are that you'll need to prove that any budget and resources you requested are worth it.

Here are some questions you should be able to answer, if your executive team asks, after implementing a SecOps program:

■ Could you deploy a patch today?

■ How often are you able to identify the need for a security patch?

■ How fast do security alerts get to you?

You should also have metrics, or KPIs, to show quantitative improvements in security thanks to your new SecOps implementation. Be sure to tailor these numbers to your specific industry, that way you can measure against what really matters, and show that you're continuing to move the security needle.

Perhaps most importantly when setting up metrics: make them realistic. No matter how thorough you and your team are, your security will never be perfect. Do the best with what you have, and strive for something you think you can accomplish (understanding that there will be some hiccups along the way). Just make sure you always seek to improve, and let your KPIs help keep you moving forward.

Pete Cheslock is Sr. Director, Ops & Support, at Threat Stack

The Latest

October 19, 2017

In light of the recent Equifax breach, Gene Kim and speakers from the upcoming DevOps Enterprise Summit San Francisco (DOES17) dissected the situation and discussed the technical leadership lessons learned while offering their own expert advice for handling crisis situations. The following are more highlights from the discussion ...

October 18, 2017

In light of the recent Equifax breach, Gene Kim and speakers from the upcoming DevOps Enterprise Summit San Francisco (DOES17) dissected the situation and discussed the technical leadership lessons learned while offering their own expert advice for handling crisis situations ...

October 16, 2017

A survey of more than 750 development team leaders in the US and UK, revealed that 68 percent plan to build more apps during the next 12 months. At the same time as reporting increased volumes of development, 91 percent of developers surveyed agree that user expectations for innovation and quality have increased, but app deliveries continue to fail ...

October 12, 2017

Today, organizations must digitally evolve or they risk becoming irrelevant. One area that’s been growing in adoption is a shift to developing and deploying modern applications in the cloud, which requires software and IT architects to rethink how to architect and manage these apps ...

October 10, 2017

Designing and deploying complete software-defined data centers (SDDCs) can be complicated because each implementation requires a broad range of infrastructure to support heavy demands for compute, networking, storage, applications and security ...

October 05, 2017

According to LogiGear's State of Software Testing Survey, almost one-third of the respondents are experiencing classic test automation issues. One problem commonly cited among respondents was that management didn’t fully understand what it takes to have a successful automation program ...

October 04, 2017

Load balancing at the DNS (Domain Name System) level has been around for a few decades now, but it didn't become crucial until recently as technology is moving to the cloud. DNS is the perfect solution for managing cloud systems ...

October 02, 2017

QualiTest recently compiled a data report analyzing software testers globally. The report details the Quality Assurance and Software Testing job market, one of the fastest growing job markets and a bellwether of tech employment due to QA's involved in nearly every conceivable industry ...

September 28, 2017

API use is exploding among developers, as APIs are an essential part of software development for the web, IoT, mobile and AI applications. APIs allow a developer to create programs or apps that can successfully request services or data from other applications or operating system. This connectivity, though powerful, is complex, and that complexity grows with new apps, new hardware such as the new iPhone and Echo, and the creation of new APIs ...

September 26, 2017

Companies are placing a greater value on high performing IT professionals as IT demands continue to escalate, according to Puppet's DevOps Salary Report ...

Share this