5 Tips for Implementing a Successful SecOps Strategy
July 24, 2017

Pete Cheslock
Threat Stack

What is SecOps? Is it a team, a job title, or a methodology?

Depending on the size of your company, it could be a mix of all three. When smaller companies implement SecOps methodologies, security is everyone's job. Larger companies have entire teams devoted to helping them achieve "SecOps" — making it hard to create a blanket term for the industry.

In broad brush strokes, SecOps is a seamless collaboration between your IT security and IT operations teams. The goal is to streamline security processes, and ensure that every piece of code that makes it into production is as secure as possible.

If you've ever thought of revamping your company's current security operations to make it more agile, or if you've been thinking about building out a SecOps function, here are 5 tips you should keep in mind:

1. Have a plan

When setting out to integrate your security and operations teams, make sure you have a plan in place so you're able to get your SecOps program off the ground and running. In order to pull together a fleshed-out plan, here are some questions you should ask yourself:

■ What are you trying to accomplish?

Advice: Don't try to do everything at once. Focus on one or two things and make sure they are specific, measurable, achievable, relevant, and timely.

■ What is your team going to execute on?

Advice: Be very clear who on your team will do what by when. Ideally, you should create a list of action items that read like a playbook that can be implemented right away.

■ What can you use to help accomplish your goal?

Advice: Most of the time starting a SecOps program involves moving around internal resources, so you might not need to ask for extra resources or budget.

2. Designate stakeholders

Next, make sure you pick the right people to help you get your SecOps program off the ground. I recommend taking a top-down, bottom up approach. You'll need to pitch the C-suite (and other executive decision makers) on exactly how SecOps will benefit the company's security posture (and bottom line).

Next, you'll need to get the developers and security team on your side, as they'll be the people doing a lot of heavy lifting behind this change. It may not be an easy conversation for you to begin, but once you've elaborated on what SecOps can do for your company, the decision to embrace it will become much easier.

3. Train your new team

Traditionally, Security, Dev, and Ops teams are siloed. In some cases your Dev and Ops teams have no idea what their security counterparts are doing, and vice versa. This means when you begin integrating the teams, there will be a significant learning curve for all parties involved. To get your teams up to speed (and ready to implement your SecOps strategy), I recommend you do the following in your first team meeting:

■ Have a security pro share what their day-to-day work is like

■ Have a member of the Dev and/or Ops team share what their day-to-day is like

■ Provide an overview of SecOps use cases (like testing codes for vulnerabilities)

■ Breakdown the new strategy, and list action items so everyone understand the new process, and what they're responsible for

4. Put processes in place

Just like with any new project, you're likely to run into a few problems early on. To make sure your new plan isn't thrown off-course, you should implement processes so that people working together will know how to handle any curveball that comes their way.

Example:

If developer A deploys code, your team should be able to answer:

■ What tool they used to scan for vulnerabilities in the code

■ Who reviewed alerts from the vulnerability scan

■ Who is giving feedback to developer A

Seems simple, right? However, the best way to make sure everyone is on board is to communicate workflows with your team. Provide them with an end-to-end description of tasks, the processes you want to implement, and then repeat and iterate ad infinitum.

Though this sounds like a lot of upfront work, this will save you a great deal of time and legwork later on. It'll also reduce errors that happen when tasks fall through the cracks, and keep everyone on the same page.

5. Know How to Measure Success

You've put this new plan in place — now you should be able to prove that it's working! Chances are your executive team will be wondering how effective this new methodology is. Since you implemented it, chances are that you'll need to prove that any budget and resources you requested are worth it.

Here are some questions you should be able to answer, if your executive team asks, after implementing a SecOps program:

■ Could you deploy a patch today?

■ How often are you able to identify the need for a security patch?

■ How fast do security alerts get to you?

You should also have metrics, or KPIs, to show quantitative improvements in security thanks to your new SecOps implementation. Be sure to tailor these numbers to your specific industry, that way you can measure against what really matters, and show that you're continuing to move the security needle.

Perhaps most importantly when setting up metrics: make them realistic. No matter how thorough you and your team are, your security will never be perfect. Do the best with what you have, and strive for something you think you can accomplish (understanding that there will be some hiccups along the way). Just make sure you always seek to improve, and let your KPIs help keep you moving forward.

Pete Cheslock is Sr. Director, Ops & Support, at Threat Stack
Share this

Industry News

May 18, 2022

Red Hat unveiled updates across its portfolio of developer tools designed to help organizations build and deliver applications faster and more consistently across Kubernetes-based hybrid and multicloud environments.

May 18, 2022

Armory announced public early access to their new Continuous Deployment-as-a-Service product.

May 18, 2022

DataCore Software announced DataCore Bolt, enterprise-grade container-native storage software for DevOps.

May 17, 2022

DevOps Institute, a global professional association for advancing the human elements of DevOps, announced the release of the Upskilling IT 2022 report.

May 17, 2022

Replicated announced a host of new platform features and capabilities that enable their customers to accelerate enterprise adoption of their Kubernetes applications.

May 17, 2022

Codefresh announced that its flagship continuous delivery (CD) platform will be made accessible as a fully-hosted solution for DevOps teams seeking to quickly and easily achieve frictionless, GitOps-based continuous software delivery in the cloud.

May 16, 2022

Red Hat announced new capabilities and enhancements across its portfolio of open hybrid cloud solutions aimed at accelerating enterprise adoption of edge compute architectures through the Red Hat Edge initiative.

May 16, 2022

D2iQ announced a partnership with GitLab.

May 16, 2022

Kasten by Veeam announced the new Kasten by Veeam K10 V5.0 Kubernetes data management platform.

May 12, 2022

Red Hat introduced Red Hat Enterprise Linux 9, the Linux operating system designed to drive more consistent innovation across the open hybrid cloud, from bare metal servers to cloud providers and the farthest edge of enterprise networks.

May 12, 2022

Couchbase announced version 7.1 of Couchbase Server.

May 12, 2022

Copado added Copado Robotic Testing to Copado Essentials.

May 11, 2022

Red Hat announced new advancements within its Red Hat Cloud Services portfolio, delivering a fully-managed and streamlined user experience as organizations build, deploy, manage and scale cloud-native applications across hybrid environments.

May 11, 2022

JFrog introduced a new Docker Desktop Extension for JFrog Xray that allows organizations to automatically scan Docker Containers for vulnerabilities and violations early in the development process.

May 11, 2022

Progress announced a series of updates in Progress Telerik and Progress Kendo UI.