5 Tips for Implementing a Successful SecOps Strategy
July 24, 2017

Pete Cheslock
Threat Stack

What is SecOps? Is it a team, a job title, or a methodology?

Depending on the size of your company, it could be a mix of all three. When smaller companies implement SecOps methodologies, security is everyone's job. Larger companies have entire teams devoted to helping them achieve "SecOps" — making it hard to create a blanket term for the industry.

In broad brush strokes, SecOps is a seamless collaboration between your IT security and IT operations teams. The goal is to streamline security processes, and ensure that every piece of code that makes it into production is as secure as possible.

If you've ever thought of revamping your company's current security operations to make it more agile, or if you've been thinking about building out a SecOps function, here are 5 tips you should keep in mind:

1. Have a plan

When setting out to integrate your security and operations teams, make sure you have a plan in place so you're able to get your SecOps program off the ground and running. In order to pull together a fleshed-out plan, here are some questions you should ask yourself:

■ What are you trying to accomplish?

Advice: Don't try to do everything at once. Focus on one or two things and make sure they are specific, measurable, achievable, relevant, and timely.

■ What is your team going to execute on?

Advice: Be very clear who on your team will do what by when. Ideally, you should create a list of action items that read like a playbook that can be implemented right away.

■ What can you use to help accomplish your goal?

Advice: Most of the time starting a SecOps program involves moving around internal resources, so you might not need to ask for extra resources or budget.

2. Designate stakeholders

Next, make sure you pick the right people to help you get your SecOps program off the ground. I recommend taking a top-down, bottom up approach. You'll need to pitch the C-suite (and other executive decision makers) on exactly how SecOps will benefit the company's security posture (and bottom line).

Next, you'll need to get the developers and security team on your side, as they'll be the people doing a lot of heavy lifting behind this change. It may not be an easy conversation for you to begin, but once you've elaborated on what SecOps can do for your company, the decision to embrace it will become much easier.

3. Train your new team

Traditionally, Security, Dev, and Ops teams are siloed. In some cases your Dev and Ops teams have no idea what their security counterparts are doing, and vice versa. This means when you begin integrating the teams, there will be a significant learning curve for all parties involved. To get your teams up to speed (and ready to implement your SecOps strategy), I recommend you do the following in your first team meeting:

■ Have a security pro share what their day-to-day work is like

■ Have a member of the Dev and/or Ops team share what their day-to-day is like

■ Provide an overview of SecOps use cases (like testing codes for vulnerabilities)

■ Breakdown the new strategy, and list action items so everyone understand the new process, and what they're responsible for

4. Put processes in place

Just like with any new project, you're likely to run into a few problems early on. To make sure your new plan isn't thrown off-course, you should implement processes so that people working together will know how to handle any curveball that comes their way.

Example:

If developer A deploys code, your team should be able to answer:

■ What tool they used to scan for vulnerabilities in the code

■ Who reviewed alerts from the vulnerability scan

■ Who is giving feedback to developer A

Seems simple, right? However, the best way to make sure everyone is on board is to communicate workflows with your team. Provide them with an end-to-end description of tasks, the processes you want to implement, and then repeat and iterate ad infinitum.

Though this sounds like a lot of upfront work, this will save you a great deal of time and legwork later on. It'll also reduce errors that happen when tasks fall through the cracks, and keep everyone on the same page.

5. Know How to Measure Success

You've put this new plan in place — now you should be able to prove that it's working! Chances are your executive team will be wondering how effective this new methodology is. Since you implemented it, chances are that you'll need to prove that any budget and resources you requested are worth it.

Here are some questions you should be able to answer, if your executive team asks, after implementing a SecOps program:

■ Could you deploy a patch today?

■ How often are you able to identify the need for a security patch?

■ How fast do security alerts get to you?

You should also have metrics, or KPIs, to show quantitative improvements in security thanks to your new SecOps implementation. Be sure to tailor these numbers to your specific industry, that way you can measure against what really matters, and show that you're continuing to move the security needle.

Perhaps most importantly when setting up metrics: make them realistic. No matter how thorough you and your team are, your security will never be perfect. Do the best with what you have, and strive for something you think you can accomplish (understanding that there will be some hiccups along the way). Just make sure you always seek to improve, and let your KPIs help keep you moving forward.

Pete Cheslock is Sr. Director, Ops & Support, at Threat Stack
Share this

Industry News

March 28, 2024

Check Point® Software Technologies Ltd. announced a collaboration with Microsoft that utilizes the Microsoft Azure OpenAI Service to enhance Check Point Infinity AI Copilot, marking a significant advancement in cyber security AI applications.

March 28, 2024

ArmorCode announced ArmorCode Risk Prioritization, providing a 3D scoring approach for managing application security risks.

March 28, 2024

AppViewX and Fortanix announced a partnership to offer cloud-delivered secure digital identity management and code signing.

March 27, 2024

WaveMaker has updated its platform in response to customer demand for more sophisticated API and code management tools.

March 27, 2024

Vercara announced the launch of UltraAPI™, a product suite that protects APIs and web applications from malicious bots and fraudulent activity while ensuring regulatory compliance.

March 27, 2024

Legit Security announced the launch of its standalone enterprise secrets scanning product, which can detect, remediate, and prevent secrets exposure across the software development pipeline.

March 26, 2024

Progress announced a strategic partnership with Veeam® Software, the #1 leader by market share in Data Protection and Ransomware Recovery, to provide customers with an enterprise-ready cyber defense solution that strengthens the security of their business-critical data.

March 26, 2024

GitGuardian released its Software Composition Analysis (SCA) module.

March 26, 2024

DataStax announced a milestone in its journey to simplify enterprise retrieval-augmented generation (RAG) for developers by integrating with Microsoft Semantic Kernel.

March 25, 2024

Check Point® Software Technologies Ltd. is collaborating with NVIDIA to enhance the security of AI cloud infrastructure. Integrating NVIDIA BlueField DPUs, which feature a broad range of purpose-built, innovative security capabilities, the new Check Point AI Cloud Protect solution will help prevent threats at both the network and host levels.

March 25, 2024

Sentry announced the release of Autofix, an AI-powered feature to debug and fix code in minutes, saving important time and resources.

March 25, 2024

Apiiro announced a product integration and partnership with Secure Code Warrior, the agile developer security training platform, to extend its ASPM technology and processes to the people layer.

March 21, 2024

Progress announced that Progress® Semaphore™, its metadata management and semantic AI platform, was named a Champion in SoftwareReviews’ 2024 Metadata Management Emotional Footprint Awards.

March 21, 2024

The Cloud Native Computing Foundation® (CNCF®) has partnered with Udemy, an online skills marketplace and learning platform.

March 21, 2024

GitLab has acquired Oxeye, the provider of a cloud-native application security and risk management solution.