The Cultural Triad: How to Embed Security into Company Culture with Partnerships, Cooperation and Collaboration
February 10, 2022

Michael Eisenberg
Coalfire

To arrive at a risk-based product development lifecycle, there must be a risk-based culture. While nearly everything can be automated these days, the source code for early-warning risk management starts with people and teams, not machines.

Software development has worked in its own silo for generations, and traditional DevOps has allowed for this vacuum with little to no security involved. Since security is now a process of continuous integration and deployment, it is mission critical for CISOs and the DevSecOps teams to engage in deeper conversations together to start working through the obstacles. The ongoing proliferation of data breaches, bad actor disinformation campaigns, and the endangerment of customer data demands it.

But how does one begin to embed security into company culture? Let's start with the cultural triad — then discuss how to get there.


The Cultural Triad: Partnership, Cooperation, and Collaboration

When the CISO brings the DevSecOps initiative to the C-suite, it should stream into the very fiber of the organization. It must be embraced from above, without indifference, dismissiveness, or passive aggression. By top-level management embracing this framework, the CISO can more effectively set the playing field for seamless integration throughout the organization.

Foster partnerships. Application development and product managers typically don't go to security folks. To begin this pivotal partnership, security folks must go to them. There may be pushback and indifference at first, but to receive cooperation from all parties, it's imperative to overcome communication challenges in pursuit of DevSecOps success. Understand that development may have legitimate grievances with security or executive leadership, so tread carefully and address those grievances in a respectful way.

The best way to start the conversation is from the standpoint of customer priorities. Start talking with designers, developers, and engineers about the customer's threat perspective. The customers need assurance, and if they don't get it from you, they'll go somewhere else that provides and certifies it.

Seek cooperation. Once the security conversation with DevOps is underway, set the table with expectations. If agile methodologies are a part of software development's DNA, now is the time to integrate security into that DNA. In the new development lifecycle, security is everyone's responsibility, so be sure to clarify and delegate ownership and accountability. Leverage the organization's mission and purpose to merge security with quality and infuse it into the company's culture.

Embrace collaboration to drive revenue growth. After addressing the need for DevSecOps from a customer perspective, everyone should focus on management's prime directive: revenue growth. Corporate officers and directors are measured and compensated by how well they deliver benefits to shareholders. A breach, a fine, or lost customer trust will have dramatic and direct impact on this calculation. Security can no longer be viewed solely as a cost center; instead, it is essential to generating revenue.

A collaborative corporate mindset empowers employees with more portable skills that enable career advancement and instills confidence in their technical abilities. It also embraces the principles of diversity, equity, and inclusion to create a mosaic of ideas and backgrounds. With this recognition, everyone is better equipped to understand their role, and how they can contribute unique skills and perspectives to the “security-focused” company culture in a meaningful way.

Security Leaders Can Lead the Transformation

Secure products have become value propositions and trigger points for purchasing decisions. The secure product lifecycle is closer than ever to everyone's core business, and everyone knows it. Customers expect it, and marketing is talking about it. Security has become more cross-functional by necessity, and with that, the surrounding corporate culture that supports it. A risk-based culture focused on threat modeling and the logical prioritization of vulnerabilities makes all this possible.

Security leaders are in the perfect position to help create a risk-based culture. Developers need to exercise risk-based team collaboration through cooperative partnerships. Examples:

■ Partner with someone in security to run tests on what they're building

■ Use procurement and vendor management to validate desired third-party software

■ Work with legal to sort out open-source contract issues

■ Communicate with marketing in putting a public face on the secure app they have created

That's a lot of people, and many teams to work with, compared to the smaller microcosm of stakeholders that developers typically interacted with 10 to 15 years ago.

Ask questions. Ask for help and advice. Role play, humanize and align. Partnership, cooperation, and collaboration are the cultural disciplines that bridge the gaps between development and security operations, and into the new methodology of DevSecOps. The alignment created through a risk-based culture strengthens the development lifecycle and produces better applications that protect the customer, the product, and the company.

Michael Eisenberg is VP, Strategy, Privacy, Risk, at Coalfire
Share this

Industry News

September 22, 2022

Katalon announced the launch of the Katalon Platform, a modern and comprehensive software quality management platform that enables teams of any size to easily and efficiently test, launch, and optimize apps, products, and software.

September 22, 2022

StackHawk announced its Deeper API Security Test Coverage release.

September 21, 2022

Platform9 announced the launch of its latest open source project, Arlon.

September 21, 2022

Redpanda Data announced Redpanda Console.

September 21, 2022

mabl announced its availability as a private listing on Google Cloud Marketplace.

September 21, 2022

Zesty announced a $75 million Series B funding round led by B Capital and Series A investor Sapphire Ventures.

September 20, 2022

Opsera, the Continuous Orchestration platform for DevOps, announced a free trial of its no-code Salesforce Release Management platform for fast and secure Salesforce releases.

September 20, 2022

Sysdig announced ToDo and Remediation Guru.

September 20, 2022

AutoRABIT announced CodeScan Shield.

September 19, 2022

Akuity.io announced the general availability of the Akuity Platform, a fully-managed SaaS service for simpler, safer and faster Kubernetes application delivery, using Argo.

September 19, 2022

Rocket Software launched Rocket® Support for Zowe, a supporting offering for the Open Mainframe Project’s Zowe® open-source framework for z/OS® and its multiple modern interfaces.

September 19, 2022

Appfire announced the acquisition of German company 7pace.

September 15, 2022

Dell Technologies is expanding its long-standing strategic relationship with Red Hat to offer new solutions that simplify deploying and managing on-premises, containerized infrastructure in multicloud environments.

September 15, 2022

Postman announced Postman v10, the most significant upgrade to the platform in almost a year, offering new features around API governance and security, as well as expanded capabilities in collaboration and integration—and higher productivity than ever.

September 15, 2022

Harness announced the general availability of fully managed Harness GitOps-as-a-Service to enable enterprise continuous delivery (CD) workflows for application and infrastructure deployments.