The Cultural Triad: How to Embed Security into Company Culture with Partnerships, Cooperation and Collaboration
February 10, 2022

Michael Eisenberg

To arrive at a risk-based product development lifecycle, there must be a risk-based culture. While nearly everything can be automated these days, the source code for early-warning risk management starts with people and teams, not machines.

Software development has worked in its own silo for generations, and traditional DevOps has allowed for this vacuum with little to no security involved. Since security is now a process of continuous integration and deployment, it is mission critical for CISOs and the DevSecOps teams to engage in deeper conversations together to start working through the obstacles. The ongoing proliferation of data breaches, bad actor disinformation campaigns, and the endangerment of customer data demands it.

But how does one begin to embed security into company culture? Let's start with the cultural triad — then discuss how to get there.

The Cultural Triad: Partnership, Cooperation, and Collaboration

When the CISO brings the DevSecOps initiative to the C-suite, it should stream into the very fiber of the organization. It must be embraced from above, without indifference, dismissiveness, or passive aggression. By top-level management embracing this framework, the CISO can more effectively set the playing field for seamless integration throughout the organization.

Foster partnerships. Application development and product managers typically don't go to security folks. To begin this pivotal partnership, security folks must go to them. There may be pushback and indifference at first, but to receive cooperation from all parties, it's imperative to overcome communication challenges in pursuit of DevSecOps success. Understand that development may have legitimate grievances with security or executive leadership, so tread carefully and address those grievances in a respectful way.

The best way to start the conversation is from the standpoint of customer priorities. Start talking with designers, developers, and engineers about the customer's threat perspective. The customers need assurance, and if they don't get it from you, they'll go somewhere else that provides and certifies it.

Seek cooperation. Once the security conversation with DevOps is underway, set the table with expectations. If agile methodologies are a part of software development's DNA, now is the time to integrate security into that DNA. In the new development lifecycle, security is everyone's responsibility, so be sure to clarify and delegate ownership and accountability. Leverage the organization's mission and purpose to merge security with quality and infuse it into the company's culture.

Embrace collaboration to drive revenue growth. After addressing the need for DevSecOps from a customer perspective, everyone should focus on management's prime directive: revenue growth. Corporate officers and directors are measured and compensated by how well they deliver benefits to shareholders. A breach, a fine, or lost customer trust will have dramatic and direct impact on this calculation. Security can no longer be viewed solely as a cost center; instead, it is essential to generating revenue.

A collaborative corporate mindset empowers employees with more portable skills that enable career advancement and instills confidence in their technical abilities. It also embraces the principles of diversity, equity, and inclusion to create a mosaic of ideas and backgrounds. With this recognition, everyone is better equipped to understand their role, and how they can contribute unique skills and perspectives to the “security-focused” company culture in a meaningful way.

Security Leaders Can Lead the Transformation

Secure products have become value propositions and trigger points for purchasing decisions. The secure product lifecycle is closer than ever to everyone's core business, and everyone knows it. Customers expect it, and marketing is talking about it. Security has become more cross-functional by necessity, and with that, the surrounding corporate culture that supports it. A risk-based culture focused on threat modeling and the logical prioritization of vulnerabilities makes all this possible.

Security leaders are in the perfect position to help create a risk-based culture. Developers need to exercise risk-based team collaboration through cooperative partnerships. Examples:

■ Partner with someone in security to run tests on what they're building

■ Use procurement and vendor management to validate desired third-party software

■ Work with legal to sort out open-source contract issues

■ Communicate with marketing in putting a public face on the secure app they have created

That's a lot of people, and many teams to work with, compared to the smaller microcosm of stakeholders that developers typically interacted with 10 to 15 years ago.

Ask questions. Ask for help and advice. Role play, humanize and align. Partnership, cooperation, and collaboration are the cultural disciplines that bridge the gaps between development and security operations, and into the new methodology of DevSecOps. The alignment created through a risk-based culture strengthens the development lifecycle and produces better applications that protect the customer, the product, and the company.

Michael Eisenberg is VP, Strategy, Privacy, Risk, at Coalfire
Share this

Industry News

October 02, 2023

Spectro Cloud announced Palette EdgeAI to simplify how organizations deploy and manage AI workloads at scale across simple to complex edge locations, such as retail, healthcare, industrial automation, oil and gas, automotive/connected cars, and more.

September 28, 2023

Kong announced Kong Konnect Dedicated Cloud Gateways, the simplest and most cost-effective way to run Kong Gateways in the cloud fully managed as a service and on enterprise dedicated infrastructure.

September 28, 2023

Sisense unveiled the public preview of Compose SDK for Fusion.

September 28, 2023

Cloudflare announced Hyperdrive to make every local database global. Now developers can easily build globally distributed applications on Cloudflare Workers, the serverless developer platform used by over one million developers, without being constrained by their existing infrastructure.

September 27, 2023

Kong announced full support for Kong Mesh in Konnect, making Kong Konnect an API lifecycle management platform with built-in support for Kong Gateway Enterprise, Kong Ingress Controller and Kong Mesh via a SaaS control plane.

September 27, 2023

Vultr announced the launch of the Vultr GPU Stack and Container Registry to enable global enterprises and digital startups alike to build, test and operationalize artificial intelligence (AI) models at scale — across any region on the globe. \

September 27, 2023

Salt Security expanded its partnership with CrowdStrike by integrating the Salt Security API Protection Platform with the CrowdStrike Falcon® Platform.

September 26, 2023

Progress announced a partnership with Software Improvement Group (SIG), an independent technology and advisory firm for software quality, security and improvement, to help ensure the long-term maintainability and modernization of business-critical applications built on the Progress® OpenEdge® platform.

September 26, 2023

Solace announced a new version of its Solace Event Portal solution that gives organizations with Apache Kafka deployments better visibility into, and control over, their Kafka event streams, brokers and associated assets.

September 26, 2023

Reply launched a proprietary framework for generative AI-based software development, KICODE Reply.

September 26, 2023

Harness announced the industry-wide Engineering Excellence Collective™, an engineering leadership community.

September 25, 2023

Harness announced four new product modules on the Harness platform.

September 25, 2023

Sylabs announced the release of SingularityCE 4.0.

September 25, 2023

Timescale announced the launch of Timescale Vector, enabling developers to build production AI applications at scale with PostgreSQL.