Implementing SecOps Within an IT Infrastructure in Transition - Part 2
July 31, 2018

Pete Cheslock
Threat Stack

Even organizations that understand the importance of cybersecurity in theory often stumble when it comes to marrying security initiatives with their development and operations processes. Most businesses agree that everyone should be responsible for security, but this principle is not being upheld on a day-to-day basis in many organizations. That’s bad news for everyone.

Start with Implementing SecOps Within an IT Infrastructure in Transition - Part 1

SecOps Pitfalls and Best Practices

Here are some best practices for implementing SecOps:

1. System Access & Users

The " target="_blank">principle of least privilege should always be top of mind for organizations when it comes to system access and users. While you may have modeled it into your policies, achieving security maturity in this area means that you have also embedded the principle of least privilege into your tools and day-to-day processes. By systematically automating and verifying your user access policies, you reduce the risk of human oversight that could enable insider threats.

2. Patching & Vulnerability Management

Patching vulnerabilities seems like an easy enough task, but companies aren’t doing it with nearly enough regularity, giving attackers plenty of time to exploit known vulnerabilities that are months (or even years) old. To mitigate these vulnerabilities and achieve security maturity, your organization’s approach to patching should be standardized, automated, and built with sufficient resiliency to withstand automatic software updates. 

3. Infrastructure Control Plane (AWS Console/API)

When operating in the cloud, APIs and management consoles are the functional equivalent of data center access. Unlike with a data center, however, securing only your own networks is not enough to secure the cloud because this approach leaves APIs exposed. To achieve SecOps maturity with respect to the infrastructure control plane, it’s necessary to evolve your security approach by handling public cloud management consoles and APIs with the same level of sensitivity as a data center. This involves automating the shutoff of access to insecure or potentially compromised systems.

4. Networking

Network topologies are still the primary means by which security and operations teams restrict access between systems, but with environments that are more complex and interconnected than ever before, traditional network security controls aren’t sufficient. Instead, servers should be grouped by role, leveraging automation to establish small network paths to model trust between peers, and architecture should run over the WAN rather than LANs. SecOps maturity in this area, therefore, means that you have modeled authentication and authorization and are not relying on the underlying network topology to define security.

5. Runtime & Services

Both operations and security teams benefit from the standardization of runtimes and software management, continuous integration, and streamlined software development life cycles, so the alignment of goals in these areas should be relatively easy. With shared objectives, infrastructure and runtimes can function as a shared utility, allowing engineers to innovate within these common structures. It’s necessary to apply the same principles across teams in order to achieve SecOps maturity with regard to runtimes and services, thereby increasing efficiency and helping to minimize the risk of failure.

As SMBs and enterprises alike continue to leverage cost-effective solutions for developing secure applications in less time, SecOps is becoming a prominent philosophy across organizations of all sizes. By implementing SecOps, companies can reap a multitude of benefits stemming from the integration of operations, security, and development functions and the alignment of their goals, including more efficient operations, reduced resource utilization, fewer cloud and app security issues and disruptions, and more.

Pete Cheslock is Sr. Director, Ops & Support, at Threat Stack
Share this

Industry News

April 17, 2025

GitLab announced the general availability of GitLab Duo with Amazon Q.

April 17, 2025

Perforce Software and Liquibase announced a strategic partnership to enhance secure and compliant database change management for DevOps teams.

April 17, 2025

Spacelift announced the launch of Saturnhead AI — an enterprise-grade AI assistant that slashes DevOps troubleshooting time by transforming complex infrastructure logs into clear, actionable explanations.

April 16, 2025

CodeSecure and FOSSA announced a strategic partnership and native product integration that enables organizations to eliminate security blindspots associated with both third party and open source code.

April 16, 2025

Bauplan, a Python-first serverless data platform that transforms complex infrastructure processes into a few lines of code over data lakes, announced its launch with $7.5 million in seed funding.

April 15, 2025

Perforce Software announced the launch of the Kafka Service Bundle, a new offering that provides enterprises with managed open source Apache Kafka at a fraction of the cost of traditional managed providers.

April 14, 2025

LambdaTest announced the launch of the HyperExecute MCP Server, an enhancement to its AI-native test orchestration platform, HyperExecute.

April 14, 2025

Cloudflare announced Workers VPC and Workers VPC Private Link, new solutions that enable developers to build secure, global cross-cloud applications on Cloudflare Workers.

April 14, 2025

Nutrient announced a significant expansion of its cloud-based services, as well as a series of updates to its SDK products, aimed at enhancing the developer experience by allowing developers to build, scale, and innovate with less friction.

April 10, 2025

Check Point® Software Technologies Ltd. announced that its Infinity Platform has been named the top-ranked AI-powered cyber security platform in the 2025 Miercom Assessment.

April 10, 2025

Orca Security announced the Orca Bitbucket App, a cloud-native seamless integration for scanning Bitbucket Repositories.

April 10, 2025

The Live API for Gemini models is now in Preview, enabling developers to start building and testing more robust, scalable applications with significantly higher rate limits.

April 09, 2025

Backslash Security announced significant adoption of the Backslash App Graph, the industry’s first dynamic digital twin for application code.

April 09, 2025

SmartBear launched API Hub for Test, a new capability within the company’s API Hub, powered by Swagger.

April 09, 2025

Akamai Technologies introduced App & API Protector Hybrid.