Implementing SecOps Within an IT Infrastructure in Transition - Part 2
July 31, 2018

Pete Cheslock
Threat Stack

Even organizations that understand the importance of cybersecurity in theory often stumble when it comes to marrying security initiatives with their development and operations processes. Most businesses agree that everyone should be responsible for security, but this principle is not being upheld on a day-to-day basis in many organizations. That’s bad news for everyone.

Start with Implementing SecOps Within an IT Infrastructure in Transition - Part 1

SecOps Pitfalls and Best Practices

Here are some best practices for implementing SecOps:

1. System Access & Users

The " target="_blank">principle of least privilege should always be top of mind for organizations when it comes to system access and users. While you may have modeled it into your policies, achieving security maturity in this area means that you have also embedded the principle of least privilege into your tools and day-to-day processes. By systematically automating and verifying your user access policies, you reduce the risk of human oversight that could enable insider threats.

2. Patching & Vulnerability Management

Patching vulnerabilities seems like an easy enough task, but companies aren’t doing it with nearly enough regularity, giving attackers plenty of time to exploit known vulnerabilities that are months (or even years) old. To mitigate these vulnerabilities and achieve security maturity, your organization’s approach to patching should be standardized, automated, and built with sufficient resiliency to withstand automatic software updates. 

3. Infrastructure Control Plane (AWS Console/API)

When operating in the cloud, APIs and management consoles are the functional equivalent of data center access. Unlike with a data center, however, securing only your own networks is not enough to secure the cloud because this approach leaves APIs exposed. To achieve SecOps maturity with respect to the infrastructure control plane, it’s necessary to evolve your security approach by handling public cloud management consoles and APIs with the same level of sensitivity as a data center. This involves automating the shutoff of access to insecure or potentially compromised systems.

4. Networking

Network topologies are still the primary means by which security and operations teams restrict access between systems, but with environments that are more complex and interconnected than ever before, traditional network security controls aren’t sufficient. Instead, servers should be grouped by role, leveraging automation to establish small network paths to model trust between peers, and architecture should run over the WAN rather than LANs. SecOps maturity in this area, therefore, means that you have modeled authentication and authorization and are not relying on the underlying network topology to define security.

5. Runtime & Services

Both operations and security teams benefit from the standardization of runtimes and software management, continuous integration, and streamlined software development life cycles, so the alignment of goals in these areas should be relatively easy. With shared objectives, infrastructure and runtimes can function as a shared utility, allowing engineers to innovate within these common structures. It’s necessary to apply the same principles across teams in order to achieve SecOps maturity with regard to runtimes and services, thereby increasing efficiency and helping to minimize the risk of failure.

As SMBs and enterprises alike continue to leverage cost-effective solutions for developing secure applications in less time, SecOps is becoming a prominent philosophy across organizations of all sizes. By implementing SecOps, companies can reap a multitude of benefits stemming from the integration of operations, security, and development functions and the alignment of their goals, including more efficient operations, reduced resource utilization, fewer cloud and app security issues and disruptions, and more.

Pete Cheslock is Sr. Director, Ops & Support, at Threat Stack
Share this

Industry News

June 27, 2022

Delinea announced the latest release of DevOps Secrets Vault.

June 27, 2022

Jit announced a $38.5 million seed funding round and launched a free beta version which automates product security.

June 27, 2022

Platform.sh raised $140 million in Series D funding.

June 23, 2022

Akana by Perforce now offers BlazeMeter to customers, previously a solution with Broadcom Layer7.

June 23, 2022

Coder announced the release of a new open source project that gives developers and data scientists a consistent, secure, yet flexible way to create cloud workspaces in minutes.

June 23, 2022

GitGuardian is announcing a series of new features to address developer experience in securing the software development lifecycle.

June 22, 2022

OctoML released a major platform expansion to accelerate the development of AI-powered applications by eliminating bottlenecks in machine learning deployment.

June 22, 2022

Snow Software announced new functionality and integrations for Snow Atlas, a purpose-built platform that provides a framework to accelerate data-driven technology decision-making.

June 22, 2022

Traefik Labs launched Traefik Hub, a new cloud service that eliminates the complexity of management and automation of Kubernetes and Docker networking at scale.

June 21, 2022

The Linux Foundation, the nonprofit organization enabling mass innovation through open source, announced the new Open Programmable Infrastructure (OPI) Project.

June 21, 2022

Docker announced the acquisition of Atomist, a company founded to improve developer productivity and keep cloud native applications safe.

June 21, 2022

SmartBear released BitBar, an all-in-one web and native mobile app testing solution.

June 16, 2022

Armory announced general availability of Armory Continuous Deployment-as-a-Service.

June 16, 2022

Infragistics announced the launch of App Builder On-Prem.

June 16, 2022

LambdaTest launched Test-at-Scale (TAS), a test intelligence and observability platform, to help development teams with shift-left testing.