Implementing SecOps Within an IT Infrastructure in Transition - Part 2
July 31, 2018

Pete Cheslock
Threat Stack

Even organizations that understand the importance of cybersecurity in theory often stumble when it comes to marrying security initiatives with their development and operations processes. Most businesses agree that everyone should be responsible for security, but this principle is not being upheld on a day-to-day basis in many organizations. That’s bad news for everyone.

Start with Implementing SecOps Within an IT Infrastructure in Transition - Part 1

SecOps Pitfalls and Best Practices

Here are some best practices for implementing SecOps:

1. System Access & Users

The " target="_blank">principle of least privilege should always be top of mind for organizations when it comes to system access and users. While you may have modeled it into your policies, achieving security maturity in this area means that you have also embedded the principle of least privilege into your tools and day-to-day processes. By systematically automating and verifying your user access policies, you reduce the risk of human oversight that could enable insider threats.

2. Patching & Vulnerability Management

Patching vulnerabilities seems like an easy enough task, but companies aren’t doing it with nearly enough regularity, giving attackers plenty of time to exploit known vulnerabilities that are months (or even years) old. To mitigate these vulnerabilities and achieve security maturity, your organization’s approach to patching should be standardized, automated, and built with sufficient resiliency to withstand automatic software updates. 

3. Infrastructure Control Plane (AWS Console/API)

When operating in the cloud, APIs and management consoles are the functional equivalent of data center access. Unlike with a data center, however, securing only your own networks is not enough to secure the cloud because this approach leaves APIs exposed. To achieve SecOps maturity with respect to the infrastructure control plane, it’s necessary to evolve your security approach by handling public cloud management consoles and APIs with the same level of sensitivity as a data center. This involves automating the shutoff of access to insecure or potentially compromised systems.

4. Networking

Network topologies are still the primary means by which security and operations teams restrict access between systems, but with environments that are more complex and interconnected than ever before, traditional network security controls aren’t sufficient. Instead, servers should be grouped by role, leveraging automation to establish small network paths to model trust between peers, and architecture should run over the WAN rather than LANs. SecOps maturity in this area, therefore, means that you have modeled authentication and authorization and are not relying on the underlying network topology to define security.

5. Runtime & Services

Both operations and security teams benefit from the standardization of runtimes and software management, continuous integration, and streamlined software development life cycles, so the alignment of goals in these areas should be relatively easy. With shared objectives, infrastructure and runtimes can function as a shared utility, allowing engineers to innovate within these common structures. It’s necessary to apply the same principles across teams in order to achieve SecOps maturity with regard to runtimes and services, thereby increasing efficiency and helping to minimize the risk of failure.

As SMBs and enterprises alike continue to leverage cost-effective solutions for developing secure applications in less time, SecOps is becoming a prominent philosophy across organizations of all sizes. By implementing SecOps, companies can reap a multitude of benefits stemming from the integration of operations, security, and development functions and the alignment of their goals, including more efficient operations, reduced resource utilization, fewer cloud and app security issues and disruptions, and more.

Pete Cheslock is Sr. Director, Ops & Support, at Threat Stack

The Latest

October 22, 2018

Embracing DevOps at enterprise scale requires a seismic shift in the way an organization plans, builds, tests, releases, and manages applications. Here are four ways to ensure your enterprise DevOps transformation is a success ...

October 18, 2018

Are applications teams prepared to manage the chaos arising from an ever-growing landscape of heterogeneous deployment types? A recent survey of application and operations professionals sought to better understand how the industry is shifting and what the future of DevOps might look like. Here is what the survey uncovered ...

October 16, 2018

More than half of organizations have a dedicated DevOps team to help them better implement agile strategies, accelerate release cycles and ensure continuous development. However, databases have a habit of holding DevOps back ...

October 15, 2018

Test Environment Management can save organizations close to $10,000 for each release, yet only four percent of large enterprises have fully integrated TEM processes into organizational DNA, according to the 2018 Test Environment Management Survey released by EMA and Plutora ...

October 11, 2018

Agile is indeed expanding across the enterprise and there was a significant jump from last year to this year in the percentage of respondents who indicated that all or almost all of their teams were agile, according to the State of Agile 2018 report from CollabNet ...

October 09, 2018

Adopting a modern application architecture is critical to business success and a significant driver of profit growth in today’s digital economy, according to the results of a global survey of IT and business executives released by CA Technologies and conducted by Frost & Sullivan ...

October 04, 2018

How do you integrate tools to enable shift-left performance? The following tools will simplify maintenance, can be managed in a centralized way, and provide an easy-to-use UI to comprehend results ...

October 03, 2018

Focusing at the API layer of an application can help enable a scalable testing practice that can be efficiently executed as part of an accelerated delivery process, and is a practice that can be adopted and enabled at the earliest possible stages of development — truly shifting left functional testing. But what about performance testing? How do we enable the shift left of nonfunctional testing? Here, we explore what this means and how to enable it in your organization ...

October 01, 2018

As businesses look to capitalize on the benefits offered by the cloud, we've seen the rise of the DevOps practice which, in common with the cloud, offers businesses the advantages of greater agility, speed, quality and efficiency. However, achieving this agility requires end-to-end visibility based on continuous monitoring of the developed applications as part of the software development life cycle ...

September 27, 2018

Imagine that you are tasked with architecting a mission-critical cloud application. Or migrating an on-premise app to the cloud. You may ask yourself, "how do the cloud savvy companies like Airbnb, Adobe, SalesForce, etc. build and manage their modern applications?" ...

Share this