5 Ways to Train Security Champions in Cross-Functional DevOps Teams - Part 1
August 28, 2019

Ed Adams
Security Innovation

As organizations seek to better embed security into DevOps and Agile software development, they're going to need to find better ways of scaling security knowledge across cross-functional teams.

Gone are the days where the security team can hold all the relevant knowledge for an IT organization and personally enact all the security checks on software code or infrastructure hosting applications. There are too many new applications and features being deployed, too much infrastructure spun up and down daily.

Everyone needs to chip in, and the only way they can do that is if companies properly train members of cross-functional teams on what it means to deploy secure software.

Cross-functional DevOps teams — and even non-DevOps teams moving toward continuous delivery of software — need all their members to skill up with both generalized and specific security training. From developers to DevOps engineers to site reliability specialists to database professionals, everyone needs to understand how security considerations impact the risk of the overall IT ecosystem they operate within, and how these security concerns should shape the work they do day in and out.

Here are five ways to accomplish that:

1. Raise the Bar on Security Awareness Across the Team

The goal for modern security training in the DevOps era should be two-fold. First, organizations should seek to generally elevate security awareness across all IT functions.

Second, they should seek to train an elite cadre of security champions with deeper levels of security knowledge who work in various capacities for the team.

The first objective of awareness isn't to make everyone deep security experts, but instead to raise the overall bar for awareness about security from anyone that touches the continuous delivery/continuous integration (CI/CD) software pipeline. This includes developers, but also QA engineers, operations professionals, DBAs and more.

The second objective recognizes that in a DevOps environment that deputizes technologists of all types to execute on security strategy, there are going to be times where the organization risks watering down deep technical security competence in the trenches. Seeding teams with at least a handful of security champions with deeper levels of security knowledge, as it applies to their specialty, ensures that things don't get overlooked.

DevOps depends on an increased collaboration between IT roles and self-service. The challenge is: as roles start to bleed into one another through deeper collaboration, individuals start to need a wider breadth of knowledge than ever before about how their actions impact the organization's threat posture. Take developers, for example: so much of application security (APPSEC) training today is focused solely on secure coding techniques, without accounting for the reality that developers today are spinning up servers, containers and otherwise self-provisioning the infrastructure their software is running on.

Even when developers take the best secure coding training available, they may be missing a whole lot of knowledge about the dangers of security misconfiguration when they're setting up their infrastructure.

There should be a core set of common knowledge that everyone needs to know about security principles: things like regulatory concerns, infrastructure issues, commonly used tools, and so on.

This would give your architects, developers, database administrators, and anyone else in the CI/CD world a common foundation of awareness. In this scenario, ideally they would all be asking themselves, “Is this the most secure way to do this task?”

At the same time, security champions who are more interested in the technical details of these issues should also have the opportunity to extend their learning path beyond the basics so they can bring greater technical knowledge to bear and act as a security resource for the rest of their team. Identifying and grooming these champions will ensure that the team has not only breadth but depth of knowledge as well.

2. Balance Traditional Training with Hands-On Learning Methods

Traditional training is still the best starting point for disseminating security knowledge across teams. Continuing professional education (CPE) classes and overviews are all relevant and help build a foundation of introductory awareness. They're not always the most exciting method of learning, but they are incredibly effective when paired with more advanced training.

At the same time, that traditional classroom training is more likely to stick with employees when supplemented with additional hands-on reinforcement. Security leaders hoping to build out security knowledge across the DevOps contingent should start exploring the benefits of gamification and simulation and how they can improve performance on the job.

Developers, IT operators, and architects are much more likely to appreciate the nuances of security risks when their book knowledge is paired with hands-on training in simulated environments, or some kind of area where they can appreciate what they're defending against. Rather than just saying, "Academically, here's what SQL injection is, here's how to defensively code against it," it's better to allow security champions to exploit those issues so they really understand them from all angles.

Read 5 Ways to Train Security Champions in Cross-Functional DevOps Teams - Part 2

Ed Adams is President and CEO of Security Innovation
Share this

Industry News

February 25, 2021

Red Hat announced Red Hat OpenShift 4.7, the latest version of the company’s enterprise Kubernetes platform.

February 25, 2021

Granulate announced the release of its open-source platform, the G-Profiler, a production profiling solution that measures the performance of code in production applications to facilitate compute optimization.

February 25, 2021

Checkmarx announced the launch of KICS (Keeping Infrastructure as Code Secure), an open source static analysis solution that enables developers to write more secure infrastructure as code (IaC).

February 24, 2021

Applause launched its Product Excellence Platform (PEP).

February 24, 2021

Mabl announced the beta release of their new native desktop application that empowers users to easily automate testing for browsers, mobile browsers, and APIs.

February 24, 2021

D2iQ announced the general availability of D2iQ Kaptain, the cloud native end-to-end platform for running ML workloads on Kubernetes.

February 23, 2021

Edge Delta announced new capabilities for dynamically processing and routing logs, metrics, and traces -- allowing DevOps, Security, and SRE teams to analyze large volumes of streaming data without the cost, delay, or complexity of requiring data to be indexed, helping customers decouple where machine data is analyzed from where it is stored.

February 23, 2021

env0 announced a remote run SaaS solution for the automation of Terragrunt workloads across multiple Terraform modules.

February 23, 2021

Platform9 closed its Series-D funding with an additional $12.5 million for a total of $37.5 million.

February 22, 2021

IT Revolution opened its Call for Presentations for both DevOps Enterprise Summit 2021 events in Europe and US.

February 22, 2021

Solo.io announced the general availability of Gloo Mesh Enterprise, an enterprise-grade, Kubernetes-native solution for service mesh management.

February 22, 2021

Copado closed $96 million in Series B funding, bringing the total funds invested in the company to $117 million.

February 18, 2021

ShiftLeft released ShiftLeft Illuminate, a new solution that leverages ShiftLeft technology to identify insider attacks, offer remediation advice and reduce overall risk to organizations’ software code base.

February 18, 2021

CircleCI introduced new platform updates to increase the control, protection, privacy, and confidence of today’s engineering teams.

February 18, 2021

OutSystems announced a $150 million capital raise.