DEVOPSdigest

What is SecOps? Is it a team, a job title, or a methodology?

Depending on the size of your company, it could be a mix of all three. When smaller companies implement SecOps methodologies, security is everyone's job. Larger companies have entire teams devoted to helping them achieve "SecOps" — making it hard to create a blanket term for the industry.

In broad brush strokes, SecOps is a seamless collaboration between your IT security and IT operations teams. The goal is to streamline security processes, and ensure that every piece of code that makes it into production is as secure as possible.

If you've ever thought of revamping your company's current security operations to make it more agile, or if you've been thinking about building out a SecOps function, here are 5 tips you should keep in mind:

1. Have a plan

When setting out to integrate your security and operations teams, make sure you have a plan in place so you're able to get your SecOps program off the ground and running. In order to pull together a fleshed-out plan, here are some questions you should ask yourself:

■ What are you trying to accomplish?

Advice: Don't try to do everything at once. Focus on one or two things and make sure they are specific, measurable, achievable, relevant, and timely.

■ What is your team going to execute on?

Advice: Be very clear who on your team will do what by when. Ideally, you should create a list of action items that read like a playbook that can be implemented right away.

■ What can you use to help accomplish your goal?

Advice: Most of the time starting a SecOps program involves moving around internal resources, so you might not need to ask for extra resources or budget.

2. Designate stakeholders

Next, make sure you pick the right people to help you get your SecOps program off the ground. I recommend taking a top-down, bottom up approach. You'll need to pitch the C-suite (and other executive decision makers) on exactly how SecOps will benefit the company's security posture (and bottom line).

Next, you'll need to get the developers and security team on your side, as they'll be the people doing a lot of heavy lifting behind this change. It may not be an easy conversation for you to begin, but once you've elaborated on what SecOps can do for your company, the decision to embrace it will become much easier.

3. Train your new team

Traditionally, Security, Dev, and Ops teams are siloed. In some cases your Dev and Ops teams have no idea what their security counterparts are doing, and vice versa. This means when you begin integrating the teams, there will be a significant learning curve for all parties involved. To get your teams up to speed (and ready to implement your SecOps strategy), I recommend you do the following in your first team meeting:

■ Have a security pro share what their day-to-day work is like

■ Have a member of the Dev and/or Ops team share what their day-to-day is like

■ Provide an overview of SecOps use cases (like testing codes for vulnerabilities)

■ Breakdown the new strategy, and list action items so everyone understand the new process, and what they're responsible for

4. Put processes in place

Just like with any new project, you're likely to run into a few problems early on. To make sure your new plan isn't thrown off-course, you should implement processes so that people working together will know how to handle any curveball that comes their way.

Example:

If developer A deploys code, your team should be able to answer:

■ What tool they used to scan for vulnerabilities in the code

■ Who reviewed alerts from the vulnerability scan

■ Who is giving feedback to developer A

Seems simple, right? However, the best way to make sure everyone is on board is to communicate workflows with your team. Provide them with an end-to-end description of tasks, the processes you want to implement, and then repeat and iterate ad infinitum.

Though this sounds like a lot of upfront work, this will save you a great deal of time and legwork later on. It'll also reduce errors that happen when tasks fall through the cracks, and keep everyone on the same page.

5. Know How to Measure Success

You've put this new plan in place — now you should be able to prove that it's working! Chances are your executive team will be wondering how effective this new methodology is. Since you implemented it, chances are that you'll need to prove that any budget and resources you requested are worth it.

Here are some questions you should be able to answer, if your executive team asks, after implementing a SecOps program:

■ Could you deploy a patch today?

■ How often are you able to identify the need for a security patch?

■ How fast do security alerts get to you?

You should also have metrics, or KPIs, to show quantitative improvements in security thanks to your new SecOps implementation. Be sure to tailor these numbers to your specific industry, that way you can measure against what really matters, and show that you're continuing to move the security needle.

Perhaps most importantly when setting up metrics: make them realistic. No matter how thorough you and your team are, your security will never be perfect. Do the best with what you have, and strive for something you think you can accomplish (understanding that there will be some hiccups along the way). Just make sure you always seek to improve, and let your KPIs help keep you moving forward.