The First Steps on a CISOs DevOps Journey

CISOs DevOps

The marriage between DevOps and Security is rapidly gaining traction. Security is shifting from its former mindset of being its own silo to getting on the same agenda as their developer counterparts. For CISOs the opportunity to get security baked in has never been as achievable, but they need to focus on building that synergistic foundation between DevOps and Security. Following are some Golden Rules for CISOs looking to make the most of the agility DevOps brings:

The first step is developing a mutual understanding. To get on the same page as your development team figure out:

  • What their business goals are
  • How they are going to meet their goals with their devops pipeline
  • What tools they are using
  • What kind of efficiencies they are looking to achieve

Then align security to support DevOps in each of those areas.

Conversely, ensuring that DevOps understands Security’s goals and is actively looking to ensure compliance to the organization’s security policies. The DevOps paradigm is a key opportunity to get compliance policies built in earlier into the software development cycle through closer collaboration with developers.

  1. Build trust and credibility: Related to the first step, after you understand your developers’ end game, do what you tell them you are going to do, and understand and empathize with their struggles. This makes it much easier to create a climate of mutual understanding and trust.
  2. Embed security into the overall developer chain: It not only speeds up the development process, it makes it more secure. However, DevOps needs a compelling case to put in the required effort and Security has to come to the table as a collaborator versus with a list of demands. For example,
    1. Ensure that access to GitHub repositories is not broader than required and that developers are careful with login credentials per this being a noted breach vector
    2. Automate and where not possible conduct manual system and network security assessments are built into the software development lifecycle
    3. Work with developers to ensure the passwords are compliant, that they are being rotated
    4. Apply encryption at rest, in use and in transit
  1. Get involved in open source. Increasingly developers and companies are relying on open source software. However, there’s no standard way of documenting security in open source projects so it becomes important to build security into the development process and check and re-check applications for Vulnerabilities. The upside for CISOs is that through utilizing open source software they get the opportunity for many eyes to look over their software and therefore, bugs and vulnerabilities get discovered faster.
  2. Treat security as an ever-changing practice that one has to stay on top off and alter practices as the landscape changes. Organizations that offer developers and security teams the opportunity to cross-train will find that they develop security-conscious developers and security teams that are business focused. This is an opportunity for security teams to come up to speed with developer tool such as Chef and Puppet while developers get to learn about vulnerability management and other security tools and practices.

By Evelyn De Souza

Hair Loss.png
Viral Infection Wearabletech
The Manuscript.png
Byod.png
Gilad David Maayan
What Are Kubernetes Errors? Kubernetes is an open-source container orchestration system for automating software deployment, scaling, and management of containerized applications. There are many types of errors that can occur when using Kubernetes. Some common ...
Louis
More CISOs will have to deliver revenue growth to protect their budgets and grow their careers in 2023 and beyond, and a core part of that will be getting multicloud security right. It’s the most common infrastructure strategy for ...
Ronald van Loon
5G networks are expanding to drive new, diverse use cases and innovative mobile-first experiences. Organizations are preparing their 5G strategies accordingly to help fuel transformation, support digital business processes, and improve how people collaborate and ...
Wealth Management Software Solutions - ServiceNow
Financial wealth management services (Updated: 06/29/2022) Many want to live in abundance, but very few people have what it takes to harness true wealth. True wealth is harnessed through the effective management of resources. Despite ...
Veljko
Blockchain and the Cloud When the word “blockchain” comes up in a conversation, many people will associate it with Bitcoin and cryptocurrencies. Although the connection is absolutely accurate, the use of blockchain doesn’t stop at ...