The First Steps on a CISOs DevOps Journey

CISOs DevOps

The marriage between DevOps and Security is rapidly gaining traction. Security is shifting from its former mindset of being its own silo to getting on the same agenda as their developer counterparts. For CISOs the opportunity to get security baked in has never been as achievable, but they need to focus on building that synergistic foundation between DevOps and Security. Following are some Golden Rules for CISOs looking to make the most of the agility DevOps brings:

The first step is developing a mutual understanding. To get on the same page as your development team figure out:

  • What their business goals are
  • How they are going to meet their goals with their devops pipeline
  • What tools they are using
  • What kind of efficiencies they are looking to achieve

Then align security to support DevOps in each of those areas.

Conversely, ensuring that DevOps understands Security’s goals and is actively looking to ensure compliance to the organization’s security policies. The DevOps paradigm is a key opportunity to get compliance policies built in earlier into the software development cycle through closer collaboration with developers.

  1. Build trust and credibility: Related to the first step, after you understand your developers’ end game, do what you tell them you are going to do, and understand and empathize with their struggles. This makes it much easier to create a climate of mutual understanding and trust.
  2. Embed security into the overall developer chain: It not only speeds up the development process, it makes it more secure. However, DevOps needs a compelling case to put in the required effort and Security has to come to the table as a collaborator versus with a list of demands. For example,
    1. Ensure that access to GitHub repositories is not broader than required and that developers are careful with login credentials per this being a noted breach vector
    2. Automate and where not possible conduct manual system and network security assessments are built into the software development lifecycle
    3. Work with developers to ensure the passwords are compliant, that they are being rotated
    4. Apply encryption at rest, in use and in transit
  1. Get involved in open source. Increasingly developers and companies are relying on open source software. However, there’s no standard way of documenting security in open source projects so it becomes important to build security into the development process and check and re-check applications for Vulnerabilities. The upside for CISOs is that through utilizing open source software they get the opportunity for many eyes to look over their software and therefore, bugs and vulnerabilities get discovered faster.
  2. Treat security as an ever-changing practice that one has to stay on top off and alter practices as the landscape changes. Organizations that offer developers and security teams the opportunity to cross-train will find that they develop security-conscious developers and security teams that are business focused. This is an opportunity for security teams to come up to speed with developer tool such as Chef and Puppet while developers get to learn about vulnerability management and other security tools and practices.

By Evelyn De Souza

Mark Rochester

Why Remote Migrations are Essential for Business Continuity

Remote Business Continuity We are approaching a banner year for the cloud. The COVID-19 pandemic has highlighted the importance of cloud technology to enable resilience and business continuity, and it will be a critical time ...
Gartner Predicts Public Cloud Services Market Will Reach $397.4B by 2022

Gartner Predicts Public Cloud Services Market Will Reach $397.4B by 2022

Public Cloud Services Market Will Reach $397.4B Worldwide end-user spending on public cloud services is forecast to grow 23.1% in 2021 to total $332.3 billion, up from $270 billion in 2020. Garter predicts worldwide end-user ...
RPA-Data

How Digital Service Providers (DSPs) can Leverage RPA to Accelerate Data Migration by 2X

Accelerate Data Migration by 2X Ongoing trends in the Telco/DSP industry such as M&As, migration of the application to the cloud, and modernization of legacy applications have increased the frequency and scope of data migration ...
Jim Fagan

Behind The Headlines: Capacity For The Rest Of Us

Capacity For The Rest Of Us We live in the connected age, and the rise of cloud computing that creates previously unheard of value in our professional and personal lives is at the very heart ...
Juan Pablo Perez Etchegoyen

69% of Enterprises are Moving Mission-Critical Information to the Cloud

Why Security matters According to a research study by the Cloud Security Alliance (CSA), 69% of enterprises are moving mission-critical information to the cloud. These migrations are massively complex and take meticulous planning to ensure ...
Darach Beirne

Take Control of Telecom by Being Your Own Carrier

Being Your Own Carrier Departments and organizations of all sizes and across all industries are transitioning away from traditional hardware IT systems and embracing SaaS-based cloud offerings. The global pandemic has spurred greater cloud adoption, ...