A Guide to SecOps: Unified IT And Security Operations in One

Original

Things move fast in IT. Innovation and development bring new ways of working that are quicker, and more connected. People want to access systems at any time, from any place, at a moment’s notice.

This is often at odds with cybersecurity. When you’re striving for innovation, it’s easy to run away with a great idea. The need for secure networks, passwords, and encryption can slow things down, and cause frustration. So, while your IT or Operations team is working to make things easier, your Security team keeps sticking a spanner in the works to hold things up.

SecOps - Security Operations - seeks to address the problem. By making security a part of your operations, not an add-on, processes can be built securely from the ground up. That way, IT is less likely to be annoyed when security tells them they ‘can’t do that’, and people are less frustrated at having to enter their password four times just to access a document.

1. The difference SecOps can make

Let’s say it’s the weekend: your IT team is off-line when your security team spots an attack on your server. They try to reach the IT manager, but their phone is off, and they are unavailable. It’ll be Monday before anything can be done, so the attack proceeds, and your valuable data is stolen or software is corrupted. It will be a huge task to sort it all out, not to mention the cost to your reputation, and customer base.

SecOps teams, on the other hand, operate 24/7 to make sure you’re covered at all times. They can act as a seamless, one-stop place to tackle issues as soon as they arise.

Image source

Not only that, SecOps can help improve everything from accessing your online marketing frameworks to improving employee morale through better team working. And, because security is part of your foundation, you’re ready when incidents happen.

People don’t always use software in predictable ways. For example, think about how we use search engines: rarely do we use whole sentences, but rather strings of words like: ‘chocolate cake recipes good’ or ‘is performance popular apps’. Security can be like that: hard to predict, with unexpected attacks or bugs, just like in the example above.

But it’s not just about security. The ‘Operations’ part of the equation means that your apps, software, and website - whatever your company uses and produces - are all made with the same ethos. They’re all user-friendly, perform well, and are all secure.

That means customers will have confidence in your company, improving your reputation, and leading to better business opportunities.

2. Building a SecOps team

No one wants to do business with a company that suffers expensive, embarrassing data loss or catastrophes. So, to prevent that, your SecOps team will consist of five key roles that work together to form a coherent defense.

• An incident responder

  This person is like your emergency 911 operator. They’re the first to know about an issue, and quickly respond to get the necessary information to the investigator. They’re also responsible for your monitoring tools, enabling them to spot risks, and issues effectively.

Image source

• A security investigator

  They will work closely with the incident responder, so they can take immediate action to assess the damage, and prevent it from going further. They’ll begin looking at how the problem occurred, and start forming a strategy to eliminate the vulnerability.

• An advanced security analyst

  This role is less about fire-fighting and more about preventing them in the first place. They’re responsible for identifying vulnerabilities before they’re exploited, and recommending ways to resolve them. That might involve software patches, new products, or strategies, ensuring your systems and products remain secure - both internally, and throughout your customer experience.

• An SOC (Security Operations Center) manager

  As the title suggests, this person manages the SOC team. They’re responsible for communicating with your business leadership team and key partners, keeping them up to date. They will need to have a good overview of all the team functions - from crisis management to ongoing monitoring, and improvements.

• A security engineer/architect

  They are responsible for managing the security architecture of your organization. They’ll test and review third-party tools, ensure compliance across the organization, and ensure security architecture is part of the development cycle.

3. Your SOC

The five roles on your SecOps team will work from your Security Operations Center - SOC. It sounds like a spy base, and in a way, it is similar. Generally, they’re not your front-of-house, product-selling, customer-facing people. They’re in the background, keeping tabs on the information going in and out of your organization, making sure it’s all legitimate.

Image source

That’s not to say they’re not involved in your final product. In fact, when considering how to improve product quality, SecOps can be a great help. With so many digital solutions out there - mobile apps, cloud-based software - you need to make sure yours can keep up, and stand out. SecOps allows you to make a fast, quality piece of software or secure app. Who wouldn’t want that?

Your SOC will look different depending on the way your organization works. It might be entirely virtual, with staff managed remotely, or a physical office staffed on a rota. Or it could be a hybrid combination of the two.

You might just decide to outsource it to a specialist SecOps firms to do it all for you, which can be a good option for smaller companies that might not be financially able to recruit a whole team.

4. Key tools you’ll need

Whatever your SOC looks like, you’ll need the right software tools for them to enable the team to function effectively.

These can be broadly grouped into the following:

• Monitoring tools

  These include alert systems such as Alerta to help your Incident Responder detect when there’s a problem. You’ll also need ongoing event management, and system information reporting tools. These help locate issues before they become crises, enabling the Incident Responder to track metrics such as network speed or traffic spikes.

• Management tools

  Because development is ongoing, you need to ensure continuity in your updates. Good systems management tools can ensure software upgrades are deployed in a consistent manner, and remain streamlined. For example, ZenTao, it's features, customization, flexibility and simplicity make it the best open-source project management software to help your team hit goals and ship faster. ZenTao covers the whole product development lifecycle, including product design and requirements management, software development, testing and bug management, release management and OP management.

  

• Automation

  Nobody can track everything all at once, especially not when incidents occur at speed. Automation tools can take care of repetitive tasks or can be used to respond initially to a breach, perhaps by shutting down a connection. Tools such as Ansible or Puppet can be useful in helping take the load off your team.

• Prevention tools

  

  Image source

  Remote teams are a great example of how the world of work has moved on. But, while they offer many benefits, they sure are a challenge for IT, and security teams! Your tools for preventing attacks are one way to help with that challenge.

  They are the systems you have in place to prevent breaches in the first place. It includes your firewall, VPN, and DNS security. They work to stop attacks before they reach your systems, allowing your team more time to focus on those that do get through or make sure they continue to be blocked!

5. Making SecOps work

Before you can implement your SecOps effectively, you need to decide a few things.

Will you outsource IT? Or purchase the resources you need in-house?

If you choose to outsource some of it, what will the scope of your internal team be? You need to make sure everyone is clear about their responsibilities, so you don’t end up paying for things you don’t use - or paying for them twice!

Then you can think about a few specifics. For example, you could find out how to review a mobile app, and do a mock review of your own to see how users may rate it. That way, you can discover any issues your end-users face, and correct them before you publish it.

Or you can role-play attacks, splitting your team into attackers, and defenders to find where your weak points are before anyone else does.

Perhaps consider attending an affiliate summit. You’ll gain ideas for your business, and you’ll have better, more secure ways to implement any ideas you learn while you’re there.

It might seem like a significant change, but by moving to SecOps instead of separate teams, you can improve your project management, systems, ways of working, and ultimately the experience your customers receive. You’ll find it’s worth it.

Need more help? Check out the Zentao blog. They have more articles on project management tools, software management, building cross-functional teams, and so much more.

--

Author bio :

Kate Priestman - Head Of Marketing, Global App Testing
Kate Priestman is the Head of Marketing at Global App Testing, a trusted and leading end-to-end functional testing solution and software diversity for QA challenges. Kate has over 8 years of experience in the field of marketing, helping brands achieve exceptional growth. She has extensive knowledge on brand development, lead and demand generation, and marketing strategy — driving business impact at its best. Kate Priestman also published articles for domains such as VMblog and Stackify.