Skip to Main Content
Building a Modern Security Program
book

Building a Modern Security Program

by Zane Lackey, Rebecca Huehls
August 2018
Intermediate to advanced content levelIntermediate to advanced
45 pages
1h 2m
English
O'Reilly Media, Inc.
Content preview from Building a Modern Security Program

Chapter 2. The Future of Development and Security

How does a security team successfully transition from a gatekeeping or blocker mentality to a DevOps-friendly approach that facilitates security self-sufficiency across the organization? When I was CISO at Etsy, I found that three key security program changes were unique to DevOps (in addition to the broader strategic shifts).

First, the security team needs to understand the techniques developers use to make all of those code-deploys every day. That’s where the feature flags, ramp ups, and A/B testing I mentioned in Chapter 1 come into play.

Second, instead of the security team holding onto its specialized knowledge, the team needs to provide leadership that encourages folks throughout the organization—and especially throughout the engineering team—to think about security day in and day out. Fortunately, you can make this part fun, especially for the engineers and data lovers, because it involves data they’ve often never seen before.

Third, the security team needs an approach to access control that still enables everyone to do their job.

This chapter explains the fundamentals related to each of these changes affecting the way we create and deliver software.

Tools for Continuous Development

As I mentioned in Chapter 1, in a DevOps methodology, most if not all the developers now own the ability to deploy the code they write directly to production. In practice, developers iterate constantly and use techniques like feature flags, ...

Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.
Start your free trial

You might also like

Modernizing Cybersecurity Operations with Machine Intelligence

Modernizing Cybersecurity Operations with Machine Intelligence

Peter Guerra, Paul Tamburello
The Future of Security

The Future of Security

Christina Morillo
Cloud Native Security

Cloud Native Security

Chris Binnie, Rory McCune

Publisher Resources

ISBN: 9781492044680