Building a Modern Security Program

Chapter 2. The Future of Development and Security

How does a security team successfully transition from a gatekeeping or blocker mentality to a DevOps-friendly approach that facilitates security self-sufficiency across the organization? When I was CISO at Etsy, I found that three key security program changes were unique to DevOps (in addition to the broader strategic shifts).

First, the security team needs to understand the techniques developers use to make all of those code-deploys every day. That’s where the feature flags, ramp ups, and A/B testing I mentioned in Chapter 1 come into play.

Second, instead of the security team holding onto its specialized knowledge, the team needs to provide leadership that encourages folks throughout the organization—and especially throughout the engineering team—to think about security day in and day out. Fortunately, you can make this part fun, especially for the engineers and data lovers, because it involves data they’ve often never seen before.

Third, the security team needs an approach to access control that still enables everyone to do their job.

This chapter explains the fundamentals related to each of these changes affecting the way we create and deliver software.

Tools for Continuous Development

As I mentioned in Chapter 1, in a DevOps methodology, most if not all the developers now own the ability to deploy the code they write directly to production. In practice, developers iterate constantly and use techniques like feature flags, ...