Scale Security

In my experience Larry, ensuring that top management are onboard with the whole security practices ‘slash’ security culture ‘slash’ security mindset had made the difference on whether a security programme had legs or not. With this in place, the challenges became significantly reduced. The main challenge I find is that shifting left, which means amongst other things, developers, operations, security, compliance teams all working in parallel, is not necessarily realised. This is not an unusual predicament however, and how can it be, considering knowing from traditional methods how time consuming it is to do security /compliance checks particularly on a complicated system(s)?

As GeyBorch has alluded to, there are several tools out there now that can help you do exactly this and my recommendation would be to invest in some time in this.

The comments about leadership alignment, cultural shift and making TM part of the SDLC are spot on and precisely how we went about it in my org.

Creating “security champions” out of the engineering org, e.g. across various squads or product teams who have a certain percentage of their time dedicated to security tasks e.g. Threat Modelling, security review of their code, vulnerability management of dependencies etc. is critical to how scaling the security function. This is usually only possible if that engineering leadership buy-in has been secured.

The engineering team is usually much larger than the “security team”, so shifting security tasks leftwards and making engineering security champions an “extension of the security team” has many side benefits including “scaling” the security practice. This also creates collaboration and partnership between security and engineering, as opposed to the traditional adversarial relationships that can ensue if security is seen as the people who “call your baby ugly” by finding flaws in your “engineering creation”.