From Passing Security Audits to DevSecOps

This is a story of a how a small company evolved their security practices as their footprint grew. The initial focus was to establish a baseline of security practices, where we used guidelines from Soc-II, Type 2 compliance as well as NIST and personal knowledge to implement security. While some automation was there around detection and monitoring, by and large it was reactive, needing human intervention, but enough to meet audit requirements.

While the current practices had worked thus far, in Nov 2018, we started to look into how we needed to evolve security to keep up with the scaling of our systems. We landed with a multi-prong approach, which will be the focus of this talk. One of the first steps was to up the skillset on the team to move to practices such as Infrastructure as Code and removing any manual steps around running and managing the team. We will talk about some of the lessons learnt around things that worked as well as not worked when changing the inherent job and culture on the team. The second big step was to decide how we will scale up our security team; whether we are going to build the entire monitoring system ourselves and have 24x7 monitoring around it or go to the industry and buy the systems and monitoring, while maintaining a smaller in-house security presence. We will talk about how we made the decision, factors we considered and how it has been progressing since then, including the changes to our development processes.