Bridging the Gap Operations and Security

Craig Bowser 15+ years in InfoSec Security Analyst, SOC Manager, Information Security Manager, Security Engineer, All Things SIEM GSEC GCED CISSP Christian, Father, Husband, Geek, Scout Leader who also does some woodworking To Do List > To Do Open Slots

Ideally….

Commonly…

At best…

So what are the causes? 3 Foundational issues 3 Technical issues 3 Additional tips

FUNDAMENTAL ISSUES

Issue #1 - Bad Staff Structure Does each group report to a different CXO?

CEO CIO CSO VP IT VP Sec Dir OP Dir Sec IT Security IT Manager Sec Manager IT Security

Issue #1 - Bad Staff Structure Does each group report to a different CXO? Is security viewed as compliance not as an operational group?

Make Checklist Check off first item on checklist Display completed items on checklist

Suggestion #1 – Align Staff Structure - Align Ops and Security under one head at an appropriate level

CEO CIO CSO VP IT VP Sec Dir OP / Sec OR CCB IT Security IT Manager Sec Manager IT Security

Suggestion #1 – Align Staff Structure - Align Ops and Security under one head at an appropriate level - Move audit/ compliance into their own group

Issue #2 – Each Group Has Different Goals Security wants to protect Ops wants max uptime

Suggestion #2 – Align or Merge Goals - Management needs to provide guidance and set priorities - Align with organization mission and goals

Issue #3 – Who is doing what? Does each group have their own procedures for the same situation? Is there confusion over investigative and reporting responsibilities?

Suggestion #3 – Get signed policies - Designate Roles and responsibilities. - List authorized actions. - Develop SOPs

TECHNICAL ISSUES

Technical Issue #1: Patching and Secure Configuration Patch Now! Fix your configs! Don’t you know how important this is?!?! Need to test! That’s not critical! That config breaks the app! Stop talking down to us!

Suggested Solutions - Build and use a test bed - Review and prioritize fixes - Provide fix suggestions - Develop alternative mitigations

Technical Issue #2 – Ops installs new application or Capability Deploy Now! Users Need! Customer Wants! Why don’t you understand operations / business? What? We have no warning / prep! Completely insecure! Opens up holes! Skipped security testing!

Suggested Solution - Build and use a test bed - Involve both sides early in requirements phase - Ensure security understands problem Ops is trying to solve

Technical Issue #3 – Security implements new tool / process Enhance security! More rules! Trust but verify Analyze all things! Don’t you see how this makes us more secure? More things breaking! More users / customers yelling! Slower network! No visible benefit!

Suggested Solution - Build and use a test bed - Get Ops involved early in planning - Eat your own dog food - Phased implementation

ADDITIONAL TIPS

Finishing Touches Help retire a device that’s EOL Use your monitoring tools to augment theirs Respond to their requests for assistance

CONCLUSION

Questions? Craig Bowser @reswob10 reswob10@gmail.com