Editor’s note: The following is a sponsored blog post from Adobe.
The central security team in a product development organization plays a vital role in implementing a secure product lifecycle process. It is the team that drives the central security vision for the organization and works with individual teams on their proactive security needs. I lead the technical team of proactive security researchers at Adobe. They are all recognized security experts and are able to help the company adapt to the ever-changing threat landscape. Apart from being on top of the latest security issues and potential mitigations that may need to be in place, the security team also faces challenges of constant skill evolution and remaining closely aligned to the business.
This post focuses on the challenges faced by the security team and potential ways to overcome them.
Increase in technologies as a function of time
A company’s product portfolio is a combination of its existing products, new product launches and acquisitions intended to help bridge product functionality gaps or expand into new business areas. Over time, this brings a wide variety of technologies and architectures into the company. Moreover, the pace of adoption of new technologies is much higher than the pace of retiring older technologies. Therefore, the central security team needs to keep up with the newer technology stacks and architectures being adopted while also maintaining a manageable state with existing ones. An acquisition can further complicate this due to an influx of new technologies into the development environment in a very short period of time.
Security is not immune to business evolution
The cloud and mobile space have forced companies to rethink how they should offer products and services to their customers. Adobe went through a similar transformation from being a company that offers desktop products to one that attempts to strike the right balance between desktop, cloud and mobile. A security team needs to also quickly align with such business changes.
Multi-platform comes with a multiplication factor
When the same product is offered on multiple operating systems, on multiple form factors (such as mobile and desktop), or deployed on multiple infrastructures, security considerations can increase due to the unique qualities of each platform. The central security team needs to be aware of and fluent in these considerations to provide effective proactive advice.
Subject matter expertise has limitations
Strong subject matter expertise helps security teams’ credibility in imparting sound security advice to teams. For security-sensitive areas, experts in the team are essential to providing much deeper advice. That said, any one individual cannot be an expert on every security topic. Expertise is something that needs to be uniformly distributed throughout a team.
These challenges can be addressed by growing the team organically and through hiring. Hiring to acquire new skills alone is not the best strategy — the skills required today will soon be outdated tomorrow. A security team therefore needs to adopt strategies that allow it to constantly evolve and stay current. A few such strategies are discussed below.
T-shaped skills
Security researchers in a security team should aim for a T-shaped skill set. This allows for a fine balance between breadth and depth in security. The breadth is useful to help cover baseline security reviews. The depth helps researchers become specific security subject matter experts. Having many subject experts strengthens the overall team’s skills because other team members learn from them and they are also available to provide guidance when there is a requirement in their area of expertise.
Strong computer science foundations
Product security is an extension of engineering work. Security requires understanding good design patterns, architecture, code, testing strategies, etc. Writing good software requires strong foundations in computer science irrespective of the layer of technology stack one ends up working on. Strong computer science skills can also help make security skills, language, and platform-agnostic. With strong computer science skills, a security researcher can learn new security concepts once and then apply to different platforms as and when needed. With such strong fundamentals, the cost of finding out the “how” on new platforms is relatively small.
Hire for your gaps but also focus on ability to learn quickly
A working product has so many pieces and processes that make it work. If you can make a mental image of what it takes to make software, you can more clearly see strengths and weaknesses in your security team. For example, engineering a service requires a good understanding of code (and the languages of choice), frameworks, technology stacks (such as queues, web server, backend database, third party libraries), infrastructure used for deploying, TLS configurations, testing methodologies, the source control system, the overall design and architecture, the REST interface, interconnection with various other services, the tool chain involved — the list is extensive. When hiring, one facet to evaluate in a candidate is whether he or she brings security strengths to the team through passion and past job experience that can fill the team’s existing gaps. However, it can be even more important to evaluate the candidate’s willingness to learn new skills. The ability to learn, adapt, and not be held captive to one existing skill set is an important factor to look for in candidates during hiring. The secondary goal is to add a variety of security skills to the team and to try to avoid duplicating the existing skill set already in the team.
“Skate where the puck’s going, not where it’s been”
To stay current with the business needs and where engineering teams are headed, it is important for a security team to spend a portion of their time investigating the security implications of newer technologies being adopted by the product teams. As Wayne Gretzky famously said, “you want to skate where the puck’s going, not where it’s been.” However, security teams need to cover larger ground. You do have to stay current with new technologies being adopted. Older technologies still get used in the company, as only some teams may move away from them. So, it would be wise not to ignore those older technologies by maintaining expertise in those areas, while aiming to move teams away from those technologies as they become more difficult to effectively secure. Predicting future areas of investment is difficult. Security teams can make that task easier by looking at the industry trends and by talking to engineering teams to find out where are they headed. The managers of a security team also have a responsibility to stay informed about new technologies, as well as future directions their respective companies may go in, in order to invest in newer areas to grow the team.
Go with the flow
If a business has made a decision to invest in cloud or mobile or change the way it does business, a security team should be among the first in the company to detect this change and make plans to adapt early. If the business moves in a certain direction and the security team does not, it can unfortunately label a team as being one that only knows the older technology stack. Moreover, it is vital for the security team to show alignment with a changing business. It is primarily the responsibility of the security team’s leadership to detect such changes and start planning for them early.
Automate and create time
If a task is performed multiple times, the security team should evaluate if the task can be automated or if a tool can do it more efficiently. The time reduced through automation and tooling can help free up time and resources, which can then be used to invest in newer areas that are a priority for the security team.
Growing a security team can have many underlying challenges that are not always obvious to an external observer. The industry’s primary focus is on the new threat landscapes being faced by the business. A healthy mix of organic growth and hiring will help a security team adapt and evolve continuously to the changes being introduced by factors not in their direct control. It is the responsibility of both security researchers and the management team to keep learning and to spend time detecting any undercurrents of change in the security space.
About the author: As a Director of Cloud Operations Security, Mohit leads a team that performs proactive security reviews of Adobe's operational environments (AWS, Azure, data centers) as a part of Adobe's Secure Product Lifecycle. His team also drives the operations security stack that product teams use for their security needs and for scaling security monitoring of their operational environments. His team is also responsible for pushing security requirements, design and implementation of Adobe's own operational platform.