(Some) people needs new keywords to feel ok. Many years in IT, little and big companies... I've seen 3 security models: 1) Absent. Everybody was so worried ab

(Some) people needs new keywords to feel ok. Many years in IT, little and big companies... I've seen 3 security models: 1) Absent. Everybody was so worried about other keywords, than nobody did remember about data security until it was a problem. 2) Invalid, unmaintained and written in the past by a third party. Everybody call this model components "the protocols", nobody knows about security, they know about "follow the protocol", or "this does not follow the protocol". 3) Conscious about threats, maintained and perfectly explained by the involved people. The 3 models, did repeat before, and during the term "devops". And will repeat after. And will be immune to the existence/usage of the term "secops" in the media. For the model 3), I've found 2 scenarios, 3a) management was conscious about security (even more than "technical people") or 3b) management didn't know almost anything about the sysadmin work, but they did know they didn't have problems. One of the keys for the model 3) is management. They push the workers in one direction or another. If management does not understand the value or the dangers of data security, usually they have problems in more fields than security (technical debt, code, tooling, teams, projects, etc) When people expects my response to an automation or integration or development question (devops), and I give them the response, with all the security aspects included, (not just a "technically valid" response) I use to gain value with the customer/team. Now I think I was a secops (before the term was out there), when my boss just did want a 'devops' at the time.