5 ms·

Great article. Looking for some bright minds, agile minds opinions how one should structure and how should Security Team work in an agile organization (100 dev

Great article. Looking for some bright minds, agile minds opinions how one should structure and how should Security Team work in an agile organization (100 devs). Where I agree with the article, for software dev, I am not sure if this will be applicable to Security Teams. Security Team ideally should deliver "security" of the company, however team cannot do it alone, we rely on other teams (devs for code, devops for infra), employees (phishing) and also need to collaborate a lot. How would you tackle Security and Security Team in agile organization? Thanks,

allendoerfer 6y ago
I think a company cannot run only on teams delivering features. There will always be some functions like HR, legal or sales. I think security fits in there nicely, it is quite similiar to compliance. A security team is not delivering security by itself, it is more like an HR department trying to prevent workplace harassment or a legal team trying to prevent GDPR violations. You might also think of it not as a team at all, when you are consulting for other teams, you are delivering features as part of that team.
inerte 6y ago
At a higher level Agile is about delivering value end-to-end as soon as possible, repeated a lot of times. The iterative part is important, because you're supposed to be measuring and learning based on past deliverables. I don't know how your company organizes the security teams, but both at Yahoo and now at GoDaddy the security folks delivered a lot of software. Code scanners, patches rollout, monitoring, etc... I agree you can't exactly deliver phishing protection, but for example I've seen fake phishing emails being sent by executives, and then the security team measures if employees are taking the bait. You do that every once in a while, measuring if things are improving or not. Maybe there are other angles you can use to approach how you measure the value your team delivers.

allendoerfer 6y ago

I think a company cannot run only on teams delivering features. There will always be some functions like HR, legal or sales. I think security fits in there nicely, it is quite similiar to compliance. A security team is not delivering security by itself, it is more like an HR department trying to prevent workplace harassment or a legal team trying to prevent GDPR violations. You might also think of it not as a team at all, when you are consulting for other teams, you are delivering features as part of that team.

inerte 6y ago

At a higher level Agile is about delivering value end-to-end as soon as possible, repeated a lot of times. The iterative part is important, because you're supposed to be measuring and learning based on past deliverables. I don't know how your company organizes the security teams, but both at Yahoo and now at GoDaddy the security folks delivered a lot of software. Code scanners, patches rollout, monitoring, etc... I agree you can't exactly deliver phishing protection, but for example I've seen fake phishing emails being sent by executives, and then the security team measures if employees are taking the bait. You do that every once in a while, measuring if things are improving or not. Maybe there are other angles you can use to approach how you measure the value your team delivers.