How to Build Security and Risk Management into Agile Environments

Many organizations have adopted the agile methodology for software development and/or moved to DevOps IT support models, micro-services, containers, and the like. Often, these practices leave Information security pros tearing their hair out for lack of assurance and verification processes, or an absence of separation of duty. Insisting on traditional waterfall-based security processes may not be an option. As one security engineering staff member put it, “Business developers come to central IT asking for solutions to a problem and are told it will take 6 months. Then its late. They won’t be back.” Risk management should be front and center in security. However, risk management is also a challenge in the iterative agile environment – especially for a number of companies that use agile project management for most or all projects, even outside development. a challenge in the agile environment. In this presentation, Blum will address: 1) Challenges of implementing security and risk management in agile or DevOps models 2) Good practices for embedding security services in the pipeline 3) Developing an agile risk management framework