GitLab Security Department, 8 Oct 2019

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: What Does the Security Operations Team Do?

Description

Devin Harris (Senior Security Analyst, Field Security - https://about.gitlab.com/handbook/engineering/security/#field-security) and Jayson Salazar (Senior Security Engineer, Security Operations - https://about.gitlab.com/handbook/engineering/security/#security-operations) discuss what exactly the Security Operations Team Does at GitLab.

Jayson mentions several key links which are here:
- https://gitlab.com/gitlab-com/gl-security/secops/operations
- Slack: #security, #security-department, @secops-team, /security

A

Devin: hi,, I'm devin harris., I'm a field security analyst here at gitlab.

A

I'm with jayson salazar today, jayson. Would you like to introduce yourself?.

B

Jayson: sure devin. so,, my name is jayson salazar., I'm a security operations engineer at gitlab.

B

I've been with the company since january 2018 and I'm quite happy at it.

A

Devin: awesome,: well, as you know,, we are trying to increase security awareness here at gitlab.

A

And, I'd just like to ask you a couple questions about your team: (security operations) jayson: sure, go ahead, devin:, alright, cool,! So in your own words,. How would you describe what your team does here at gitlab?.

B

Jayson:, I would say the security operations team is the first line of defense.

B

When it comes to,, security incidents, both internal,, that means initiated by an team member deliberately or not on purpose.

B

But also by external parties,.

B

We are the team that interfaces with other stakeholders and other teams,.

B

Teams like infrastructure, application, security, compliance to try to mitigate (threats) and bring important things to completion,.

B

That are related to the security posture of gitlab.com and other systems and the corporate side of the company.

B

So, for example, if an s1/p1 (severity 1, priority, 1 vulnerability) is reported to us on hackerone,.

B

The application security team is going to start working on that,.

B

But if that s1/p1 (vulnerability) affects the capacity for gitlab.com to remain secure or operational,.

B

Then secops is going to get involved and then we will work with application. Security,.

B

To bring that s1/p1 to a happy state,, a mitigated state, with the help of infrastructure or developers that are responsible,.

B

For that particular functionality that is affected.

B

So yeah, we do many different things.

B

I think security operations, are very diverse in what we deal with.

B

So if it's phishing, mass phishing campaigns affecting our team members, or if it's an s1/p1,.

B

Or if it's a document that was mistakenly shared publicly, then we are engaged and everything in-between.

B

We also work on improving our capabilities when it comes to detection and response so,.

B

It's a pretty diverse bunch, (of responsibilities), but we all have a lot of fun doing it.

A

Devin: cool, well, thank you very much for that.

A

My next question: is...can, you describe a really cool project. Your team has recently worked on or is currently working on?.

A

Jayson: so, as I mentioned, earlier, security operations does mostly reactive, work,.

B

We are there to react and respond whenever something doesn't go as expected,.

B

We try to the best of our ability to support teams like infra(structure), developers, application, security,.

B

With their needs, when it comes to security,, either feedback or whenever something happens,.

B

But also a big part of where you usually want to take security is, to a more proactive.

B

Way of working., so that's what we are currently working on.. We are working on,.

B

Tools focused on data ingestion and log aggregation to improve our ability to spot undesired states.

B

And behaviors that we are being victims of,, but also to better respond to those threats or dangers.

B

And be able to more quickly mitigate those problems., so that's pretty cool.

B

It's a bit, like going into more detail. I suppose, it's out of scope of this short interview. But,.

B

People can definitely reach out to us if they want to talk about it, or we can drop a couple of links about what we are currently doing,.

B

Or you can just look in our tracker and see what initiatives we're involved with.

A

Devin: awesome, well, thank you for that.. That sounds like it's going to be very helpful.

A

My last question, I thin is probably extremely relevant for your team...

A

When would somebody contact security operations and how would they do that?.

A

Jayson:, so security operations can be found around many different channels,, but.

B

If you ping us on any channel with (the handle) @secops-team,, then we are quickly going,. We are usually quite quick in responding.

B

You can also just drop by the #security or #security-department channels, and we read those pretty regularly,.

B

So if you leave a message there, because you don't know who else to ask or who to contact,.

B

You can just drop a message and we will reply.. Finally, you can just directly contact us,.

B

Or if you think you know about a particular threat or risk to gitlab when it comes to cyber security,.

B

You can always "page"us.

B

The security operations team, has an on-call rotation,. There is a security engineer available 24/7 for you,.

B

If you have such a concern,, you can just write in slack /security [message].

B

Like, "I have a concern with x, y" and then somebody will get in contact with you.

B

As soon as possible;, even if it's out of "business hours".

B

Someone, somewhere is getting a call on their phone and then we can assist better.

B

But, slack is always a good choice,. Paging us is also in-case of problems or incidents is a good alternative.

B

As well, or just reaching over direct (slack) messages., I'm always happy to chat to different people about different things.

A

Devin: awesome, well, thank you for that.. It was really good getting to learn a little bit more about your team, and I'm really looking forward to working with you (your team), a bit more.