GitLab Security Department, 7 Oct 2019

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: What Does the Threat Intelligence Team do?

Description

Devin Harris (Senior Security Analyst, Field Security - https://about.gitlab.com/handbook/engineering/security/#field-security) and Antony Saba (Senior Threat Intelligence Engineer - https://about.gitlab.com/handbook/engineering/security/#threat-intelligence) discuss what exactly the Threat Intelligence Team does at GitLab.

Antony mentions several key links which are here:
- https://about.gitlab.com/handbook/engineering/security/#engaging-the-security-on-call
- https://about.gitlab.com/handbook/engineering/security/#internal-application-security-reviews
-Slack: #security, #security-department, @sec-ops-team

A

Devin:, alright, I'm devin harris, I'm an a field security analyst here at gitlab and today,.

A

I'm with antony saba, he's a senior threat, intel engineer.

A

Would you like to introduce yourself?, antony: yeah.

B

So I'm antony, I'm a threat, intel engineer here on the security team,. I.

B

Report up through strategic security. I've been here about a year and a half.

B

Helping build up the teams and generally help where I can.

B

Devin: awesome thank you,, as you know, we're trying to increase security awareness.

A

Inside of gitlab here- and this is part of our series- so thank you for taking.

A

Time to meet with me today, I just have three simple questions for you: antony:, alright,.

A

Devin: first,, in your own words, what would you describe threat, intel's job being?,.

A

Antony: so threat intel's job is to work within strategic security,. Looking at trends in.

B

Activities that we're seeing that are affecting users on gitlab.com to.

B

Protect gitlab.com., then the other security department thing that we're.

B

Protecting is the company,, so looking at things that are affecting team members.

B

As well in addition., devin:, okay and then..., antony:, oh and then taking those trends and making sure.

B

That our initiatives are in line with reducing any risks associated with those.

B

Devin:, okay, so really kind of the frontline defense there?. I love it! antony: no, they're, more of a strategic look.

B

At it,, so now that we have fully operational secops team teams and.

B

Application security teams, the threat intel roles are looking at making sure.

B

Things are getting collected as we do our day-to-day activities,, so that we can.

B

Make those trends make good database decisions., devin:? Okay, thank you,.

A

That's awesome,. That makes a lot of sense.. Can you describe a really cool project.

A

You've either recently finished or have been working on recently? antony:. The current big push is to stand up a production environment.

B

For security, specific tooling, that is more independent than gitlab.com, we.

B

Have a similar problem to support and infrastructure (teams) in that you can't use.

B

Gitlab.Com to do support tasks of gitlab.com if gitlab.com is unavailable.

B

Or under attack,, so we're looking at spinning that up and I'm helping drive.

B

Some of the requirements for that so that six months, nine months from now we.

B

Can start hiring soc (security operations, center) analysts that have a.

B

Set of tools that is predictable to respond to events, respond to reports of.

B

Phishing of employees or anything else, that's happening and make sure that we.

B

Are tracking and recording that and being efficient about it as we as we grow.

B

Devin: that sounds like this can be very useful.

A

Antony: mm-hmm devin: and then lastly, when, if.

A

Ever,, would somebody get in contact with their team and how would they do that?.

B

Antony: so again, as we've grown in the last year,, people are still pinging me directly for.

B

Stuff, but now that we have the operations team and you think something.

B

Is going on, always be comfortable? You know you need to be comfortable. Paging security.

B

By either in slack, you can type in just /security and then a message or you.

B

Can find them in the #security channel and tag @secops-team there. if it's.

B

An mr review or design review of some new technology. You can tag the appsec team.

B

Either in the issue, or in slack we do, you know, because we are responsible for.

B

Both self-managed and the production infrastructure, there are a lot of things.

B

That will span both the secops team, the application security team and I'll get.

B

Pulled in to do additional review as necessary for those as well.

A

Devin: awesome, we'll make sure to link those resources you mentioned and the video when we're done, and I really appreciate you taking the time to talk to me today.

A

Antony: absolutely thanks.