Snow in April, Alert Monsters, and Connect Four: 5 Takeaways from our SecOps Chat

Maurina Venturelli, VP of Marketing

May 1, 2023

5 min read

Meny Har, CEO Opus, recently hosted Andy Ellis, Hall of Fame CISO, in our inaugural live LinkedIn chat. I participated from my home in Cheyenne, Wyoming, where the snow was blowing and quickly piling up on the deck; welcome to springtime in Wyoming.

Cheyenne, WY April 19, 2023

There were numerous brilliant pieces of information and theories, and I wanted to take a moment to share my top five:

‍

What we really have is a configuration hygiene problem. Security teams have too many tools. We’ve spent 10+ years trying to shift left and in trying to do so we’ve accumulated (collected) numerous detection tools. Scanning tools - SAST, DAST, SCA, and I’m likely forgetting at least seven more. Oh and BTW, we’ve also created an acronym nightmare. Do we really need that many? I digress. This “tool tsunami” or “death by 10,000 alerts” is the result of constantly re-creating the idea of software architecture (skip to 14:27 to hear Andy’s take). While this paves the way for cooler, better things, it also creates a whole new set of risk exposure issues, thus a whole new set of tools with…. You named it, alerts!

‍

We’re now in a time where context matters. It’s no longer effective to have remediation centered in each of your tools. Sure, tools like Synk, Wiz, Orca, and the like have remediation operations built in, but it’s only for their specific tool. They can’t aggregate across each, let alone appsec tools and cloud sec tools. That sucks. Opus gives you all that AND a bag of chips… well we will if you want them. Opus sees alerts from all the tools, aggregates duplicate alerts, AND enriches the alert with context within your company. Opus enriches the alert with information such as, who checked in the code, what app it belongs to, what other alerts/findings it's related to, reasons to prioritize or not, and much more. We will slay your alert monsters!

Showing off my drawing skills. Watch out for Alert Monsters!

Security teams are left to “solve the remediation problem”. The number one goal of security teams is to keep their product (application) secure at all times. One of the ways they do this is by monitoring scanning tools and managing alert…monsters. But, as Andy mentions, vulnerability detection vendors have no incentive to hide alerts of any kind. They will show you everything, and a human needs to decide prioritization, urgency, etc. This creates a huge time suck for security teams, duplicate tickets for developers, inability to prioritize what matters, and will almost always result in friction between security teams and developers. [Insert cheeky Opus Security sales pitch here.] In all seriousness, if you want to see a demo click here. Bonus points if you ask for me to be on the call!

source: giphy.com

Auto-remediation: When do you rely on it? When does it cause more harm than good? At around 14 minutes, Andy brilliantly states that automation should only happen in tasks. In other words, if you don’t have a well-oiled process and buy-in from all people (devs, sec, operations, cloud, etc), and a list of tasks to support your process, you shouldn’t rely on auto-remediation. In fact, implementing auto-remediation before a well defined, agreed upon process will cause you more harm than good. It’s also important to note you need to find the right balance between auto-remediation and humans.

‍

Most importantly, it comes down to culture change. I’ve been marketing security tools for about 12 years now; everything from SAST/DAST to Cloud SOAR/Cloud SIEM; and we’ve been talking about developers, security, IT operations, and cloud teams working hand-in-hand for at least that long. At Opus we believe in security posture; take app sec posture, cloud sec posture, etc., and connect them like Connect Four! We like the idea of a culture where security is looked at as product security (#ditchtheacronyms). It’s everybody’s responsibility to do remediation, and organizations that adopt this culture change need a tool that makes it accessible and enables teams to collaborate easily. In product security culture, the vulnerability alert can come from the code of the application, the container, AWS, Azure, the carrier pigeon, it doesn’t matter, we’re going to aggregate them, enrich them, help you orchestrate the fix, and ultimately build a culture of trust and respect.

Connect Four was created 49 years ago. source https://en.wikipedia.org/wiki/Connect_Four

‍

See the Opus Platform in Action

Cybersecurity Consolidation: The Key to Stronger Security

February 13, 2025

SSVC Explained: How It Transforms Vulnerability Prioritization

February 5, 2025

How to Achieve and Maintain FedRAMP Compliance

February 2, 2025

Cloud-to-Code Integration: Enhancing Security from Cloud to Codebase

January 25, 2025

Cloud Security Posture Management (CSPM): A Comprehensive Guide

January 14, 2025

Remediation as Security Immunization: Protecting Against Exploits, Malware, and Ransomware

January 25, 2025

Security Remediation Insights - Looking Back at 2024, Ahead to 2025

January 15, 2025

No-Code Automation in 2025: Choosing and Implementing Tools

January 14, 2025

Build vs. Buy: A Guide for Security Remediation Platforms

January 14, 2025

How To Design an Effective Vulnerability Management Program

January 14, 2025

Exposure Assessment Platforms (EAPs): A Cybersecurity Essential

November 20, 2024

NYDFS Cybersecurity Regulation: Key Compliance Steps

January 14, 2025

Is Python the Right Tool for Your Cyber Security Strategy?

January 14, 2025

What Is DORA Compliance? A Practical Guide

January 14, 2025

Opus' Ownership Detection & No-Code Workflow Builder

November 5, 2024

Remediation vs. Mitigation: Key Differences Explained

November 7, 2024

What Is Vulnerability Remediation & How It Works

January 14, 2025

Vulnerability Assessment: Definitions, Methodology & Tools

November 7, 2024

Wrapping Up Season One of "30 Min on: Vulnerability Management"

October 21, 2024

CVE and CVSS: Vulnerability Assessment & Severity Ratings

October 29, 2024

CVSS Scores: How They Enhance Vulnerability Assessment

February 12, 2025

What CVE Scores Mean for Your Cybersecurity Strategy

October 29, 2024

The 2025 Guide to Risk-Based Vulnerability Management

January 12, 2025

Secure SDLC: Why and How to Integrate Security In Your Development Life Cycle

October 20, 2024

Application Security Posture Management (ASPM): How It Works & Top Tools in 2025

January 12, 2025

How to Prioritize Vulnerabilities Effectively in 2025

January 12, 2025

The Opus Multi-Layer Prioritization Engine: What is it All About?

September 10, 2024

EPSS Score: Improving Vulnerability Prioritization in 2025

January 12, 2025

Opus Platform Explained: Cloud-Native Vulnerability Remediation

October 20, 2024

It’s Time to Get Proactive About Vulnerability Remediation

October 29, 2024

The Vulnerability Strikes Back - TABLETOP PART TWO

August 13, 2024

Opus Security Joins CrowdStrike Marketplace

September 29, 2024

Cloud-to-Code Integration for Comprehensive Remediation

January 15, 2025

Understanding CTEM: How Opus Security Can Help

September 22, 2024

This Is What Your Security Champions Program Is Missing

September 29, 2024

Risk-Based Vulnerability Management (RBVM) in a Cloud-Native World

October 7, 2024

How Business Impact Analysis Facilitates Effective Remediation

October 20, 2024

[Case Study] How Opus Solved the Puzzle of Disparate Tools and Alerts

October 7, 2024

It’s Time for Security Operations to Ditch Excel

February 13, 2025

Security Remediation Budgeting - Everything You Need to Know

October 20, 2024

How to Achieve More Effective Vulnerability Management?

August 13, 2024

Checklist: Tracking Down Key Stakeholders for Effective Security Remediation

October 2, 2024

Streamlining Security Remediation: The Convergence of CTEM and ASPM into a Single Operating Platform

September 22, 2024

How to Locate Key Stakeholders for Security Remediation

October 7, 2024

The Evolution of Vulnerability Remediation: From RBVM to Security Remediation Platforms

September 29, 2024

Practical Vulnerability Remediation - When Should You Act?

October 20, 2024

The Ultimate Remediation Lifecycle for Vulnerability Management

September 22, 2024

Global Leader in Content Solutions Streamlines Remediation with Opus

August 13, 2024

Opus Security helps Global Technology Company Connect Security Tools for More Effective Security Remediaiton

August 13, 2024

Opus Security's VP of Marketing shares her thoughts on B2B marketing in a recent DemandBase podcast.

August 13, 2024

Opus Security Wins 2023 CyberSecurity Breakthrough Award

October 20, 2024

Vulnerability Management - A Story

September 22, 2024

6 Ways Orchestration Reduces Cloud Security Risk

October 2, 2024

Move Beyond Shift Left and Shift Smart

October 20, 2024

3 Tips for Bridging the Remediation Developer/Security Gap

October 2, 2024

WAF With EKS, Using Only k8s Controllers

August 13, 2024

Opus Recognized in the 2023 Gartner® Emerging Tech: Security — The Future of Cyber Is Automated Moving Target Defense report.

August 13, 2024

Wiz identifies, Opus fixes.

August 13, 2024

Writing your Cloud Opus: A Deep Dive into Orchestrating your Cloud Security

August 13, 2024

Snow in April, Alert Monsters, and Connect Four: 5 Takeaways from our SecOps Chat

August 13, 2024

Security in Sync: How Security Teams Can Make Cloud Remediation Less Painful for Engineers

October 20, 2024

Why We Need a New Approach to Remediation in the Cloud

August 13, 2024

Introducing Opus: Orchestrating Remediation and Reducing Risk in the Cloud

September 29, 2024

Snow in April, Alert Monsters, and Connect Four: 5 Takeaways from our SecOps Chat

Read next

See the Opus Platform in Action