Closing The Gap Between Security & Networking Ops: 5 Best Practices

IT networking operations and security operations centers are often misaligned. According to Gartner, “Security is seen more as a bolt-on appendage to IT rather than an integral component that should be baked into all architectures. This leads to end-user frustration and fosters kingdom-building versus deep integration between teams. The end results of both intrasecurity and IT organizational misalignments are unhappy users; reduced security; and architectures that are more complex, costly to operate and difficult to scale.”

From my experiences working with both teams, these five best practices will help close the divide. You’ll achieve a higher level of security and create aligned priorities that can be measured and demonstrated to your executive team.

Best Practice 1: Incentives. Aligning incentives to create shared goals may be common knowledge, but it’s hardly common practice. In many organizations there is an inherent conflict between the goals of the networking and security teams. The networking team may be concerned with maintaining network availability, which is obviously hindered as security and access restrictions pile up, while the security team resists any architectural changes if they can potentially introduce new risk. Consider defining both security and networking goals for both teams.

Best Practice 2: Reporting structures that foster collaboration. In some organizations, the CISO reports outside of the IT department (e.g. to the CFO). In the absence of a common boss, inter-team tension can quickly escalate. Simple things such as joint social events or locating the teams in close proximity can go a long way in fostering collaboration. Another common approach is to have “overlays,” where the networking team has a representative in the security team and vice versa.

Best Practice 3: A “single pane of glass.” All too often, the security team’s view of the network and risk are different to that of the networking team due to different tools that are used by each team. It is imperative that both teams use the same tools for provisioning and making changes to network security devices. You simply cannot have people in either department making changes without approval. Everyone needs to follow a process in order to make changes, even the network administrator. Without change control, your network becomes a free-for-all and poses a major security risk for outsiders and insiders.  

Best Practice 4: Holistic process analytics. Without good data and visibility, it’s not easy to understand where you may have made mistakes or introduced bottlenecks. Tracking each stage of the network change process (which team requested the change, how long did it take to analyze it, approve it for risk, provision the change, etc.) can help you identify and resolve inefficiencies.

Best Practice 5: Automation. First and foremost, automation can eliminate mistakes, which create tension. Automated tools are also better than human beings at “translating” requests that may be communicated in one language (e.g. the language of networking) into another language (that of security). Finally, whenever a person has to say no to a request, there is a potential for friction. However, if an automated solution does not allow something, it creates a sense of fairness: “the system won’t let me approve this” to “I don’t allow you to do this.”

At the speed of today’s business and with increased focus on automation, the lines are quickly blurring between operations and security teams. Aligning these teams is an imperative; if your factions are warring, don’t delay in doing something about it.