0

Currently, we don't have a specific dedicated penetration or security tester/specialist in the team.

We've been scanned and audited by different companies specialized in internet security and we've been addressing the discovered issues using the forces of the backend development, frontend development and DevOps teams. Sometimes though, we did realize that we could've found some of the issues earlier, before the audit, if paid more attention to security testing.

At what point and what would be the signs of a time when a company would need to hire a dedicated security specialist and what would be the advantages/disadvantages of that action?

I'd like to keep the question generic, but will provide any details if needed.

  • 3
    Looks like you have to do risk analysis to figure this out. Perhaps the very people auditing you could help with that. – forest Dec 21 '17 at 3:02
  • This is a little unanswerable. A dedicated security person does not bring magic into your company. They bring skills, experience, and time. But those are things that your existing employees could also provide. The question is a pure HR question having to do with resource management, not security. – schroeder Dec 21 '17 at 10:19
  • @schroeder I guess you have a good point, I've tried to let the question be generic and, I think, I've got a good answer. Did not realize it does not fit the security SE in this format well. Voted to close as well. Thanks. – alecxe Dec 21 '17 at 13:33
3

Now.

The fact that you are realizing that issues are being found so late in the SDLC is a sign you need to hire security people. But here's the difficult part. There are many different disciplines in Information Security, and you may need to hire more than one person to cover the different disciplines. For example, the following are each different skillsets. There may be some overlap, but you'll be hard-pressed to find someone who is skilled at everything that has the depth necessary to get the job done correctly.

  • Software Architecture
  • Network Architecture
  • Code Review
  • Penetration testing
  • Vulnerability assessments
  • Risk management
  • Developer education

There also should be questions about where you want a security program to mature to. If you hire penetration testers that just find vulnerability after vulnerability, you'll end up with developers who keep writing bad code, because their mistakes aren't caught during the development process. Or during the design process. It's really hard for me to tell someone "yeah, I found this serious design flaw. You'll need to rip out a bunch of code to fix it." That's financially expensive. Human-time expensive. And developers don't really get education out of it.

It should be noted that even within each of these disciplines, there's different skills. For example, software architecture can be someone who is embedded in a team, but from the security team, helping design software. Or it can be someone who takes documentation near the end of the design process, reviews it, helps the team understand design flaws. Both approaches have their pros and cons. Or you may find people who are good at risk management when it comes to physical security, but not information security. Or people who are good at vulnerability assessments, but not good at penetration testing.

Take stock of what the company needs now, and start developing a security program around that.

Not the answer you're looking for? Browse other questions tagged or ask your own question.