Security risk and governance are absolutely essential for IT professionals in the enterprise
today.
We're speaking with Brennan Baybeck, who is the vice president of Global IT Risk Management
at Oracle.
Brennan, how are you?
Great.
Thank you, Michael.
Tell us about your environment.
Our environment is extremely complex.
We're currently in a transformation where we're moving much of our IT infrastructure
and IT systems to the cloud.
And so, we would be what people consider a hybrid environment where we've got things
that are still on-premise in our data centers that we own and manage.
We have things that are definitely all completely cloud-based, and then we have things that
are in the middle that is used to help us interface the systems in the different environments.
Brennan, share with us some of the practices that you follow that perhaps others can learn
from.
The practices that we follow that I think would be beneficial for people to hear about,
one is the way we manage our threats and vulnerabilities at the company.
We have a governance program in place for that where we are actively seeking information
from all of our vendors.
Oracle is a big one, of course.
Understanding what the threats and vulnerabilities are to our environments, what they're doing
in relation to their products to address threats and vulnerabilities and, alongside that, we
have a good asset inventory system where we keep track of all the assets so that we know
what we have to patch and when and where the vulnerabilities should be applied.
Are there specific challenges that you face as you go through and try to execute this
program you're describing?
Yeah, definitely the asset inventory at a large company like Oracle is a challenge and
all my peers that have companies of our size have the same challenges.
The challenge there is that things are changing so rapidly that keeping those assets up to
date, ensuring that they are automatically updated through automated techniques and things
are what we're really looking for.
Oracle has got a great program around that.
They link the vulnerability information as well as the patching information through that
automation as well.
That's very beneficial to us.
Brennan, what's the relationship between these types of governance practices and the end
result of having excellent security?
Having a good governance program gives you many benefits.
The first one is protecting the business and the critical assets of that business.
The critical assets, one of the main critical assets is the data.
But if you're in a services business like we are at Oracle, good governance also helps
drive compliance with contractual requirements with customers, regulatory compliance with
regulators.
Additionally, it also helps with ensuring that the various components of your security
program are covered, whether it's security operations, change management, configuration
management, patching, threat intelligence, whatever.
Starting with that good governance program, those are what the benefits are.
You're describing, it sounds like, governance that covers both the technology deployment
details as well as the processes.
Yes.
Actually, any good governance program should cover not only those two areas, the process
and technology, but also the people.
There's an old security saying that the people are the weakest link in the security chain.
We still see that today.
I've been doing this over 25 years.
Especially in large organizations with companies that are moving into DevOps processes and
building security into those processes.
It's more like a security education and making people part of the solution versus just sitting
on the edge.
Brennan, you mentioned DevOps, and we hear lots of discussions these days around DevOps,
but we don't hear too much about the role of governance and risk management in DevOps.
The role is actually changing quite a bit.
In the past, you would see security risk people and governance individuals kind of sitting
on the edge in a checklist type approach where the project would get done and then security
and governance would come in, check some boxes, and determine whether or not it's active in
addressing the requirements that it's supposed to.
In DevOps, that's a lot different.
Things are iterating very quickly.
Things are happening; multiple iterations in a day.
The governance professionals and security professionals have to kind of rethink, retool,
and reskill themselves on how they're going to interface into those types of processes.
Well, of course, then I have to ask you; how will they retool and make sure that they're
fitting into those kinds of processes?
As an example, what my team is considering and starting to work towards is, instead of
being a person that is in there in the middle like a gatekeeper, we look to automation to
do that.
We look at making the developers responsible for implementing the proper security into
their products and their services.
One way that we look at this is, instead of it being a security vulnerability, it's not
a defect in their code.
They know how to react to a defect in their code, which is, they need to fix that.
It's just like any other defect that they're working to fix in the next iteration.
In the past, the security vulnerability would have been something that would ship off to
a security professional to go look at, make an opinion on it, and then instruct that person
to do a certain type of change.
We want to get out of that role and in that process.
What we want to focus on is creating the automation to allow them to move faster, create the value
faster, and to enable the business.
Okay.
Brennan Baybeck, thank you so much.
Thank you, Michael.