DevSecOps – Breakthrough? Or Buzzword?

In the beginning, the tech gurus created DevOps, and saw that it was good.

Next, buzzword nation went off and started creating ThisOps and ThatOps, and here at Fishtech Group, we saw that it wasn’t good.

One of the “Ops” iterations making its way onto the market and into the industry consciousness over the last few years is DevSecOps, which is essentially adding “security” into the previous combination of Development and IT Operations (“DevOps”).

You may have noticed that this is the first time we have mentioned anything about DevSecOps on our website. You may also be asking, “wait, aren’t you a cybersecurity solutions company? Shouldn’t security be a core focus of your offerings?” Of course!

So, why aren’t we providing “DevSecOps” alongside our DevOps offerings? Let’s clear a few things up.

Security in DevOps is a Byproduct of Quality

We talked a little bit in our previous “What is DevOps?” blog post about the pitfalls of buzzwords surrounding DevOps, and DevSecOps is a prime example.

While we don’t disagree with the primary principles of so-called DevSecOps, we think it unnecessary to make a new distinction and are wary of offerings of “DevSecOps” as if it’s a new and shiny thing you should divert your resources to.

With the invention of DevSecOps, it sounds like security is just now in consideration for DevOps principles and processes, but we beg to differ.

Security in DevOps is inherent.

Security in DevOps is implicit.

Without security, DevOps isn’t DevOps.

Security in DevOps is a byproduct of quality. If DevOps practices are implemented correctly, security will be there. But don’t just take it from us…

The Phoenix Project (The Experts Have Spoken)

Our team has been passing around a copy of The Phoenix Project: A Novel About IT, DevOps, and Helping Your Business Win, which was written by some of the progenitors of the DevOps movement, and they mention the inclusion of information security within the DevOps structure, without referring to such an organization as DevSecOps.

In fact, one of the primary writers, Gene Kim, was the CTO of a cybersecurity company for years before writing The Phoenix Project. If there was no distinction made by an originator of DevOps, who has extensive history in cybersecurity, we don’t think there needs to be one either.

We’ve done our own market research to look into what the unique aspects of “DevSecOps” really are. To be honest, they sound kind of familiar…

Automation Through CI/CD Pipelines

Time and time again, source after source brought up automation through CI/CD pipelines as a core tenant of DevSecOps saying that DevSecOps automates security within the DevOps workflow. In our experience this is already a key part of the DevOps philosophy.

As we’ve mentioned, DevOps practices focus on busting silos and automating process from all applicable teams, including IT Operations, Development, Security, and more.

That’s just what DevOps is.

The Focus Should Already Be On Security 

Furthermore, these sources mention that “real DevSecOps” needs to place an emphasis on empowering teams to improve security practices for quick review and approval processes that leave an audit trail and meet compliance requirements. We agree!

But, again, this is something that we believe is already covered in DevOps practices and principles.

Let us again clarify that we find nothing wrong with the ideas behind DevSecOps. Security is supremely important. Our belief is simply that putting a new name on established practices to spin up new business isn’t the right approach.

In Conclusion

Rest assured! While you may not see “DevSecOps” in our offerings, security is still a top priority as we guide organizations through total digital transformation utilizing a DevOps perspective.

DevOps may go by many names, but true DevOps bakes security into every process, principle, and toolset.

It’s time to embrace the DevOps revolution and see the speed-to-value ramp up in your organization. Let silos be a thing of the past and learn how to continuously and reliably deliver value to your customers faster.

DevOps truly provides the purest form of Digital Transformation.

Buzzword Bingo with Eric Foster & Rick Holland

Recently we were excited to welcome Rick Holland, CISO and Vice President of Strategy from Digital Shadows, to sit down with our own Eric Foster, COO of CYDERES to discuss a wide range of topics across the landscape of cybersecurity.

Check out their fascinating discussion around:

  • DevOps
  • Purple Team
  • AI & ML
  • The “Cloud”
  • The state of SIEM
  • And more …

Bridge to DevOps: Our Unique Approach

We believe DevOps is MORE than a buzzword.

We’ve seen it revolutionize the way our customers deliver speedy value to their customers.

We’ve seen silos busted and teams working more efficiently to innovate securely.

Now that we’ve discussed the history of DevOps and how traditional organizational structures are being revamped for exponential increases in efficiency, let’s take a moment to look at how we approach the implementation of DevOps principles and practices in your organization.

DevOps is more than a practice, it’s a cultural shift. It’s important to take each unique aspect of your organization into consideration as you proceed through every step of this transformation.


DevOps success looks different for every organization while maintaining the same overall tried and true principles of success.

Therefore, the first step in an effective DevOps reorganization strategy is always to take time analyzing what success looks like for your organization and what exactly your core objectives are.

For example, identify a specific targeted process we want to improve. Next, how will we know if we have improved it, or if we’ve actually made it worse? Identifying metrics and KPI’s are crucial in measuring success.

Once we define measurable goals for this project’s timeframe and scope, actionable steps can be set as we progress in shifting the overall culture.


In order to truly sow the seeds of cultural change within the organization, it’s critical that the key personnel are deeply involved and accountable to the process.

Each of these people should be involved in deciding:

  • What are the business objectives we can focus on during the course of this project?
  • What are the requirements that we must keep in mind?
  • Who are the main groups/stakeholders that should be interviewed to gather intelligence?
  • Which of these stakeholders are the most sympathetic to this shift?


This phase involves ascertaining the crucial intelligence needed to begin the transformation towards an effective DevOps culture.

It can and will be painful – silos will be revealed, lack of efficiency highlighted, redundancy and bottlenecks discovered. Keep in mind the goal is not to focus on the negative, but to isolate what’s keeping your organization back and apply the principles to change.

Iterate and improve! That concept is essential to the core of DevOps.

As your DevOps advisor, we will ask fact-finding discovery questions like –

  • In the targeted process, what are the steps, even if loosely understood?
  • How do you track/confirm the success of your process? (e.g. what, if any metrics exist to track the success of this process)
  • Where is significant re-work generated or received?

With all of this analysis of current toolsets and other relevant information, a thorough review of organizational processes can be compiled.

PHASE FOUR: Develop DevOps Structure

At this point, several key processes have been identified to be in need of serious adaptation or to be removed and replaced altogether!

The key personnel involved can continue to work with this data and, with the help of your DevOps advisor, develop detailed recommendations for moving to a CI/CD pipeline. This includes evaluating your technology stack for stability and efficiency moving forward as new benchmarks for success are created.

The new DevOps structure is beginning to take shape, and because the right people have been involved in the discovery and analysis phases, they will have a clear cultural buy-in to lead the new DevOps charge.

PHASE FIVE: Documentation & Execution 

The analysis and conclusions of each of the previous phases culminate in an executive summary that the DevOps advisor will deliver with detailed recommendations for immediate and ongoing execution.

This involves clear and documented process instructions, training on the various new or augmented toolsets, and redefined roles and responsibilities for those involved.

The end result is really no end at all, rather a commitment to ever increasing efficiency and speed to value, constantly innovating and growing your DevOps culture.

Have a question about any of these phases and how a Fishtech-led DevOps workshop can benefit your organization? Put our industry-leading expertise to work for your business, and watch pure digital transformation unfold.

Bridge to DevOps: What is DevOps?

Breakfast + Lunch = Brunch.

Chilling + Relaxing = Chillaxing.

Some of the best things in life are fusions of two equally great things in order to make something that’s even better. That’s why this little equation has us very excited:

Development + IT Operations = DevOps

Sure, many talk about “DevOps” with various definitions and in many different applications. But is there anything real behind all the buzzwordy hype?

From the tested and delivered value our customers are experiencing – the answer is a resounding YES.

This month we plan to cut through the language and illuminate the real value that a genuine DevOps practice (and overall culture) can bring to any organization.

Let’s start with the basics.


What exactly is DevOps?


Our DevOps model is defined as “a set of practices and cultural patterns designed to improve your organization’s performance, revenues, profitability, and outcomes.” We believe that having a DevOps approach is important for every modern business in an increasingly technological world.

Companies can no longer afford to specialize in their industry alone. The pizza war proves it: Every company today is a technology company. From 2010 to 2019, Domino’s share price rose 3,405 percent. Some of their competitors only saw a fraction of that share growth. Why?

Domino’s understood that they needed to be a technology company first and a pizza company second. They put a number of applications into place to allow their customers to easily order a Domino’s pizza from multiple devices and multiple platforms including via text, Twitter, and Amazon’s Alexa. This is a prime example of a company embracing technology as a core part of its business.

As organizations continue to embrace digital transformation, how should their various teams be structured? How can DevOps principles help increase the speed, efficiency, and value they bring to their customers?

Next, to show you the value of DevOps and how it can transform your business, let’s take a look at the traditional organizational structure of an IT organization.


Traditional Organizational Structure Inefficiencies


Traditionally, the organizational structure of a team implementing changes would be:

  • Dev Group / Application Team
  • Network Team
  • Security Team
  • QA Team
  • Other smaller teams

These are all separate teams working on their own goals… and not working together. Any changes requested may take weeks to go through all of the various silos. With so many moving parts and red tape, things never seem to get done. This is the traditional place that DevOps arose to address.


DevOps is the DevOpposite


Organizations using a DevOps approach have small cross-functional teams that include all of the skill sets mentioned above. These could be assigned per project or product. These cross-functional teams allow for a better implementation of a Continuous Integration/Continuous Delivery (CI/CD) pipeline and can lead to faster go-to-market strategies. When you bust the silos of traditional IT organizations, you don’t have to wait for each separate team to complete their tasks before moving a project along.

So, what is the ideal DevOps team structure? It can be different for every team, and different practices may be more ideal for your business objectives, and where you are at in your digital transformation. Ideally, working with a highly knowledgeable team of experts that can analyze your current situation and how best to move forward would allow you to adopt DevOps practices and principles in a tangible way that can help you achieve your goals, and keep DevOps away from the buzzword garbage bin.


DevOps… More Than a Buzzword


Hear it from James Grow, Fishtech Group’s Director of DevOps and Security Automation:

“It’s almost become a buzzword, and it’s kind of a tragedy, but knowing what DevOps is about, and then adopting those concepts helps us to scale, automate, and improve our culture, employee satisfaction, and most importantly, help deliver faster value to our customers.”

Utilizing a consultative approach, Fishtech Group covers the tools and processes needed to implement a DevOps practice while addressing the necessary changes to adopt new toolsets, processes, and training for all facets of an IT organization.

It’s time to embrace the DevOps revolution and see the speed-to-value ramp up in your organization. Let silos be a thing of the past and learn how to continuously and reliably deliver value to your customers faster. DevOps truly provides the purest form of Digital Transformation.

The Speed of Chronicle: “It’s Like Google… for Business’ Network Security”

Changing Cybersecurity for Good.


A bold tag-line for Alphabet Group’s new security arm, Chronicle. After working deeply within their Chronicle platform, we believe it’s absolutely true.

CYDERES, Fishtech Group’s Security-as-a-Service division, has been tapped as one of Chronicle’s initial partners worldwide trained and licensed to deliver managed detection and response services for its new Backstory platform.

Today we’re going to zoom in and focus in on one particular powerhouse feature of Backstory … speed. But first, for the uninitiated:

What is Chronicle?

Born from X, Google’s “moonshot factory” intent on solving the world’s most intractable problems, Chronicle is a new company within Alphabet (Google’s parent company). Like Fishtech Group, Chronicle is dedicated to helping companies find and stop cyber attacks.

What is the platform?

Chronicle was built on the world’s biggest data platform to bring unmatched capabilities and resources to give good the advantage. Essentially, “It’s like Google Photos but for business’ network security” says Stephen Gillett, Chronicle’s CEO. But what makes Chronicle different? What gives it an edge in the cybersecurity space?

The Speed of Chronicle

With the incredible resources of Alphabet, including Google’s vast computing and cloud storage infrastructure, Backstory is able to process information at speeds previously unheard of in the cybersecurity space.

In the last several months since Chronicle’s launch, we’ve seen a repeated theme in rooms of CISOs as we demonstrate its’ capabilities – often leading to “holy sh*t” moments – as we showcase how unbelievably fast automatic analysis through Backstory can help analysts filter through and understand security telemetry … all in a matter of seconds.

Yes, that’s right – not 4 hours, not 4 minutes, even faster than 4 seconds to search through petabytes of data.

“Backstory can handle petabytes of data, automatically”  so you can find threats faster and spend more time actually remedying issues.

To demonstrate, here is a quick video demoing Backstory.

Now, let’s do an easy experiment to help us make a comparison. We’re going to highlight something you’re probably so used to seeing that it doesn’t register to you anymore.

  1. Go to
  2. Type in “Google Chronicle”
  3. Look at the top of your screen

What do you see? Google kindly spits out a few numbers detailing their speed.  As of this posting, we received 384,000 results in .56 seconds. That’s a lot of data, very quickly. That’s the power of Google.

Chronicle offers up similar speeds, but with a different focus.

Whereas Google is focused on web data, Chronicle is focusing on your security telemetry. Because it’s built on Google’s infrastructure, no matter how much data you’re working with, Chronicle can scale to your needs, without sacrificing valuable time. This infrastructure, along with strategic automation allows for Backstory to:

  • Handle more volume, including petabytes of data.
  • Provide automatic analysis to help your analysts understand suspicious activity in seconds, not hours.
  • Automatically connect user and machine identity information into a single data structure, giving you a more complete picture of each attack.

All of these factors amount to a huge asset for your organization – speed to value, speed to clarity, speed to security. Even major cyber thought leaders are “absurdly enthusiastic” about the solution.

Why CYDERES with Chronicle?

Powered 100% by Chronicle, CYDERES is the human-led and machine-driven 24-7 security-as-a-service operation of Fishtech Group.

We supply the people, process, and technology to help organizations manage cybersecurity risks, detect threats, and respond to security incidents in real-time.

“Chronicle is Google for your security data,” says Eric Foster, CYDERES COO. “We are the Backstory experts.”

With our dedicated personnel, we can bring the speed of Backstory and the power of 24/7 managed detection and response to protect your organization from the next big digital threat.

If you would like to learn more about the power of CYDERES and Backstory, let us know by filling out the form below. We’re excited to show you how we can help stop today’s alert from becoming tomorrow’s incident.

How SMBs achieve enterprise-grade cybersecurity

Winning at cybersecurity is difficult for today’s large enterprise. It’s more so for smaller operations.

Meet payroll, develop products, schedule benefits. With the long task list in mid-size enterprises, cybersecurity all too often falls by the wayside.

Every business is a technology business. Unfortunately, this puts small to mid-sized execs in an especially tough spot when it comes to cybersecurity. They often don’t have the architecture (the people, processes, or technology) in place to properly or efficiently secure their organization.

The threat of compromise looms large. The struggle to meet compliance requirements is real. And the distraction from the core business affects the bottom line.

Truth: Cybersecurity is every organization’s Achilles heel. The advantages of online commerce bring perils that absolutely need to be addressed. That’s why leveraging the cloud and shoring up security is imperative to a prosperous future.

Outsourcing to overcome financial hurdles

Outsourcing allows mid-size businesses to take advantage of the same kinds of tech resources that large companies have in-house. Cost-effectiveness is the biggest advantage, as medium-sized businesses would need to dedicate at least $1-2 million to stand up a security operations center (SOC) with three shifts of three analysts each, plus backups.

A partner with virtual SOC capabilities, by contrast, can offer superior 24/7 security for a fraction of the total cost of ownership — due to economies of scale, reliance on cloud infrastructure and deployment of AI techniques. Partnering with an outside provider is the best way for mid-level orgs to obtain enterprise-level security while maintaining focus on their core business.

Enterprise-grade security for all

We believe every organization deserves and needs enterprise-grade security. And we understand mission critical. Cybersecurity concerns are no less significant to the CEO of a smaller enterprise. It’s a huge stressor that detracts from the company’s mission.

To avoid downtime and disruption, mid-size orgs can’t afford to put off cybersecurity architecture assessments. With a roadmap of actionable findings — and a trusted partner, mid-size execs can focus time and talent on the company mission.

An Interview with Rick Holland and Eric Foster

Recently we were excited to welcome Rick Holland, CISO and Vice President of Strategy from Digital Shadows, to sit down with our own Eric Foster, COO of CYDERES to discuss a wide range of topics across the landscape of cybersecurity.

Check out their fascinating discussion around:

  • Blue team as a service
  • Digital risk protection
  • The current state of SIEM
  • Dealing with account takeover
  • Going from an analyst to a defender
  • The genesis of most phishing attacks
  • The future of information security 
  • The best BBQ in the country … and much more.

Chronicle's revolutionary platform, powered by core Google infrastructure

Have you heard about Chronicle?

Born from X, Google’s “moonshot factory” intent on solving the world’s most intractable problems, Chronicle is a new company within Alphabet (Google’s parent company). Like Fishtech Group, Chronicle is dedicated to helping companies find and stop cyber attacks.

Giving good the advantage

Chronicle (which is architected over a private layer built on core Google infrastructure) brings unmatched speed and scalability to analyzing massive amounts of security telemetry. As a cloud service, it requires zero customer hardware, maintenance, tuning, or ongoing management. Built for a world that thinks in petabytes, Chronicle can support security analytics against the largest customer networks with ease.

Customers upload their security telemetry to a private instance within the Chronicle cloud platform, where it is automatically correlated to known threats based on proprietary and third-party signals embedded in each customer’s private dashboard.

How Chronicle protects your telemetry data

Chronicle has implemented several layers to prevent sharing your telemetry data with third parties. Each customer has its own Individual Privacy Agreement that forbids data sharing of any kind including with Google – who themselves are unable to access your Telemetry data.

Storage on Google’s core infrastructure
Chronicle inherits compute and storage capabilities as well the security design and capabilities of Google’s core infrastructure. The solution has its own cryptographic credentials for secure communication among those core components. Source code is stored centrally and kept secure and auditable. The infrastructure provides a variety of isolation techniques (firewalls, etc.) that protect Chronicle from other services running on the same machines.

The Chronicle services are restricted and can be accessed only by specific users or services. An identity management workflow system ensures that access rights are controlled and audited effectively.

Each customer’s Chronicle telemetry is kept private and encrypted. The core infrastructure operates a central key management service that supports automatic key rotation and provides extensive audit logs.

Chronicle is giving good the advantage. Fishtech Group is helping to deliver.

Solving for X: Fixing the Cybersecurity Pipeline #3

Part 3 of a series

By 2021, experts predict we’ll see 3.5 million open cybersecurity positions worldwide, with at least 500,000 of those unfilled jobs in the U.S. alone. That’s more than triple the shortfall that existed just two years ago. Meanwhile, cyber-attacks are growing in scale and impact.

What’s an industry to do? Clearly, fixing the cybersecurity pipeline is imperative, and it won’t be a simple fix.

The problem is not merely a talent shortage. There are plenty of people interested in a cybersecurity career. And while companies need people who can be effective immediately, they may not require traditional, let alone advanced, degrees.

So how did our analysts and developers get started? What would they tell a friend interested in a cybersecurity career? Here’s what they said in their own words. (Identities retracted to protect the very busy.)

Find what interests you.

“Half of the time the person is really asking “how do I become a hacker/pen-tester?” without realizing how broad cybersecurity is. So, my first advice to anyone is to research the different domains in cybersecurity and pick a few that seem interesting. Find your passion in this awesome domain chart.”

Get experience!

“When I was mentoring college interns, I’d tell them the degree doesn’t mean anything to me without actual practical experience. Get the experience however you can whether it’s through an internship or just personal education. Two of my best hires came from completely different worlds: one was just out of the Army with a networking background and the other had just completed his Masters. Both had ‘the hunger’ and were always searching for the Why. ‘Why did this alert fire? Why did this desktop communicate to a malicious site? How did it happen? Who else could be impacted?”

Get involved!

“Find local security and security-related groups where you can both network and learn. Many are free and are great opportunities to meet people at all different levels and career paths in the industry.”

Learn a language!

“If you don’t have any experience as a developer, you need to get some. Learn a language or two. Python is popular, but even learning Powershell can be helpful. Knowing .NET, Java, Elixer, or any other language that is used for web applications is extremely helpful if you’re looking to get into penetration testing.”

Get the basic concepts!

“Gain at least a basic understanding of networking concepts. You don’t need to be a CCIE, but understanding routing and switching concepts, network segmentation, traditional networking tiers/layers, and what should go where from both a network and security solution perspective (e.g. IDS/IPS placement) are conversations that our engineers and architects have on a daily basis.  Most organizations have separate application development and network engineering roles/teams, and you need to be able to communicate with both of them.”

Read up on Cloud and DevOps!

“Understand what Cloud and DevOps are — they’re being embraced by more and more organizations, large and small. As with networking and application development, you need a good grasp on what these concepts are, how they differ from traditional data center and waterfall development models, respectively, and how to interweave security controls into those concepts.”

Toastmasters anyone?

“The ability to write and speak in front of others are soft skills that are not always emphasized but are very important. At some point, you’ll need to write a policy, procedure, process, or report of some type, and it can’t look like a fifth grader put it together. Similarly, be able to effectively present and communicate your ideas in front of people, whether it’s a group of peers, a customer, or your executive board.”

Dig in!

“Experience is, first and foremost, the most important factor to getting hired, but even if you’re experience is limited to a lab environment, a class in school, or what you put together at home, it’s still experience. There are plenty of free solutions out there than can be installed virtually on a laptop to at least gain an understanding of how something like a firewall, SIEM, or IPS works.  You can also download many free toolkits for pen testing and vulnerability scanning, and then test them locally on a VM to see how they work.”

Fishtech Cracks New Code for Success in Martin City

Recently the generous folks over at Martin City CID sat down with us to talk about what we do, our history (and that of our founder, Gary Fish) and our vision for building up our community in South Kansas City.

Click through to read this snapshot into who we are and what we’re passionate about!