This is a talk I gave at the Security Operations Center Summit on June 5th in Washington, DC.

1. The Agile SoC
Get the most from your security team

2. About me
I am Justin Erdman
Security Engineer @ Cybereason
Unapologetic Blue Teamer
justin.erdman@cybereason.com
Twitter: @elorionsec

3. Agenda
✓ What is it?
✓ Origin Story
✓ Why Agile?
✓ Core Principles / Elements
✓ The Real World
✓ Challenges
✓ Getting Started

4. ““Agile is not just a methodology, but a set of
principles and philosophy.”
- Pearl Zhu

5. Agile…Huh?
✓ Set of principles for software development under which
requirements and solutions evolve through the collaborative
effort of self-organizing cross-functional teams
✓ Advocates adaptive planning, evolutionary development,
early delivery, and continuous improvement, and it
encourages rapid and flexible response to change

6. In the Beginning…
✓ 1950’s – IBM started using iterative & incremental
software development methods
✓ 1970’s - Evolutionary project management & adaptive
software development
✓ 1990’s - Rapid application development, extreme
programming, scrum
✓ 2001 - The Manifesto for Agile Software Development

7. The Skinny
Responding to change Following a plan
Rapid iterations Big-Bang campaigns
Testing & data VS Opinions & conventions
Many small experiments A few large bets
Individuals & interactions One size fits all
Collaboration Silos & hierarchies

8. The Flavors Du Jour
✓ Scrum
✓ Kanban

9. Scrum!
✓ Iterative & incremental process for structuring work
✓ Leverages commitment as change agent
✓ Face-to-face communication / close online collaboration
✓ Gamification of work

10. Scrum-ptious
✓ Small team spending a short time building small things
✓ Time boxed & cross-functional teams
✓ Prioritized product backlog
✓ Three roles - product owner, scrummaster, & team
✓ Team velocity based
✓ No new items mid-sprint
✓ Scrum board reset every iteration
✓ Work only on those items that fit into the iteration
✓ Daily stand-ups

11. Roles & Ceremonies
✓ Roles
Product Owner
ScrumMaster
Team
✓ Ceremonies
Sprint Planning
Daily Stand-up
Sprint Review
Sprint Retrospective

12. The Quick & Dirty On Scrum
✓ Product owner creates a prioritized list
✓ team selects top item(s) from backlog
✓ Sprint (2-4 weeks) — team meets each day to assess progress
✓ Scrummaster keeps the team focused
✓ Hand work to customer / show to a stakeholder
✓ Sprint review & retrospective
✓ Rinse & repeat

13. Scrum Workflow

14. Kanban!
✓ Based on 3 basic principles
Visualize what you do today (workflow)
Limit the amount of work in progress (WIP)
Enhance flow
✓ Plan – Do – Study – Adapt (PDSA) approach

15. You Can Kanban
✓ Work split into pieces
✓ Limited in progress items for a specific workflow
✓ Not timed boxed
✓ No prescribed roles
✓ New items can be added anytime within the pre-decided limit
✓ Board not reset & can be changed by anyone on team
✓ Story points & velocity not used
✓ No prescribed product backlog
✓ Daily stand-ups common

16. Kanban Board

17. Our Story
Welcome to our crazy world

18. Change…Why?
✓ Better organization of process improvements
✓ Prioritization of high impact items
✓ Increased work throughput & (some) predictability
✓ Easier to track planned & handle unplanned work
✓ Better resilience to changes
✓ Minimized planning & coordination
✓ Greater ability to gauge growth over time

19. You like Sticky Notes…Right?
✓ Sprint zero 100% sticky notes
✓ No speed record attempts….yet
✓ Brain training
✓ Gamification of work
✓ Work to establish realistic team velocity
✓ Reinforce team mentality

20. Evolution
✓ Sticky Notes to Jira
✓ More realistic in sprint velocity
✓ Honest & direct team communication / feedback
✓ Full recognition of importance of ceremonies
✓ Less “I” & a whole lot more “team”
✓ Ask for help

21. Scrum Backlog

22. Active Sprint

23. Sprint Burn-down chart

24. Sprint Retrospective

25. Challenges & Setbacks
✓ Moving to Scrum calls for a culture shift
✓ Establishing a groove – training is necessary
✓ Makes it difficult not to be a team player
✓ Breaking down classic silos
✓ Accountability
✓ Distraction from BAU – Discipline!

26. Resources / Tools
✓ Tools
Jira
Trello
ServiceNow – Visual Tasks Boards
VersionOne
✓ http://www2.cprime.com/Agile-Impeditments-Webinar
✓ https://www.cprime.com/resources/what-is-agile-what-is-scrum
✓ https://www.atlassian.com/agile/how-to-do-scrum-with-jira-
software

27. thanks!
Any questions?
You can find me at
justin.erdman@cybereason.com
Twitter: @elorionsec