From Security Champion to Engineering Security Culture: MTS Web Services Transforms DevSecOps Approach
MTS Web Services has moved away from the traditional Security Champion model toward an engineering-wide security culture that embeds DevSecOps practices into everyday work. Head of DevSecOps Ilya Sharov and DevSecOps Lead Nikolay Luzgin described the transformation in detail, explaining how the company addressed overload, shallow training, and lack of motivation that plagued the earlier program.
How the original Security Champion program operated
The company first secured internal approval, created a wiki space, and established rules requiring exactly one champion per team. Managers had to approve the additional workload, and champions were selected or appointed based on interest where possible. Entry barriers were kept low with basic DevSecOps training, and a helper system allowed champions to escalate findings to experts for triage of true versus false positives. Motivation came through internal currency redeemable for merchandise and badges, while playbooks clarified responsibilities during vulnerability handling.
Problems that emerged
Over time the single champion became the default contact for every security question, leading to role overload and diluted focus. Basic corporate courses proved inadequate for deeper skill growth, and appointed champions showed little desire to advance beyond minimum requirements. Teams also lacked clarity on exactly which security topics to learn, whether infrastructure controls or secure coding techniques.
Changes introduced
The company replaced the single-champion structure with multiple security heroes who voluntarily deepen expertise within their primary roles. A DevSecOps guild was formed inside the larger engineering community, supported by community managers who organize events. Regular activities now include meetups, workshops, case studies, and feedback sessions; the number of such events grew from a few in 2023 to 18 in 2025.
Security scan results are now visible to entire teams and tied to maturity metrics. A short DevSecOps onboarding course introduces new employees to existing tools and processes. Competency maps define role-specific tracks for developers, DevOps engineers, architects, and managers, with quarterly updates to materials and external courses adapted to internal terminology. Recognition programs highlight both individual heroes and top-performing teams, while basic training completion is linked to key performance indicators.
Results achieved
Engagement has grown organically as specialists pursue security skills for professional value rather than obligation. Product teams increasingly include secure development topics in their own events, and the topic has moved from a localized initiative to a sustained engineering practice across the organization.
Related articles
Security Vision SIEM Adds Monitoring for Missing Logs, Correlation Quality, and SOC SLA Compliance
Security Vision has released a major update to its SIEM platform that extends monitoring beyond external threats to the health of the data collection pipeline itself. The new release introduces continuous checks for source stability, allowing administrators to define acceptable event flow deviations and receive alerts when logs suddenly stop arriving. A dedicated dashboard now evaluates correlation rule performance through testing on simulated events and supports import/export in Sigma format for easier detection sharing across platforms. The StatAnalyser service applies statistical models to flag atypical behavior with special markers, while the incident card gains automated retrospective process-chain reconstruction that links parent processes, user sessions, and host movements. Additional oversight features track analyst SLA adherence and let managers drill from team-wide statistics into individual performance metrics. Overall, the platform aims to close the loop from data ingestion through detection, investigation, and response within a single managed workflow.
ManticoreSearch Publishes Detailed Checklist for Enabling Authentication in Production
ManticoreSearch has released an extensive checklist for safely enabling authentication in production deployments. The guide covers standalone nodes, distributed tables with remote agents, and replication clusters, stressing the need for thorough inventory of clients and nodes before changes. It details procedures for creating users with minimal privileges, testing in staging environments, and performing controlled rollouts during maintenance windows. Special attention is given to handling Bearer tokens, protecting auth.json files, and ensuring consistent authentication data across cluster nodes. The document also explains differences between RT-mode and plain-mode configurations and provides commands for initializing the first administrator and reloading authentication settings.
WhatsApp Web Gains Native Audio and Video Calling with Screen Sharing and Device Switching
WhatsApp, owned by Meta, is rolling out audio and video calling directly in its web version, eliminating the previous need for a separate desktop application. The update introduces a Calls tab with call history and favorite contacts, along with screen sharing and reactions that match most desktop app capabilities. Calls can now seamlessly transfer between devices without disconnection, allowing users to start a conversation in a browser and continue it on a smartphone. Group calls gain waiting rooms where the link creator can require manual approval for entry, useful for professional meetings. Additional improvements include background noise suppression, faster transition to HD video quality, and the ability to call users via usernames across platforms without sharing phone numbers.
Manticore Search Adds Built-in Authentication and Authorization Starting with Version 27.1.5
Manticore Search has introduced native authentication and authorization capabilities for SQL over MySQL, HTTP/HTTPS endpoints, and replication operations. The feature distinguishes between authentication, which identifies the requester, and authorization, which determines permitted actions such as read, write, schema, replication, and admin. Users can enable the feature via the auth directive in the searchd section of the configuration file, supporting both RT mode with auth.json storage and plain mode with an explicit path. Initial setup requires creating an administrator account, after which additional users can be managed through SQL commands like CREATE USER, GRANT, TOKEN, and SET PASSWORD. The system supports mysql_native_password, HTTP Basic authentication, and Bearer tokens, with mandatory SSL or HTTPS recommended for credential transmission. Detailed logging, permission checks, and phased rollout guidance are provided to minimize disruption in production environments.