Shift left security

Shift left security means moving security checks earlier in the making of software, into the developer's everyday work, instead of testing only just before release. The name comes from the way software teams draw their process, as a line from left to right: plan, write code, build, test, release and run. Checks that once sat near the end of that line are moved towards its start. The same idea is often called DevSecOps, short for development, security and operations.

Here is how it works in general. While the developer types, a plug-in in the code editor points out risky code. When the developer opens a pull request, a proposed change for other developers to review, scanners read the change automatically. One kind, static analysis, reads the code for patterns that become vulnerabilities, such as user input that is never checked. Another, software composition analysis, checks the open-source libraries the code uses against lists of known flaws. Others look for passwords written into the code, and inspect the container image that the software ships in. These checks run inside the CI/CD pipeline, the automated system that builds and tests every change. A serious finding stops the change from being merged until it is fixed.

Why move the checks earlier? A flaw found while the developer is still writing the code takes minutes to fix. The same flaw found after release may need an urgent patch, and an attacker may already have used it. The developer also learns, at the moment it matters, what made the code unsafe.

Take, for example, a developer at an insurance company who writes a database password into the code. Static application security testing flags the line before anyone else sees the change.

Consider a serious flaw announced in a popular open-source library. Software composition analysis tells every team the same day which of their applications contain that library.

Imagine an engineer writing the code for a car's braking unit. Static analysis for safety-critical code checks each change against the strict coding rules that carmakers require.

Shifting left has a cost. Every scanner produces findings, and developers can be buried under them. Application security posture management removes the duplicates and hands developers a short, ranked list.

How is shift left different from runtime protection? Shift left checks the software before it runs. Runtime tools, such as cloud workload protection, watch the software after it is live, and catch what the early checks missed. Teams need both.