Security Think Tank: Shift left, shift right. What about shift everywhere?

It is a long-held belief that security needs to become more prominent in the development lifecycle. Instilling this belief in the developer community, however, has proven to be rather challenging. Work has been ongoing from different angles to achieve the goal of secure development, but we still seem to have some way to go (although many organisations have made great strides so far and lessons can be learned, as our research has shown).

A combination of approaches is needed to realise secure application development. Implementing security tools to help assess the complied application code, review the libraries being used and carry out regular vulnerability scanning are among the options available to organisations. By adding in the right processes and the right people, who also need to be trained and operate in a culture that is supportive of “secure by design and development” thinking, organisations can start to see the benefits that secure application development can bring to the business.

The concept of shift left has been proven to be highly effective in supporting this ambition. If you think about application development as a timeline, this is about taking the security considerations and shifting them left towards to the beginning of that timeline so that they are incorporated at the earliest stage possible. This can be supported by getting security elements included in the non-functional requirements for the application, for example.

While shift left is useful and can improve security within application development, this is not enough when you consider the whole application lifecycle. This is where two other elements come into play, and they are complementary. They are shift right and DevOps, or more importantly DevSecOps. Shifting right is about taking security to the right of the application development timeline and, similarly, DevSecOps is about having security in all elements of the development process.

“Once you have mastered shifting left and right, the next logical step is to automate elements of development and support. This is to ensure they happen and to ensure consistency”