Shift‑Left Security: Early Testing Benefits
Key Points
- Discovering security flaws late in the SDLC often forces costly, time‑consuming rework that delays releases and disappoints users.
- The traditional SDLC places testing (including security) after code is built, making it a reactive step that can miss critical vulnerabilities.
- “Shift‑left” security moves security testing into the earlier development phases, enabling developers to catch and fix flaws as they code.
- Integrating security early through DevSecOps fosters continuous collaboration among development, operations, and security teams, improving overall security, reducing expenses, and delivering higher‑quality software.
Full Transcript
# Shift‑Left Security: Early Testing Benefits **Source:** [https://www.youtube.com/watch?v=vOpIbH4RQ70](https://www.youtube.com/watch?v=vOpIbH4RQ70) **Duration:** 00:06:04 ## Summary - Discovering security flaws late in the SDLC often forces costly, time‑consuming rework that delays releases and disappoints users. - The traditional SDLC places testing (including security) after code is built, making it a reactive step that can miss critical vulnerabilities. - “Shift‑left” security moves security testing into the earlier development phases, enabling developers to catch and fix flaws as they code. - Integrating security early through DevSecOps fosters continuous collaboration among development, operations, and security teams, improving overall security, reducing expenses, and delivering higher‑quality software. ## Sections - [00:00:00](https://www.youtube.com/watch?v=vOpIbH4RQ70&t=0s) **Shift‑Left Security to Prevent Late Fixes** - The speaker outlines how discovering security vulnerabilities late in the SDLC causes costly delays and rework, and advocates embedding security testing early (shift‑left) to avoid these issues. ## Full Transcript
so you just developed an application and
you're ready to push forward in the
market with production but discover a
major security vulnerability that causes
you to go back and rework the code
entirely this could take days weeks or
even months to fix which in turn causes
your deployment deadline to slip
increased costs to rework and
disappointed end users who are excited
about this new app so why did this
happen and how can you fix this moving
forward hi I'm Carolyn and I'm a product
marketing manager with red hat and today
we're going to be talking about shift
left security and why it's important for
developers and it professionals when we
think about shiftleft security it's
important to think about the software
development life cycle or the
sdlc the sdlc is a framework that
developers use to develop deploy and
maintain their applications and you can
think of this as a line that goes from
the left to the right the leftand side
is all focused on coding and building
the application software itself so Key
activities here include planning the
scope of the
software defining function
requirements designing key parameters
like the platform or the
architecture and building the software
itself so that is all covered on the
left hand side of the sdlc the right
hand side is all focused on production
so Key activities here include the
testing phase which includes security
tests of the
application the deployment stage so
making the app available to its intended
end users and then lastly the
maintenance stage so constantly
addressing different bugs and
vulnerabilities that pop up
traditionally when looking at the sdlc
you can see that this testing phase
comes after the code has already been
built the problem with this is that
security flaws often times go unnoticed
within the sdlc process and in turn
cause for costly and complex rework
later down the line this makes it a very
reactive approach enter shift left
security shift left security is a
concept that essentially moves this
security testing phase over to the
leftand side of the software development
life cycle where the code is actually
being
built this has become fundamental to
Modern software application development
because by doing so developers can
quickly identify the security flaws as
soon as they come up they can save vital
time and resources and money and they
can ultimately create a higher quality
end
product the idea of shiftleft security
builds upon the common concept of Dev
seop
in which developer
teams developer operations teams are in
close collaboration with security
teams it's important for devops and
security teams to kind of share that
responsibility of security across all
departments so that they can ensure
early and continuous security
integration rather than leaving it as an
afterthought so let's go ahead and walk
through some of the benefits of shift
left
Security
benefits so the first benefit of
shiplift security is obviously you're
going to have better security overall of
your application so that is a huge
benefit for both you and the end users
you can also ensure that you're
delivering your apps faster um so you
are making them available for the end
users as soon as you say that you are
that's going to overall enhance their
experience and as the developer you will
ensure that you are saving time and
money while additionally reducing
overhead
costs because you don't have to go back
and rework the application as soon as
you see those security vulnerabilities
arise the last benefit of shift left
security is that you are going to reduce
overall delays in
production so that's a quick list for
you the bottom line is that nobody
benefits When security policies are a
mystery it's important for developers to
not only understand security policies
but include remediation within their
developer tasks so they can proactively
address security risks with shift left
security there are a variety of tools
that developers can choose from to help
strengthen their Dev SEC Ops approach
one of which is Red Hat Advanced cluster
security for kubernetes or
ACS ACS works with any kubernetes
environment and it automates this the
dev set op's best practices and
integrates devops tools with security
tools to secure workloads and shift
security left ACS is included within a
grouping of tools at red hat called Red
Hat Trust software supply chain or
tssc which helps
organizations secure their workloads
from the beginning of this software
development life cycle rather than
leaving it as an afterthought as we
discussed
previously if you want to learn more
about these tools Red Hat ACS and
trusted software supply chain along with
additional resources around shift left
security and Dev SEC Ops approach be
sure to check out the links below that's
all I have for you for today thank you
for listening and we'll see you next
time