Shifting security left allows engineering to integrate security into DevOps

As you probably know by now, trends like “shift-left security” and “DevSecOps” refer to integrating security throughout the build cycle, rather than the end, where it traditionally resided—or should we say ‘languished?” Shifting left can help organisations keep workloads secure in the age of cloud-based applications and infrastructures that are constantly changing and constantly subjected to increasingly sophisticated cyber-attacks.

The more metrics we gather, the more compelling ‘shifting left’ in application development appears. For example, organisations could be looking at:

• A 70% reduction in build costs.
• Three times faster build speeds, compared to legacy methodologies.
• A 50% average time reduction in time to go-live.
• Up to 40% reduction in run operation costs vs legacy.

Beyond this, why is it important?

Research* shows that during the past five years, up to 76% of all vulnerabilities were from applications. This can be viewed as an opportunity, because shifting left can start addressing 76% of all your vulnerabilities in a single step. As the numbers above show, the earlier you catch problems, the cheaper (and faster) they are to fix. If you have to stop everything and fix code that was created months ago, you’re going to pay more and it’s going to take a while.

*www.accenture.com/security