1. Shifting Security Left
Security in a DevOps World.

2. What we're talking about
What is "Shifting Left"
Why is it important
How to start shifting

3. What is "Shifting Left"?

4. The practice of shifting left
Driving security closer to contributors
Confidentiality, Integrity, and Availability
Eliminating barriers across teams
Enabling IC's to do the right thing first
Reduce "Waste" in re-work and waiting
Driving security (Confidentiality, Integrity, and Availability) as close to the individual contributors (the work) as possible
Getting security as close to when changes are being made or better considered!
Blurring the lines between teams and fostering more collaboration
Enabling IC's by embedding the knowledge and providing the tools required to do the right thing
Reducing waste by eliminating re-work and waiting
Waste is a Lean term for any expense, or "work", that doesn't turn into value

5. Development
Code Review
Sec Review
Deployed
Sec Testing

6. Why is "Shifting Left" important?

7. Benefits to IC's, Teams, and Company
Market demands faster delivery
Autonomy leads to high IC happiness
Higher quality delivered to customers
Lower MTTR for errors
TL;DR "Better Security"
State of DevOps report
The markets today demand faster delivery of features
Days of batching changes for weeks or months is gone
More autonomy leads to higher IC's happiness in their work
Contrary to what some might believe…
Shifting left and moving quickly does not impede quality. It improves it!
That leads to lower MTTR due to faster iteration cycles and smaller batch sizes
Basically, It means a "Better Information Security Posture"

8. How do you start "Shifting Left"?

9. Set requirements with training Automate All The Things
Some first steps
Culture change
Set requirements with training
Automate All The Things
Trust but verify with gates
Tooling
Immutable infrastructure
Configuration Management
Shifting left requires a conducive cultures that value trust, moving fast, and empowering IC's
Start with education and awareness through training
Start automating your way into early stages and deliver results to IC's
Unit tests, static code analysis, vulnerability assessments
Trust but verify is a great phrase to live by
Instill trust in IC's and leverage automation to verify controls are being met
Driving tools to the further towards IC's serves to empower them
Using immutable infrastructure allows for greater confidence and trust
Use immutability to deliver system configurations to IC's
Then let the IC's take control of driving changes