Be Proactive! Shift Security Validation Left

“Shifting (security)” left approach in Software Development Life
Cycle (SDLC) means starting security earlier in the process. As
organizations realized that software never comes out perfectly and
are riddled with many exploitable holes, bugs, and business logic
vulnerabilities that require going back to fix and patch, they
understood that building secure software requires incorporating and
consolidating numerous resources.

This conclusion led DevOps and R&D leaders to become
proactive, acquiring technology to find and close these gaps in
advance, with the aim of reducing the cost and effort while
improving the quality of their outcomes.

With emerging comprehensive continuous security
validation technology^[1], the demonstrated
benefits of ‘shifting left’ as a fundamental part of SDLC can now
be applied to your cybersecurity program, with results far
exceeding the purely technical aspects of security posture
management.

At the development level, the conceptualization of SDLC is the
result of the convergence of numerous lines of thought to optimize
the process. From a cybersecurity perspective, the same thought
convergence process led to the concept of rolling out a continuous
security assurance program by implementing the fundamentals of
Extended Security Posture Management
(XSPM)^[2] technology.

The Security Posture Management Lifecycle

Like SDLC, XSPM is born out of the need to take into
consideration the entire security posture management lifecycle,
including validation from an offensive perspective. Since the term
‘shifting left’ was coined, a plethora of detect and response
solutions integrable into the CI/CD process has emerged. Yet, even
postulating a perfectly integrated and optimized advanced detection
and response tool stack, it will still suffer from a structural
flaw. Detect and respond is a reactive approach that leaves the
initiative in the hands of the attacker and presupposes the ability
to detect any and all attacks.

In reality, the increasingly dynamic nature of the cyber-threat
landscape and the asymmetric nature of cyber defense – an attacker
only needs to succeed once, whereas defenders need to block every
single attack – mean that focusing exclusively on the reactive
detect and response approach is akin to fighting the last war. The
time has come to switch to shifting further left towards
integrating a proactive continuous security validation process.

XSPM includes all the continuous security validation elements
and organizes them in a security posture four stages lifecycle –
Assess, Optimize, Rationalize, Assure.

• The ‘Assessing’ step consists of launching a comprehensive set
  of attacks covering the attack kill chain from beginning to
  end.
• The ‘Optimizing’ step identifies misconfigured security
  controls, enabling optimizing them to often compensate for not yet
  patched CVEs and reduce the IT team patching workload.
• The ‘Rationalizing’ step evaluates the efficacy of the
  detection and response tool stack, provides detailed information to
  improve their configuration and identifies overlapping tools and
  missing capabilities.
• The last step, ‘Assuring’, includes a dynamic analytic process
  that can be customized as needed and used to visualize the security
  posture trends over time.

Productivity tops security, let’s make security productive

The optimization of cybersecurity programs as facilitated by
XSPM’s framework and technology provides for better utilization of
the funds and resources invested in cybersecurity. Reducing
overlap, minimizing patching window, prioritizing workload, setting
KPIs, and other benefits directly result from integrating security
early on rather than retrospectively.

To achieve this combined optimization of resource allocation and
security posture, both security and risk management leaders first
need to establish a relatable, validated baseline. With data
emanating exclusively from a detect and response array, the reality
is an unoptimized sequential process that pushes the proactive
security validation step at the back of the queue and results in
antagonizing siloed DevOps and SOC teams. Misaligned goals between
teams lead to a chaotic flow of contradictory information hampering
the decision-making process, slowing down operations and
potentially leading to unsecured deployment.

Combining the two for secure software – the benefits of baking
XSPM in SDLC

When security testing only kicks in at the end of the SDLC, the
delays caused in deployment due to uncovered critical security gaps
cause rifts between DevOps and SOC teams. Security often gets
pushed to the back of the line, and there’s not much collaboration
when introducing a new tool, or method, such as launching
occasional simulated attacks against the CI/CD pipeline.

Conversely, once a comprehensive continuous security validation
approach is baked in the SDLC, daily invoking attack techniques
emulations through the automation built-in XSPM technology identify
misconfiguration early in the process, incentivizing close
collaboration between DevSecOps and DevOps. With built-in
inter-team collaboration across both security and software
development lifecycle, working with immediate visibility on
security implications, the goal alignment of both teams eliminates
erstwhile strife and friction born of internal politics.

Creating exponential outcomes

Shifting extreme left with comprehensive continuous security
validation enables you to begin mapping and to understand the
investments made in various detection and response technologies and
implementing findings to preempt attack techniques across the kill
chain and protect real functional requirements.

The process equips IT teams with all they need to identify
opportunities that solidify and stabilize security posture
management from the very start, avoiding costly delays in
deployment and minimizing the risk of successful breach attempts,
while SOC teams gain precise data on which to build a threat
informed strategy.

How are you going to be proactive today about your company’s
security posture?

Note — This article is written and contributed by Ben
Zilberman – Product Marketing Director at Cymulate^[3].