Rewired

Chapter 22Build in security and automation from the start

Treat your password like your toothbrush. Don't let anybody else use it, and get a new one every six months.

—Clifford Stoll

Almost all security breaches in the cloud stem from human error and misconfiguration, rather than from attacks that compromise the underlying cloud infrastructure.¹ Cloud requires secure configuration of applications and systems. In addition, traditional cybersecurity mechanisms have not been designed to operate at the tempo required. As a result, companies must adopt a new security approach built around automation.²

Shift left on security

“Shift left on security” is a software industry movement to inject security earlier into the SDLC, as opposed to leaving it to the last step (see Exhibit 22.1). There are two rationales for this.

First, it is quicker for development teams to address security concerns while code is being written. Any security concern can be addressed by an agile pod then and there in the process, without waiting for it to be detected later (often by a completely different team). The cycle time for detecting and addressing problems is drastically reduced.

Second, each step of the SDLC adds security checks at that moment in time. For example, in the coding step, checks can be made for vulnerabilities in third-party components used in the development. If a vulnerability is detected, it would enable the team to look for alternative third-party components to use as a workaround. ...