The document discusses the concept of 'shifting left' in software testing, highlighting the importance of integrating security early in the development process according to the devsecops paradigm. It emphasizes the need to also 'shift right' to effectively respond to threats by providing feedback from production to development. The author encourages the establishment of a feedback loop among development, security, and operations for improved optimization and security practices.

1. Shift Left. Wait, what? No,
Triangle DevOps
11/7/2018
Photo by Nick Fewings on Unsplash
...Shift Right!!!

2. About me
Phillip Maddux
Principle AppSec Researcher & Advisor
@Signal Sciences
https://signalsciences.com
Career Summary
WebDev, DBA, SA, IT Auditor (~7 yrs)
AppSec in Financials, EY & GS (~9 yrs)
On the socials
● Twitter: @foospidy
● Github: http://github.com/foospidy
● LinkedIn: http://linkedin.pxmx.io
● Blog: http://pxmx.io
Honeypot Enthusiast
● HoneyPy
● Honeydb.io

3. For clarification… this is not about voting
Photo by Mirah Curzer on Unsplash

4. We’ve been hearing a lot
about shifting left.
Photo by Samuel Zeller on Unsplash
An approach to software testing and
system testing in which testing is
performed earlier in the lifecycle
(i.e., moved left on the project
timeline). It is the first half of
the maxim "Test early and often." -
Wikipedia
The DevSecOps paradigm that we are all preaching is
"Shift Security Left" e.g. design and develop your
application with security in mind as early as possible
and integrate security into CI/CD pipeline.
- An AppSec person in an AppSec Slack channel
Fun Fact: There is even a cloud
security company named “ShiftLeft”.

5. That is all good
Photo by Jonathan Daniels on Unsplash

6. But we’ve
been shifting
left for
years
Photo by Tim Gouw on Unsplash

7. We need to shift right in a way that
enables us to...
Photo by Jon Tyson on Unsplash
...respond to threats and prioritize what
we do on the left.

8. Instrument for security...
Photo by Patrick Fore on Unsplash
We already do this for application performance monitoring
One of the best approaches is to provide rapid
feedback to developers. In the land of
application performance, we found that
running APM tools in production was a way to
help developers find places to optimize their
code. This created a feedback loop from
production (the right) to development (the
left).[1]
Any sensitive /
high risk
transactions.
1. James Wickett, https://labs.signalsciences.com/devsecops-security-shift-right

9. Shift right, and start applying a feedback loop
to Dev, Sec, and Ops!
Photo by Jerry Kiesewetter on Unsplash
Thank you
Also, check out James
Wickett’s blog post for
additional thoughts on
this topic.