Rootconf Mini 2024 (on 22nd & 23rd Nov)

Abstract

In today’s fast-paced digital world, security must be a priority, not an afterthought. Adopting a “Shift-left” approach means integrating security early in the software development lifecycle (SDLC). This talk will discuss the importance of early security integration, the challenges organizations face, and how to implement security tools throughout the development process to improve application security.

We will share real-world case studies that illustrate the benefits of early security measures and provide practical tips on using shift-left security and automated tools to safeguard your applications and data. Additionally, we will talk about how an ideal path to production should look and introduce a selection of security tools that facilitate the shift-left approach.

Key Takeaways

• Understanding the Shift-Left Approach: Discover why incorporating security early in the SDLC is crucial for reducing vulnerabilities.

• Ideal Path to Production: Understand how an ideal path to production should look, including essential steps and considerations for security.

• List of Security Tools: We will look at different security tools that help with the shift-left security approach, such as SAST, DAST, Software Composition Analysis (SCA), Software Bill of Materials (SBOM), Secrets Detection Tools, and Infrastructure as Code (IaC) Scanning Tools. I’ll also share which tools I like the most and when to use them in the CI/CD pipeline.

• Real-World Challenges and Best Practices: Gain insights into common challenges teams encounter when integrating security early and explore strategies to overcome them.

• Importance of Culture and Continuous Improvement: Understand that Shift-Left is more than just adding tools to the pipeline; it’s also about creating a strong security culture and continuously improving security practices in the development process and within the team.

Audience

• Security Engineers and DevSecOps Practitioners

• Engineering Leaders and Decision Makers

• Developers and Software Engineers

• Technically Curious Professionals