Find out what's inside the January 2021 edition of the Journal & download a free copy of this month's featured article
The “shift left” approach is not a new concept within software testing and DevOps best practices and it is commonly thought of when discussing DevSecOps. This usually includes security testing earlier in the software development lifecycle with the goal of identifying security vulnerabilities and weaknesses prior to shipping code to operations. However, “shift security left” is commonly interpreted to be “get developers to run security tools”. This approach is fraught with issues as it requires developers to context switch out of their workflow, learn and use new tools, understand the output of these new tools, and file bugs to be remediated (in yet another tool). The “shift left” approach requires a harder shift left, bringing security testing as close as possible to the developer while not expecting them to learn new tools. Furthermore, security results need to be contextual and provide actionable next steps so they can be resolved as quickly as possible. Finally, security scans need to finish in minutes, not in hours or days. A harder shift left empowers you and your organization as it applies repeatable, defensible processes that automate security and compliance policies from the first line of code written.
In this session, we will discuss:
• Common pitfalls when implementing traditional “shift left” security
• How to best apply different security scanning techniques available
• Embedding security scanning into the developer workflow
• Automating secure development best practices
Alex Grohmann – Founder, Sicher Consulting
Mr. Grohmann (CISSP, CISA, CISM and CIPT) is founder of Sicher Consulting and an ISSA Fellow. He is the recipient of ISSA ‘Honor Roll’ and was president of the NoVa chapter for three years, winning Chapter of the Year during that time. He is a graduate of the FBI’s Citizens’ Academy and served on the board of directors for the Washington DC chapter of InfraGard for four years. Currently Mr. Grohmann serves on the board of directors of Northern Virginia Community College’s Workforce Development taskforce, NOVA Cybersecurity Advisory Board and is an mentor at MACH 37, the Virginia cyber security accelerator. He also sits on the IT sector coordinating council (IT-SCC)
David DeSanto – Senior Director, Product Management - Security at GitLab, GitLab
David is the Senior Director, Product Management – Security at GitLab. He is a network security professional with a deep background in security research and product strategy. David lives in the greater Dallas, TX area with his wife and their two dogs.
ISSA Webinars and Conference series cover all the continuing education credits to maintain your cyber security certifications. (CPEs, CEUs, ECE, etc). Each hour is equal to one continuing education credit. Certificates of completion are available upon request after completion. For instructions, click here.