Shift-left security
In classical software development, security was handled downstream: when the software was ready to be released, a security department or external company would perform a security review. The problem with this approach is that it's hard to fix architectural problems at that point. In general, the later you fix a security vulnerability, the more expensive it gets; and if you don't fix vulnerabilities, the costs can be many millions, which can lead to bankruptcy for some companies. The earlier you fix a security vulnerability in the development life cycle, the cheaper it is (see Figure 13.2):
Figure 13.2 – Costs for fixing security vulnerabilities in the development life cycle
That's what we call shift-left security: baking security into the development life cycle and making it an essential part of all activities.
The problem is that there are not enough security specialists out there to put them in every engineering...
