Shift left security — Good intentions, poor execution, and ways to fix it
Summary
The whole premise of shift left is to put security into the hands of developers, empowering us to manage the risks associated with the code we write. Many of the tools marketed as “dev-friendly” integrate into our development toolset — Jira and Pull Requests notably — but don’t try to fit into our way of working. They alert us too late, adding unnecessary context-switching and forcing us to revisit and fix code that we’ve already moved on from. The key is to address these three points above in such a way that security feels like a natural extension of the work we’re already doing, rather than a series of external demands. By guiding us as we’re still in ‘work-in-progress’ mode with our code, security can adopt a positive coaching and helping stance, nudging us to correct issues before they become problems and go clutter our backlog.