{"id":83550,"date":"2023-04-20T10:40:00","date_gmt":"2023-04-20T14:40:00","guid":{"rendered":"https:\/\/staging.checkmarx.com\/?p=83550"},"modified":"2024-08-15T14:04:11","modified_gmt":"2024-08-15T14:04:11","slug":"shifting-left-no-longer-enough-time-to-shift-everywhere","status":"publish","type":"post","link":"https:\/\/checkmarx.com\/blog\/shifting-left-no-longer-enough-time-to-shift-everywhere\/","title":{"rendered":"Shifting Left Is No Longer Enough: It\u2019s Time to Shift Everywhere"},"content":{"rendered":"

\n\n\n<\/p>\n


<\/p>\n

Fully secure your applications and unlock business potential with Checkmarx One<\/h2>\n

\n\n\n<\/p>\n

\n\n\n<\/p>\n

Everything Everywhere All at Once<\/em> dominated the Oscars and is the buzz of the movie world. What if it\u2019s also the key to reimagining our approach to AppSec?<\/p>\n

\n\n\n<\/p>\n

\n\n\n<\/p>\n

No, that doesn\u2019t mean our application security teams have to grow hot dog fingers. We just need to readjust our thinking on application security beyond the outdated \u201cshift left\u201d narrative. Because we need AppSec everywhere, all at once.<\/p>\n

\n\n\n<\/p>\n

\n\n\n<\/p>\n

Yes, the hallowed ideal of \u201cshift left\u201d has been the AppSec dream for years, promising savings of time and money by remediating vulnerabilities earlier in the software development life cycle. But if you shift your application security testing left, doesn\u2019t that imply you\u2019re shifting your focus away from some other area?<\/p>\n

\n\n\n<\/p>\n

\n\n\n<\/p>\n

In a world that runs on code, we can\u2019t afford that. Focusing security on one phase of the software development life cycle is like locking the front door but leaving the windows open at Fort Knox. Threat actors, noting that you\u2019ve left so much to chance, will have a blast with that \u2014 until all the gold is gone.<\/p>\n

\n\n\n<\/p>\n

\n\n\n<\/p>\n

The logical solution: Shift everywhere<\/h2>\n

\n\n\n<\/p>\n

\n\n\n<\/p>\n

Modern application development (MAD) has been invaluable for software development teams, allowing them to innovate to stay competitive and build mission-critical applications at speed. But modern development practices, such as increased use of APIs, open-source code, containers, etc., introduce new attack surfaces.<\/p>\n

\n\n\n<\/p>\n

\n\n\n<\/p>\n

Cybercriminals are well aware of modern development practices and new attack surfaces and are taking full advantage of organizations that have not implemented comprehensive application security measures. As stated in a recent CSO article1<\/sup>, \u201cattackers [are] step[ping] up their assaults on beleaguered organizations.\u201d In fact, Forrester analysts noted2<\/sup>, \u201cSixty-two percent of organizations surveyed by software supply chain security vendor Anchore have been impacted by a software supply chain attack in the past year.\u201d<\/p>\n

\n\n\n<\/p>\n

\n\n\n<\/p>\n

To combat cybercriminals, we need to stay one step ahead. We need to secure every phase of software development for every application while simultaneously balancing the dynamic needs of CISOs, security teams, and development teams.<\/p>\n

\n\n\n<\/p>\n

\n\n\n<\/p>\n

Shift everywhere, defined<\/h2>\n

\n\n\n<\/p>\n

\n\n\n<\/p>\n

Shift everywhere is not just a slogan, it\u2019s a movement.<\/p>\n

\n\n\n<\/p>\n

\n\n\n<\/p>\n

Forrester pioneered the movement, calling for an end to the \u201cshift left\u201d approach in \u2018The State of Application Security 2022\u20193<\/sup> report. As the report notes, \u201cThis year, organizations are investing in security scanning throughout the life cycle …. A \u2018shift everywhere’ approach enables product teams to develop and deploy with speed and confidence.\u201d Without a shift everywhere approach, organizations run the risk of security gaps and delayed software deployments.<\/p>\n

\n\n\n<\/p>\n

\n\n\n<\/p>\n

Shift everywhere goes beyond securing the development life cycle. It\u2019s a shift in mindset that impacts every activity related to securing your applications, your organization, and your customers:<\/p>\n

\n\n\n<\/p>\n

\n\n\n<\/p>\n

Every risk<\/h2>\n

Security must be built into every phase of the software development life cycle so that risks are identified everywhere, as early as possible.  <\/p>\n

\n\n\n<\/p>\n

\n\n\n<\/p>\n

Every deployment<\/h2>\n

\n\n\n<\/p>\n

\n\n\n<\/p>\n

When an application goes live, that doesn\u2019t mean it\u2019s fully secure. You need to monitor your apps before and after deployment. Attackers can hijack open-source packages, or rushed developers can create shadow APIs, just to name a few threats. A shift everywhere approach means scanning every line of code, whether it\u2019s deployed or not.<\/p>\n

\n\n\n<\/p>\n

\n\n\n<\/p>\n

Every application<\/h2>\n

Shift everywhere applies to every application, not just the most critical ones. With our cloud-native application security platform, you can scan one application or one thousand \u2026 all with the click of a button for no additional cost. If you\u2019re not scanning every application, you could be leaving risks on the table.<\/p>\n

\n\n\n<\/p>\n

\n\n\n<\/p>\n

Every technology<\/h2>\n

To make all of the above a reality, your team can\u2019t be left dangling with a patchwork of tools that don\u2019t quite work together. Your AppSec solutions have to be easy to deploy and use, or, well, there\u2019s a great chance they\u2019ll never get fully deployed and used.<\/p>\n

\n\n\n<\/p>\n

\n\n\n<\/p>\n

Everyone<\/h2>\n

Security has to engage all parties \u2014 CISOs, security teams, and developers \u2014 so they abandon their silos to collaborate and innovate on meeting emerging AppSec challenges.<\/p>\n

\n\n\n<\/p>\n

\n\n\n<\/p>\n

In other words, it\u2019s time we refuse to settle. Shift Everywhere means securing every risk, every technology, every application, every deployment. Everything<\/em>.<\/p>\n

\n\n\n<\/p>\n

\n\n\n<\/p>\n

The impact of shifting everywhere<\/strong><\/h2>\n

\n\n\n<\/p>\n

\n\n\n<\/p>\n

So, what will shift everywhere mean to you?<\/p>\n

\n\n\n\n<\/p>\n