While organizations are modernizing their development processes to drive business growth and productivity, security teams have been challenged to keep up. It is increasingly important for security teams to shift security responsibility left to developers. But in past years, friction reigned between development and security teams because development can’t slow down to incorporate needed security processes. Organizations are realizing that teams — including security, developers, DevOps, operations and IT teams — need to align to work together on common goals.
Shifting security left affects development cycles in areas including modernizing software development, infrastructure, and using new tools and technologies such as generative AI. It is essential organizations understand modernization trends to speed up productivity, enable collaboration and increase exposure for employees, partners and customers. It is also essential for organizations to understand that all of these efforts have security implications.
Modernization conversations must include looking at security implications on platform engineering, DevOps and software developers themselves. At the same time, security pros need to understand the development process to make sure security can be modernized to support efforts for greater productivity and scale.
Application development has evolved from Waterfall to Agile methodologies. Organizations now are shifting operations left for DevOps processes and to enable developers to provision their own cloud infrastructure. The result is that developers can rapidly build apps, release them and keep updating them. We’ve moved from a linear process — from left to right to build, test, stage and deploy applications — to an infinity software development lifecycle (SDLC) with continuous integration and continuous deployment. We now have a circular SDLC, where there isn’t as much of a predeploy left or a post-deploy right runtime process.
Organizations must forget the mindset of traditional security as well. While traditional security worked with Waterfall software development methods, it doesn’t work in today’s circular SDLC. Security teams must also remember that shifting left certainly won’t work if security vendors or security teams force security tools on developers. Tools instead need to work within developer workflows — they can’t slow things down. Security teams also need effective ways to help developers throughout the SDLC, with shorter feedback loops to efficiently remediate security issues in their applications without hindering productivity.
Below, view the first in a video series on modernization trends from TechTarget’s Enterprise Strategy Group in which analysts Melinda Marks, cloud and application security, and Paul Nashawaty, infrastructure and application modernization, discuss the business effects of cloud-native application modernization.
And stay tuned: The series will continue with more discussions on security in modern software development, including conversations at conferences with developers on application modernization and how security can keep up with modernization.
Note: Enterprise Strategy Group is a division of TechTarget. Its analysts have business relationships with technology vendors.
