Application Security , Governance & Risk Management , Legacy Infrastructure Security

Adopting a 'Shift Left' Strategy

To deliver a secure Infrastructure as Code service, development teams must adopt a "shift left" strategy that brings all the applications and security under one umbrella to provide faster and continuous delivery of the fully automated code, according to Ori Bendet and Igor Markov of Checkmarx.

Markov says Infrastructure as Code, or IaC, is the process of provisioning and configuring an environment through code instead of manually setting up the required devices and systems. Once code parameters are defined, developers run scripts, and the IaC platform builds the cloud infrastructure automatically, he says.

See Also: Managing API Security

“One of the major changes we witnessed in the infrastructure's cloud-native development as a coding platform was that every application is saved as a code in the repository and scanned separately to find vulnerabilities and potential misconfiguration early in the development cycle,” Markov says.

In this video interview with Information Security Media Group, the executives discuss:

• Use of open source in the infrastructure-as-code development process;
• Use of automation in the coding process;
• How to provision infrastructure and configuration in a cloud environment.

Bendet, director of product management at Checkmarx, leads its flagship product, CxSAST - Static Application Security Testing. Previously, he held product and engineering positions at Time To Know, HPE, PicApp, and Bezeq.

Markov, head of the SAST product unit at Checkmarx, has over 20 years of experience in research and development and business operations. He is experienced in leading design, development, modernization, enablement, and support of enterprise products, including native cloud, SaaS, and on-premises, high-scale, data-driven and analytical applications.