CRISC Certified in Risk and Information Systems ControlInformation Technology and SecurityHard
A software development company is adopting a DevSecOps approach. As part of this, they are integrating security tools and practices throughout the entire software development lifecycle (SDLC), from design to deployment. A key practice being implemented is automated security testing within the continuous integration/continuous delivery (CI/CD) pipeline, ensuring that code is scanned for vulnerabilities with every commit. This practice directly supports which core principle of DevSecOps?
- AContinuous Monitoring
- BInfrastructure as Code
- CShift Left
- DImmutable Infrastructure
Show answer & explanationAnswer & explanation
Correct answer: C. Shift Left
The 'Shift Left' principle in DevSecOps advocates for integrating security practices and testing as early as possible in the SDLC. Automated security testing with every code commit within the CI/CD pipeline is a prime example of shifting security left, moving it away from traditional, later-stage security reviews.
Why the other options are wrong
- A. Continuous Monitoring is about ongoing oversight of security posture, but the scenario focuses on *early* integration of testing, not post-deployment monitoring.
- B. Infrastructure as Code (IaC) is about managing infrastructure through code, not directly about integrating security testing into the CI/CD pipeline.
- D. Immutable Infrastructure refers to not modifying servers after deployment, rebuilding them instead, which is unrelated to early security testing in the pipeline.
Shift Left (DevSecOps)
A principle in DevSecOps that emphasizes integrating security practices and testing into the earliest possible stages of the software development lifecycle (SDLC), rather than as an afterthought.
- Proactive security, not reactive.
- Aims to find and fix vulnerabilities early, reducing cost and effort.
- Often involves automated security testing in CI/CD.
Memory trick: Shift Left, Automate Everything, Culture of Security, Continuous Feedback.