{"id":4665,"date":"2023-07-18T18:17:00","date_gmt":"2023-07-18T18:17:00","guid":{"rendered":"http:\/\/www.sumologic.com\/blog\/dont-just-shift-left-level-up-building-a-modern-cyber-defense-program"},"modified":"2025-06-10T09:08:47","modified_gmt":"2025-06-10T17:08:47","slug":"dont-just-shift-left-level-up-building-a-modern-cyber-defense-program","status":"publish","type":"blog","link":"https:\/\/www.sumologic.com\/blog\/dont-just-shift-left-level-up-building-a-modern-cyber-defense-program","title":{"rendered":"Don\u2019t just shift left, level up: Building a modern cyber defense program"},"content":{"rendered":"\n
\n
\n
\n
\n
\"Don't<\/figure>\n<\/div>\n\n\n

<\/p>\n\n\n\n

Within the security community of late, the focus has been on \u201cshifting left\u201d, and while that has merit, it is somewhat myopic missing some of the realities of defense in practice. Instead, I propose a simple framework to help guide initiatives that will \u201clevel up\u201d defenses and greatly improve security postures wholistically. Some license is taken in terminology in order to keep things simple, memorable, and applicable. <\/p>\n\n\n\n

We start with the three basic pillars of development, design, and detection. To be more specific, secure<\/strong> development (or DevSecOps), secure architectural design (such as zero-trust architectures & security reference architectures) and lastly, modern detection and incident response. These three pillars are built on the foundation of automation and doing \u201ceverything as code\u201d, including Infrastructure as Code (IaC), Detection as Code (DaC), and Security Orchestration Automation and Response.<\/p>\n\n\n\n

<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

Why is automation the foundation supporting the three pillars? Because manual security processes are prone to human error, such as accidental misconfigurations, drift from secure baselines, or in the world of detection–distractions and alert fatigue. Manual processes also don\u2019t scale, limiting the ability to have a consistent security posture that is centrally managed and monitored. <\/p>\n\n\n\n

Note that each of the three disciplines applies automation and \u201cas code\u201d in different ways, but the most mature teams are aggressively moving to these programmatic approaches. Unfortunately when organizations fall short in any one area, even the most mighty houses can fall.
<\/p>\n\n\n\n

<\/p>\n\n\n\n

Development<\/h2>\n\n\n\n
\"\"<\/strong><\/figure>\n\n\n\n

In a previous article<\/a>, I emphasized that end-to-end visibility starts at development time. Where we once focused our security efforts on securing single monolithic applications and servers, the new modern app is spread across containers, microservices, and different cloud providers, and unless you design these complex apps with security from the start, the battle may be already lost. In the military, they speak of \u201cmoving left of bang\u201d. The guiding principle is, it’s better to detect adversarial intentions early than respond to malicious actions after the damage is done. <\/p>\n\n\n\n

Fortunately, developers fix problems, and they do it programmatically. We now have tools to do security validation early on in the development lifecycle. This is especially true with the open-source community rallying to solve the hard problems of supply-chain risk, software vulnerabilities, and instrumenting telemetry<\/a> at the lowest levels of our software. I described this previously as \u201cthe ultimate race condition\u201d<\/a> in which developers must create tooling to secure critical applications, continuously validate they are secure and operating as designed, and incorporate these functions into the CI<\/a>\/CD<\/a> pipeline and are part of the build and run-time processes. This reduces the security risk, but everything comes at a cost. Having these additional gates and checks does create overhead that can slow things down, and that then becomes a business risk.<\/p>\n\n\n\n

Creative and bleeding-edge development drives business revenue and is the reason companies can innovate at high speed. From a business perspective, security is a necessary evil. And although cyber doesn\u2019t add to the bottom line, by leveling up cyber defenses, organizations can reduce the risk of cyberattacks and their associated costs, including financial losses, reputational damage, and legal liabilities. It also helps ensure that critical business functions can continue in the event of a security incident. <\/p>\n\n\n\n

Positioning secure development as an investment, and not a cost center helps reframe the conversation. As security practitioners, we need to be able to articulate the benefit that comes from secure design processes and DevSecOps. Here are four principles I advise security professionals to keep them aligned with business objectives.
<\/p>\n\n\n\n