[Autogenerated] the best way for us to answer this question is to
look at a real world example for this example.
I'm going to use the PC idea, says Standard,
which is the payment card industry Data security Standard version
Trita 2.1 has a requirement under close 11.2 to run internal and
external network vulnerability scans at these quarterly and after any
significant change in the network.
This is a long standing requirement for the PCR requirements,
and anyone operating in a PC I certified environment will be very comfortable
and used to running vulnerabilities guns on a quarterly basis.
But what if we changed our tanking?
You recall in the previous slide we had a movement,
true different stages in the life cycle from left to right.
You may have heard of the term shifting left when it comes to def SEC ops.
What that means is,
can we move the processes and activities further left
to happen earlier in the life cycle?
Looking at the traditional way that this PC idea
says requirement would be achieved,
we would initiate a vulnerabilities gun once per quarter,
have a human reviewed results and then retest to ensure any
high risk vulnerabilities were addressed.
If we were to shift left for this particular PC idea,
says Requirement,
we would undertake vulnerability scans as part of our software release pipeline.
And we would not release if ah,
high risk vulnerability was identified were not
constraining to once per quarter.
We could do this one's per week or once per day,
depending on the frequency over releases.
When we embed activities such as vulnerable.
Re scanning is part of our released pipeline.
We don't have an extra job every quarter to undertake.
This is shifting left but also automating or security practices.
Now let's look introducing security into the dead op
cycle to produce their cycles.
Starting with the planning phase weakens introduced
trip modeling and cold standards,
starting by embedding security at the planning
stages of a project shifting left.
Then, as code is written, we can undertake static cold analysis,
software composition, analysis and other types of code analysis techniques.
This will catch certain amounts of vulnerabilities in code as it's
being written or committed to the code repository.
Once the software is built on ready for testing,
we can immediately run vulnerable his scans before we release it to the testers.
Any major vulnerabilities can be addressed before the
testing function spends their time testing software that may
have major vulnerabilities in it.
During the testing phase,
we can run ___________ testing something that's
traditionally run the inn off the life cycle.
During release,
we can look at the compliance validation to ensure that the software
complies were any regulatory or industry standard required.
As we deployed software,
we consign it cryptographic lea to ensure the
integrity of the software as its released.
Moving to an operate and monitor phase, we can monitor and detect,
respond and recover from security incidents.
Overlaying the security practices on the DEV Ops life cycle means that we can
scattered a different processes ______ various phases on.
We can work in tandem with the development on the operation stages.
All of this encompasses better security, visibility and control.