Financial news

By Sandeep Johri

Businesses across all sectors today must relentlessly pursue a digital transformation agenda to stay competitive. However, this progress comes with added risks. The more things that are digitized, the greater the attack surface available for cybercriminals. 

Financial institutions are both at the forefront of digital transformation, and primary targets for threat actors. The breach of an application could lead to the personal and financial data of millions of customers falling into criminal hands. 

The consequences could be catastrophic, with financial losses, damage to the company’s reputation, regulatory fines, and the erosion of customer trust. IBM has estimated the average global cost of a breach to be an eye-watering $4.24m. Insecure applications are a major source of security risk and a critical vulnerability can lead to a serious breach, making AppSec (application security) an increasingly important business priority. 

To be successful, AppSec cannot be an afterthought; it must be ingrained in business strategy from the outset. With global IT spending projected to reach $4.6 trillion in 2023, organisations must ensure their security capabilities keep pace with their expanding IT infrastructure. 

Effective application security does more than ward off a cyber crisis. Addressing vulnerabilities early in the development lifecycle enables businesses to shorten development cycles and increase the ROI on software development projects. Indeed, in a recent survey, 75% of CISOs recognised that secure applications drive their company’s business and revenue.

Unlocking these benefits requires a new approach to AppSec. Security needs to be embedded in every level of development, a strategy known as “shifting everywhere”. So what does shifting left mean in practical terms, and how can organisations put it into practice? 

Going beyond shifting left

The concept of “shifting left” in application security has been a popular concept for some time, first pioneered by prolific developer Larry Smith over two decades ago. This approach advocates for early integration of security measures in the software lifecycle. 

While this has been an extremely beneficial method in development, it is time for businesses to push the boundaries further. Enter the “Shift Everywhere” approach – a model that extends security at every phase of the application lifecycle, from inception to deployment and beyond.

Shift everywhere is a more all-encompassing approach which offers a compelling value proposition for firms that need a strong focus on app development. It is achieved by going beyond securing the development lifecycle alone. It fosters a security-first mindset that permeates every activity related to application security, spanning the entire organisation and its customers. From development and security heads to sales leads and executive directors, everyone should be on the same page about security. By embracing this approach, businesses can proactively address vulnerabilities, enhance development efficiency, and bolster their security posture.

The right tools for the job

Effectively implementing a shift everywhere approach without draining resources requires the right processes and tools. Solutions must integrate smoothly into the developer environment without disrupting workflows. Cloud-native platforms are especially valuable here as they offer a unified and streamlined approach, combining tools and processes seamlessly. This enables stakeholders, including CISOs, security teams, and developers, to collaborate openly and frequently on AppSec challenges. Getting everyone on the same page will make it easier to secure buy-in for key decisions. 

Automation is pivotal in achieving the shift. Highly automated vulnerability scanning enables organisations to improve visibility across every line of code, both in deployed applications and those still under development. This ensures that, even after deployment, applications remain safeguarded against potential threats.

A defining trait of shifting everywhere is extending security measures to all elements of the application security strategy. This comprehensive approach encompasses key components for holistic protection against evolving threats. Security then becomes a joint effort by everyone, starting from management and reaching every developer and AppSec engineer.

Unlocking the value of shift everywhere

The shift everywhere approach offers a transformative change in application security, unlocking numerous benefits beyond the traditional ‘shift left’ paradigm. By embracing this comprehensive approach, organisations can achieve stronger collaboration, improved security and accelerated business growth.

Fostering open communication among stakeholders such as departmental heads will help different teams and departments to address AppSec challenges together, reducing duplications and oversights that sap resources and lower ROI. The result is a centralised view and greater control with comprehensive visibility into security-related activities, enabling swift identification and resolution of vulnerabilities.

A focus on AppSec also sends a strong signal to customers, partners and investors. Building a reputation for safe, secure application development further fosters business growth, complemented by cost savings and ROI from efficient development cycles.

Organisations seeking to keep up with the digital agenda without increasing their risk exposure must embrace the ‘Shift Everywhere’ approach to fortify their application security. Facilitating collaboration, strengthening their security posture, and demonstrating a commitment to secure applications, empowers enterprises to navigate the digital landscape with confidence.

About the Author

Sandeep Johri, CEO of Checkmarx, has spent many years in Silicon Valley as an executive, founder, strategic advisor and investor. He most recently served as CEO of Tricentis, which he led for seven years from an early-stage startup to a global leader of continuous-testing software solutions.