DevSecOps › Module 2 › Lesson 2
Shift Left
Shift left literacy names early testing, pre-merge gates, and cheaper fixes — map shift-left checkpoints on YOUR $DEVSEC_LAB before broad production deploy.
Visual · t36_shift_left
Shift left literacy. $DEVSEC_LAB only. Original Cyberlium.
Opening
Fix cost rises with stage — literacy teaches shift-left checkpoints so findings surface in PRs on repos you govern.
Shift left moves security testing earlier — IDE hints, pre-commit hooks, PR checks, build-stage SAST, container scan before push to registry. A secret caught in PR costs minutes; the same secret in production costs incident response. Each leftward step needs scope — YOUR repo, YOUR lab URL, YOUR artifacts. Cyberlium outlines shift-left on YOUR $DEVSEC_LAB — write checkpoint row for commit, PR, build, and deploy on one fictional app. Next: Pipeline Stages.
1. Shift-left checkpoints (named)
Commit: pre-commit secrets hook on YOUR repo. PR: SAST and lint gate before merge. Build: dependency and container scan on CI artifact. Deploy: IaC policy check and staged DAST on YOUR lab URL only.
On $DEVSEC_LAB, write checkpoint row — stage, tool class, gate action for one fictional repo.
Command guide
Try these commands — Shift-left checkpoints (named)
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
NIST SSDF — https://csrc.nist.gov/Projects/ssdf CISA Secure by Design — https://www.cisa.gov/securebydesign GitHub Actions security — https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install python3
macOS:
Command — copy this
brew install python3
Windows: Download https://python.org/downloads/
═══ LINUX / macOS ═══
Command — copy this
export DEVSEC_LAB=${DEVSEC_LAB:-$HOME/cyberlium-lab/t36-devsec}
cat > "$DEVSEC_LAB/notes/ssdf-practices.md" <<'EOF'
# NIST SSDF Practices — YOUR org literacy stub
## Prepare the Organization (PO)
- PO.1: define security requirements for software development
- PO.3: implement supporting toolchains (SAST, secret scan, IaC scan)
## Protect Software (PS)
- PS.1: protect all forms of code from unauthorized access and tampering
- PS.2: provide a mechanism for verifying software release integrity
## Produce Well-Secured Software (PW)
- PW.4: review design against security requirements
- PW.7: reuse existing well-secured software where feasible
## Respond to Vulnerabilities (RV)
- RV.1: identify and confirm vulnerabilities on an ongoing basis
- RV.2: assess, prioritize, and remediate — feed YOUR findings/ backlog
Lab maps: gitleaks→PS, checkov/trivy→PW, ZAP localhost→RV, SBOM→PS.2
EOFCommand — copy this
grep -E 'PO\.|PS\.|PW\.|RV\.|gitleaks' "$DEVSEC_LAB/notes/ssdf-practices.md"
python3 -c "print('SSDF: prepare → protect → produce → respond — map to YOUR lab tools')"Primary tools to practice this lesson: grep, python3. Reference sites: NIST SSDF (https://csrc.nist.gov/Projects/ssdf); CISA Secure by Design (https://www.cisa.gov/securebydesign); GitHub Actions security (https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Why shift left beats release-week audits
Late discovery blocks releases and forces hotfixes. Early gates give developers context while code is fresh. Version-controlled policy lets teams compare defect rates quarter over quarter on lab repos.
Students document lab checkpoints on notes — production shift-left follows org SDLC and merge policies.
3. Lab boundary
Forbidden: skipping left gates then scanning stranger orgs for 'coverage.' Allowed: shift-left card — four checkpoints with $DEVSEC_LAB fictional repo example.
Ship: shift-left card for YOUR lab pipeline. Next: Pipeline Stages.
4. What you ship: shift-left card for $DEVSEC_LAB
Four checkpoints with gate actions. $DEVSEC_LAB named. chmod 600.
5. What you record before the next lesson
Date. Shift-left card. $DEVSEC_LAB named. File t36-m02-l02-shift-left.txt chmod 600.
6. Wrong vs right: stranger orgs vs YOUR repos
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Defer all scans to production deploy. Point DAST at stranger URLs for early feedback.
Right
Write shift-left card for YOUR $DEVSEC_LAB. Next: Pipeline Stages.
Mission: document shift-left on YOUR lab
1) Define commit, PR, build, deploy checkpoints. 2) Write checkpoint row with tool class per stage. 3) Name gate pass/fail action. 4) chmod 600.
Stuck? Ask Cyberlium AI Mentor
Leftmost feasible gate wins — secrets belong in pre-commit, not post-incident.
Knowledge Check
APPLY: Shift left primarily means:
Multiple choice
Knowledge Check
APPLY: True or False: PR-stage SAST catches issues before merge on code you own.
True or False
Knowledge Check
APPLY: Shift-left literacy on Cyberlium uses:
Multiple choice