131 / Shift Left: Integrating a Security Mindset Early in the Software Development Life Cycle, with Paul Connaghan

Product Momentum Podcast

When product development teams build new software tools and systems, they like to start with the end in mind by nudging quality assurance and security scanning closer to the early stages of the process. Paul Connaghan, Principal Application Security Consultant at RiverSafe in London, UK, says this “shift left” approach goes straight to the heart of business operations by embedding a security mindset in the underlying architecture, in UX and UI design, and in the QA and app hosting apparatus.

In this episode of Product Momentum, Paul sat down with Paul Gebel and Jonathan Coupal, ITX’s VP of Infrastructure, stressing the importance of moving security considerations to the earliest possible phase of the SDLC (software development life cycle).

Shift Left
“Shift left has been something of focus for clients a few years now,” Paul says. “Once we’ve actually written some code, we want to test that code as soon as we can.”

Paul’s passion for app and system security, and threat modeling specifically, is obvious. It’s a task typically performed by security folks, Paul adds, as it can be quite involved to produce threat models for things that we don’t entirely understand. Nonetheless, he advocates for teaching product teams to do this for themselves.

Build a Security-Focused Culture
“It helps us address the skill challenge, because there’s just not enough people in cyber to effectively secure all the applications and products that are out there,” Paul shares. “But it also gets teams into the habit of having daily conversations about security, which is fundamentally really the thing that’s going to help close the [security knowledge] gap and build a security-focused culture.”

Question: within each sprint, how much capacity does your team allocate for security? None? 5%? More? Be sure to catch the entire episode to learn Paul Connaghan’s expert recommendation.

---

Learn more about application security and threat modeling by catching our earlier Product Momentum episode, with guest Chris Romeo.

---

You can also watch our conversation with Paul Connaghan on the Product Momentum YouTube channel!

The post 131 / Shift Left: Integrating a Security Mindset Early in the Software Development Life Cycle, with Paul Connaghan appeared first on ITX Corp..