The concept of "shifting left" for appropriate IT concerns is growing. The notion is basically to shift more into the app dev delivery pipeline functions that, when applied earlier, can result in greater stability and security of the resulting code. Security is one of those functions that can yield significant benefits in terms of reducing the conflicts and errors that crop up in production and cost time and money the business would rather not spend.
Most of the time the security functions proposed as being ready to "shift left" are those that relate directly to code: vulnerability scanning, automated patching, intrusion detection and similar services. What is rarely (in fact probably never until this post) mentioned is the benefits of shifting web application firewall functions left.
There is good logic behind shifting this kind of functionality left, namely application affinity. Highly application affine services like web application security and load balancing and optimization are specific to an application. Not a protocol like HTTP, but to the actual application itself. Application security and optimization, in particular, often contain configurations that require understanding specific URIs (like RESTful API calls), the types of data being exchanged (and its formats), as well as identifying users and devices that may be specific to the app or specific portions of the app.
That means a web application security policy is based pretty much on the application, which means that policy is good for that application alone. Matching data and URIs can (and does) introduce the potential for errors which means an application that breaks. When that error first shows up in production, heads roll. Time is spent, money is wasted and the caffeine budget for the week skyrockets and leaves everyone else drinking colored water for the rest of the month. Not good at all.
Shifting the configuration and testing of these application affine policies lefter, into test, can be a significant boon in terms of eliminating most (hopefully all but, Heisenberg) conflicts or errors and ensuring a smoother, faster and less complicated roll out through the production pipeline.
The increasing availability of software and virtual editions of traditional web application firewall services means the ability to provision these services in a broader number of environments and ensure higher levels of access lefter in the deployment pipeline. Shifting web application security lefter also means the ability to apply vulnerability scanning to the web application security service while it's protecting the application under test, giving security ops and dev a better understanding of the interaction between the two as well as the opportunity to tweak policies to ensure proper (expected and desired) behavior. Policies, especially those that might be encapsulated in template form, are easy enough to move between environments and can be treated as code - stored in repositories and versioned for future use.
The availability of APIs and templates along with virtualization of traditionally network-hosted application affine services makes it possible for organizations to shift security lefter and achieve real gains in optimizing the production pipeline process.
About the Author
Related Blog Posts
F5 accelerates and secures AI inference at scale with NVIDIA Cloud Partner reference architecture
F5’s inclusion within the NVIDIA Cloud Partner (NCP) reference architecture enables secure, high-performance AI infrastructure that scales efficiently to support advanced AI workloads.
F5 Silverline Mitigates Record-Breaking DDoS Attacks
Malicious attacks are increasing in scale and complexity, threatening to overwhelm and breach the internal resources of businesses globally. Often, these attacks combine high-volume traffic with stealthy, low-and-slow, application-targeted attack techniques, powered by either automated botnets or human-driven tools.
F5 Silverline: Our Data Centers are your Data Centers
Customers count on F5 Silverline Managed Security Services to secure their digital assets, and in order for us to deliver a highly dependable service at global scale we host our infrastructure in the most reliable and well-connected locations in the world. And when F5 needs reliable and well-connected locations, we turn to Equinix, a leading provider of digital infrastructure.
Volterra and the Power of the Distributed Cloud (Video)
How can organizations fully harness the power of multi-cloud and edge computing? VPs Mark Weiner and James Feger join the DevCentral team for a video discussion on how F5 and Volterra can help.
Phishing Attacks Soar 220% During COVID-19 Peak as Cybercriminal Opportunism Intensifies
David Warburton, author of the F5 Labs 2020 Phishing and Fraud Report, describes how fraudsters are adapting to the pandemic and maps out the trends ahead in this video, with summary comments.
The Internet of (Increasingly Scary) Things
There is a lot of FUD (Fear, Uncertainty, and Doubt) that gets attached to any emerging technology trend, particularly when it involves vast legions of consumers eager to participate. And while it’s easy enough to shrug off the paranoia that bots...