devopsy.kinsta.cloud

Tag: ShiftLeft

  • ShiftLeft Appoints Prevention-First, Cybersecurity Visionary and Artificial Intelligence/Machine Learning Pioneer Stuart McClure as Chief Executive Officer

     Serial Entrepreneur, Cybersecurity Leader and Industry Veteran joins ShiftLeft to Drive Growth and AI/ML Innovation Globally

    Santa Clara, CA, August 2, 2022 —  ShiftLeft, a disruptor and innovator in the world of DevSecOps and NextGen SAST and SCA, today named Stuart McClure as CEO. With more than 30 years in security, vulnerabilities and prevention technology, McClure will leverage his experience to enable growth and expansion for the company while advancing AI/ML in the DevSecOps and application security market.

    “I am honored to join ShiftLeft as CEO, and build on the company’s stellar foundation of innovation and thought leadership around vulnerability detection and prevention in the continuous integration/continuous delivery (CI/CD) landscape,” stated Stuart McClure, CEO of ShiftLeft. “I have been waiting almost 30 years to shift the entire discussion left and take prevention to the root cause of cybersecurity vulnerabilities: source code. And with their recent $29M financing round ShiftLeft is set up for success.”

    The ShiftLeft platform integrates with the CI/CD pipeline and developer community to quickly identify the known and unknown vulnerabilities that matter most to your organization. Cybersecurity threats begin with code, making them completely preventable if you identify and address them in real time, and before they become part of your product. ShiftLeft’s solution has been built from the ground up to solve the core of this problem and enables developers and application security teams to collaborate together to fix what matters most, quickly.

    “As a board member, Stuart has been instrumental in promulgating the value ShiftLeft brings to the development and security community which will now go to scaling the business,” says Jay Leek, Managing Partner & Co-founder at SYN Ventures. “We are extremely grateful to Manish Gupta for building a tremendously valuable company and solution and look forward to where Stuart will take it.”

    “Stuart’s background and command of the cyber landscape makes him the perfect leader for ShiftLeft’s next evolution,” says Manish Gupta, Founder and Former CEO who will continue as Advisor to ShiftLeft and the board.

    “Stuart has long been among the very few that I would go into any foxhole with in the cybersecurity industry,” said Malcolm Harkins, former CISO of Intel and Cylance. “His experience in the world of prevention will apply extremely well to tackling the final place to take prevention, that of code.”

    Prior to joining ShiftLeft, McClure led Cylance as its Founder and CEO and was acquired by Blackberry in 2019, driving a revolutionary new AI/ML-based approach to threat prevention, detection and response. Prior to Cylance, he was Global CTO for McAfee/Intel, Founder/President/CTO of Foundstone which sold to McAfee in 2004, and at Ernst & Young he was a founding team member of their cybersecurity practice. Finally, Stuart’s knowledge of how the attacker works is well known as the founding author of the world’s most popular cybersecurity franchise called Hacking Exposed and later Web Hacking.

    About ShiftLeft

    ShiftLeft empowers developers and AppSec teams to dramatically reduce risk by quickly finding and fixing the vulnerabilities most likely to reach their applications and ignoring reported vulnerabilities that pose little risk. Industry-leading accuracy allows developers to focus on security fixes that matter and improve code velocity while enabling AppSec engineers to shift security left. A unified code security platform, ShiftLeft CORE scans for attack context across custom code, APIs, OSS, containers, internal microservices, and first-party business logic by combining results of the company’s and Intelligent Software Composition Analysis (SCA). Using its unique graph database that combines code attributes and analyzes actual attack paths based on real application architecture, ShiftLeft then provides detailed guidance on risk remediation within existing development workflows and tooling. Teams that use ShiftLeft ship more secure code, faster. Backed by SYN Ventures, Bain Capital Ventures, Blackstone, Mayfield, Thomvest Ventures, and SineWave Ventures, ShiftLeft is based in Santa Clara, California.

  • ShiftLeft Report Reveals State of Application Security

    ShiftLeft Report Reveals State of Application Security

    A report published today by automated application security testing platform ShiftLeft found only one in three applications has an attackable vulnerability. The report also found organizations that prioritized their remediation efforts based on the level of actual threat are fixing 76% of those vulnerabilities within two sprints lasting 12 days, on average.

    Based on millions of scans performed in the last year using the ShiftLeft platform to identify vulnerabilities, organizations have reduced the number of vulnerabilities they need to address by 97% on a year-over-year basis, the report found.

    In addition, the report noted that the average median scan time is only 90 seconds, which helped drive an overall 68% increase in daily scans year-over-year. Overall mean-time-to-remediate (MTTR) has dropped by 37%, the report also found.

    ShiftLeft CEO Manish Gupta said given the increased number of vulnerabilities, it’s more critical than ever for organizations to focus their remediation efforts on those that can be exploited within their IT environment. For example, the report found that only 4% of all Log4j instances discovered in the IT environments analyzed were vulnerable. Rather than spending weeks looking for every instance, Gupta said IT teams would be much better off focusing their efforts on the instances that might actually be exploited.

    The challenge is that not enough organizations have a way to score vulnerabilities based on the risk they represent to the business, Gupta added.

    While there is a lot more focus on adopting DevSecOps best practices in the wake of a series of high-profile breaches of software supply chains, the ShiftLeft report made it clear that presenting developers with a long list of potential vulnerabilities is counterproductive. The bulk of vulnerabilities that are being discovered are not actually attackable, noted Gupta.

    That doesn’t mean application security doesn’t need to improve, but it is clear that a lot of time and effort is being wasted, added Gupta.

    In theory, at least, as the cultural divide been application development teams and cybersecurity teams continues to narrow, the overall ability to prioritize remediation efforts should improve. The first step toward achieving that goal is making it easier to identify what percentage of the application attack surface is really vulnerable. Otherwise, developers presented with a long list of theoretical vulnerabilities will continue to prioritize developing new features and capabilities versus remediating vulnerabilities.

    One way or another, vulnerability remediation issues will soon come to a head. In the wake of an executive order from the Biden administration to improve overall application security within federal IT environments, many organizations will adopt similar policies and processes. Developers, naturally, will inevitably either push back or do an end-run around processes they deem too onerous. Rather than allowing a stalemate to occur, Gupta said savvy DevOps teams will invest more time in identifying the critical vulnerabilities that need to be addressed before cybercriminals exploit them.

    The issue, of course, is that cybercriminals are getting more adept at discovering and exploiting those very same vulnerabilities.

  • What the New OWASP Top 10 Changes Mean to Devs

    What the New OWASP Top 10 Changes Mean to Devs

    The open web application security project (OWASP) recently updated its top 10 list of the most critical security risks to web applications after four years. It represents the most radical shake-up since the list was introduced in 2003. The changes will undoubtedly have a big impact on how businesses address application security going forward and how developers and DevOps teams approach their jobs. This article will look at three of the most significant changes that have emerged in the new top 10 list.

    OWASP

    New Methodology for Current and Future Threats

    This time, OWASP took a more data-driven approach to their research to get better insight into current and future threats. Members provided more than 1.5 million data points on the security threats they see. OWASP categorized the data and assigned an impact score before deriving their overall ranking.

    OWASP also included survey data from security professionals about emerging threats. For example, the current incident rate of server-side request forgery (SSRF) vulnerabilities is low, but security professionals consider this attack very serious and expect it to increase significantly in the future. SSRF enables attackers to use vulnerable servers to request and receive data from protected internal sources, which is a very serious risk. So, SSRF became a new category (A10:2021) this year.

    With this new methodology, OWASP is now able to offer comprehensive insight into the most serious current and future threats.

    OWASP 10 Expands Security to the Left

    One key change in the new top 10 list is the inclusion of many categories (e.g, Insecure Design—A04:2021, Software and Data Integrity Failures—A08:2021) that recognize the industry has to start with better application design practices to improve security.

    Many application vulnerabilities creep into software because secure design principles are not followed from the outset. In the race for faster app development, corners are being cut. The CI/CD approach to application development is a major contributor to the use of plugins, libraries or software modules of dubious integrity. This problem is getting worse. Businesses must ensure that all their software components are from reputable sources and should use software supply chain tools to check for known vulnerabilities.

    Major Ranking Changes due to the Evolving Threat Landscape

    Injection attacks, which have been ranked as the number-one risk since 2003, are now ranked number three. While this is welcome news, we cannot claim victory just yet. Your valuable data is still very much at risk from vulnerable apps that allow bad actors to run unauthorized commands and access the sensitive corporate information your business depends on.

    Injection attacks have been replaced by broken access control (A01:2021). OWASP reported that in their data set 94% of applications were tested for these vulnerability types and 3.8% showed one or more weaknesses. A staggering amount!

    Due to the increased adoption of standardized authentication frameworks which are more readily available and easier to implement, identity and authentication failures (A07:2021) have plummeted in the ranking from number two to number seven as a risk.

    This shift demonstrates that as businesses have improved their determination of who can access applications, they have neglected to enforce controls over what an individual user, process or device can do in that application. It is crucial to consider authentication and authorization together for a better security posture.

    Lots of Work Ahead to Bring Left and Right Security Together

    The 2021 OWASP top 10 list is a big step forward. OWASP’s expansion of security to the left with the inclusion of new categories and significant changes to their rankings will require businesses to revaluate their application security posture. Addressing security earlier in the application development life cycle will likely prevent many of the more common attacks, but businesses must complement this with robust, proven and scalable security protections on the ‘right’ like web application firewalls. It is not just about shift left, it is about expand left. You need both left and right security for a better multilayered security posture.

  • ShiftLeft Announces Strategic Investment from and Go-to-Market Partnership with Wipro

    Funding from Wipro Ventures is part of a go-to-market partnership to drive ShiftLeft into new markets and verticals

    Santa Clara, CA, June 16, 2022 — ShiftLeft, an innovator in automated application security testing, announced an investment from and go-to-market partnership with Wipro Ventures, the strategic investment arm of Wipro Limited (NYSE: WIT, BSE: 507685, NSE: WIPRO). With this investment, Wipro, with its strong global presence, will become a key partner in ShiftLeft’s continued growth.

    The ShiftLeft CORE platform combines both static application security testing (SAST) and software composition analysis (SCA) solutions to create a unified view of potential application vulnerabilities. As a modern, cloud-native application built to make both application security and development teams’ lives easier, ShiftLeft scans whole applications in minutes, allowing customers to scan their code with every software release. ShiftLeft’s unique Code Graph technology combines, analyzes and prioritizes SAST and SCA results to map actual data flows through applications to validate “attackability” — indicating whether security flaws can be reached by attackers. This innovative approach gives ShiftLeft the lowest false positive rate in the industry compared to other accepted OWASP application security benchmarks.

    “Wipro has repeatedly demonstrated that it is a leader when it comes to bringing new technological innovations to customers,” said Manish Gupta, CEO, ShiftLeft. “Equally important, Wipro is a ‘shift left’ organization leading the way in empowering developers to improve code security throughout the software development cycle. ”ShiftLeft makes it intuitive for Wipro’s hundreds of Cybersecurists and tens of thousands of software developers to build security into the DNA of every software release. With this new partnership with Wipro, customers from various sectors, including healthcare, industrials, manufacturing, retail, hospitality and government, will be able to deploy and operate ShiftLeft.

    “ShiftLeft is a cutting-edge solution that enables teams to integrate security at scale without slowing them down,” said Tony Buffomante, SVP and Global Head, Wipro Cybersecurity & Risk. “Our global clientele will now be able to take advantage of ShiftLeft SAST and SCA and help them remediate code flaws before they become attackable. We are looking forward to playing a significant role in ShiftLeft’s rapid global expansion.”

    About Wipro Limited

    Wipro Limited (NYSE: WIT, BSE: 507685, NSE: WIPRO) is a leading technology services and consulting company focused on building innovative solutions that address clients’ most complex digital transformation needs. Leveraging our holistic portfolio of capabilities in consulting, design, engineering, and operations, we help clients realize their boldest ambitions and build future-ready, sustainable businesses. With over 240,000 employees and business partners across 66 countries, we deliver on the promise of helping our customers, colleagues, and communities thrive in an ever-changing world. For additional information, visit us at www.wipro.com.

    About ShiftLeft

    ShiftLeft empowers developers and AppSec teams to dramatically reduce risk by quickly finding and fixing the vulnerabilities most likely to reach their applications and ignoring reported vulnerabilities that pose little risk. Industry-leading accuracy allows developers to focus on security fixes that matter and improve code velocity while enabling AppSec engineers to shift security left. A unified code security platform, ShiftLeft CORE scans for attack context across APIs, OSS, internal microservices, and first-party business logic by combining results of the company’s and Intelligent Software Composition Analysis (SCA). Using its unique graph database that combines code attributes and analyzes actual attack paths based on real application architecture, ShiftLeft then provides detailed guidance on risk remediation within existing development workflows and tooling. Teams that use ShiftLeft ship more secure code, faster. Backed by SYN Ventures, Bain Capital Ventures, Blackstone, Mayfield, Thomvest Ventures, and SineWave Ventures, ShiftLeft is based in Santa Clara, California.

  • No More Hot Potato: How Collaboration is Key in Application Security

    No More Hot Potato: How Collaboration is Key in Application Security

    Technology is accelerating at an unprecedented rate and companies with little digital footprint or experience in application security are struggling to keep up. With more and more breaches and vulnerabilities being detected in applications, people are shifting blame like it’s a game of hot potato. But it doesn’t have to be that way.

    With Shifting Left Virtual Conference rapidly approaching, Rebecca Auguste sat down with the CEO of ShiftLeft, Manish Gupta, to discuss how developers and application security teams can better collaborate to increase application security efficacy. The two talked about ShiftLeft’s strategy, how innovation and security can be at odds with one another, adopting modern solutions and everything in between.

    What is ShiftLeft? 

    ShiftLeft is a next generation application security company. As companies are moving rapidly adopting the cloud, developing software ever faster so they can deliver features to their customers and drive ever increasing revenue, in that race we are starting to leave security behind because we are still using legacy tools. The idea is we need to shift left and we have to start fixing vulnerabilities as early on as possible in the process thereby reducing our cyber risk.

    Are innovations and security at odds with each other now? 

    Historically they have been. Use of legacy technologies in a modern pipeline forces customers to choose between being agile delivering feature functionality faster or getting better at security. At ShiftLeft we are starting to show through our customer successes that that choice doesn’t have to be that way. We can become more agile and we can become more secure.

    Here are some important statistics from ShiftLeft customers:

    1. If you’re doing automated enforcement in ShiftLeft you are fixing 91.8% of the vulnerabilities
    2. If you’re not doing automated enforcement but you’re using a modern solution like ShiftLeft you’re fixing 58% of vulnerabilities in the first sprint.
    3. If you’re still stuck with a legacy solution, your team isn’t fixing 60% of the vulnerabilities ever – forget if it’s the first, second or third sprint. It becomes technical debt. 

    So why aren’t people adopting modern solutions like ShiftLeft and ditching legacy solutions?

    Legacy solutions ask developers to slow down because they have to take a few hours to go scan and dump a long list of vulnerabilities. As the developer, seeing hundreds of vulnerabilities is like a deer in the headlights. Because it’s a mountain of work, it’s easy for developers to want to ignore the problems. The question shouldn’t stop at “what are our applications consisting of?” The real problem gets solved when we start asking what do our applications contain and what vulnerabilities do they have that can be exploited, therefore how quickly can we fix them. It’s all about moving to be proactive, not reactive.

    How can development and security teams better collaborate to increase the efficacy of security with applications and software? 

    It’s extremely important for us to realize that developers are not responsible for security. Developers are measured, they are compensated to deliver feature functionality on time and to provide that feature functionality with minimum bugs. But bugs are not vulnerabilities. There is a lot of talk in the industry that developers should become responsible for application security. We aren’t there today but we can eventually.

    There are two important application personas: 

    • Application security: Application security has a mile wide and inch deep knowledge of applications and who is compensated on app security improvements.
    • Developers: Developers have a mile deep but inch wide knowledge of software because they are so focused on their own code.

    Both personas are required because application security cannot fix vulnerabilities in applications, the developer must do that. But developers aren’t going to want to do that unless that work is prioritized by application security.

    Key takeaway? Collaboration is essential to application security.

    We need to create a workflow that allows application security to meet their end goals such as: What are the vulnerabilities of an application? What are the critical vulnerabilities? How can I provide these vulnerabilities to the developer in a developer workflow without asking them to go to a different console so they can fix vulnerabilities as quickly as possible? We need to start seeing a workflow that allows both application security and developer personas to work collaboratively to improve application security.

    Shifting Left 2.0 is a two-day virtual conference taking place from 9 a.m. to 2 p.m. PDT on June 22nd-23rd that dives deep into application security in the modern tech space. To register for free and to check out the full agenda, visit the Shifting Left 2.0 website.

  • How to Analyze Your Code for Security Vulnerabilities

    How to Analyze Your Code for Security Vulnerabilities

    Shifting Left 2.0 is a two-day virtual conference taking place from 9 a.m. to 2 p.m. PDT on June 22nd-23rd that dives deep into application security in the modern tech space. Security experts share insights on topics ranging from how to measure AppSec success to what role AppSec plays in digital transformation. Software developers, security engineers, C-level business leaders and more can all benefit from the lively tech conversations at this free virtual experience. 

    Vickie Li, developer evangelist at ShiftLeft, teases her session at Shifting Left 2.0 in the Q&A below. Vickie and Suchakra Sharma, staff scientist at ShiftLeft, describe how to effectively review code for vulnerabilities and present tactics for performing an effective security code review on your applications on Wednesday, June 23rd from 10:10 a.m. to 10:40 a.m. PDT.

    You can find the full agenda and register for free at Shifting Left 2.0.

    To start off, why don’t you tell me a little bit about your role as a developer evangelist at ShiftLeft?

    My job as a developer evangelist is to help developers write more secure code. Here at ShiftLeft, we build and support ShiftLeft CORE, a security tool that helps developers find vulnerabilities in their code through SAST, SCA, and secret scanning. But a big component that goes into building secure software is to understand and remediate the vulnerabilities found by these tools. My goal is to help developers build more secure applications by learning the security fundamentals they need to write secure code and use security tools effectively.

    Your session is titled, “Intro to Code Analysis,” so I am curious what are some of the most effective ways to analyze your code for security vulnerabilities?

    I am probably giving away a bit of a spoiler here for my session with Suchakra. The most effective way of finding vulnerabilities in code is to use static code analysis, or to find security issues by analyzing source code. Techniques like dynamic analysis and penetration testing excel at finding exploitable vulnerabilities but often miss a large number of security issues. Static analysis, on the other hand, tends to be much better at finding as many vulnerabilities as possible.

    But conducting a manual code analysis on every single line of code is inefficient and not feasible in most cases. In this case, utilizing a SAST tool to scan the application and then validating the results afterward using manual code review would be the best action plan. 

    Code is really at the heart of building secure applications. With that in mind, how beneficial is it for developers to have a security mindset when writing code? 

    It is extremely crucial for developers to keep security in mind when building software. Security is a team effort by everyone: application security engineers, system administrators, managers, architects, and analysts. But when dealing with application security, developers are the ones who write vulnerabilities into code, and developers are the ones who have to fix vulnerabilities when they are found. So as developers, if we can keep security in mind during the development process, we can prevent vulnerabilities from being introduced into the code base, saving ourselves and our colleagues time and headache down the line.

    What type of security training or continuous learning practices should dev teams implement to help secure the code they write?

    Learning about security continuously is key to building secure applications. Developer security education needs to be efficient, engaging, and easy to absorb, and we need to introduce security training in a way that is relevant to everyday development work. By identifying security issues in a developer’s code, we can provide the context of the security issue and demonstrate the real-life importance of best practices.

  • ShiftLeft Advances DevOps with Industry’s Most Developer-Friendly Automated Application Security Platform

    New Offering Enables Developers to Secure up to 200,000 Lines of Code and Perform 300 Scans Per Year at No Cost

    Santa Clara, Calif. – December 17, 2019 – ShiftLeft Inc., an innovator in automated application security, today launched a new version of its Inspect static application security testing (SAST) solution, designed specifically for developers. Available for free, the new version of ShiftLeft Inspect provides developers with the fastest and most accurate SAST solution combined with key workflow integrations such as code repositories, build and bug-tracking tools to insert security into earliest stages of the software development lifecycle (SDLC).

    More organizations are embracing DevOps processes than ever before, with developers being tasked with releasing software into production at incredibly high velocity. This means security is often overlooked in favor of faster CI/CD pipelines and software products are delivered with undiscovered or unresolved vulnerabilities.

    “It is now well accepted that security needs to be shifted as far left as possible, but the lack of developer-friendly code analysis tools is a key inhibitor,” said Manish Gupta, CEO of ShiftLeft. “ShiftLeft Inspect is designed to give developers the speed, accuracy and seamless CI/CD pipeline integration they need. Yet, developers are the ultimate ‘try before you buy’ consumers so we’re now offering security to them through a truly usable, self-service and free version so they can see exactly what Inspect can do for them.”

    ShiftLeft Inspect delivers the industry’s leading SAST capabilities, including the ability to insert security directly into developer pull requests through a recently announced partnership with CircleCI. By leveraging ShiftLeft Inspect, developers can scan code and automate acceptance decisions based on security criteria. This ensures the right developers get the right vulnerability information at the right time, which leads to more efficient mean time to remediation (MTTR) and ultimately getting applications to production faster, without sacrificing security.

    The new free version of ShiftLeft Inspect permits up to five users to perform 300 scans annually on 200,000 lines of code or less, which is significant given the fact that the average application has 7,200 lines of code.*

    The offering supports applications written in Java, C#, Golang and Scala. It also allows developers to run two scans concurrently and analyze an infinite number of dependencies and frameworks. Additionally, ShiftLeft Inspect integrates with tools needed to streamline application security workflows, including bug-tracking tools, build tools, deployment tools, code repositories and security information and event management tools (SIEMs).

    To learn more about the free version of ShiftLeft Inspect, visit the ShiftLeft website and sign up for free here: www.shiftleft.io/register.

    *Based on Java applications in GitHub as of December 2019

    About ShiftLeft

    ShiftLeft is a continuous application security platform, purpose-built for the modern software development life cycle. It combines next-generation static code analysis (to quickly and accurately identify vulnerabilities) with application instrumentation (to protect the application) in an automated workflow. This combination of runtime-informed code analysis and code- informed runtime protection delivers the most accurate, automated, and comprehensive application security solution. To learn how ShiftLeft keeps application security in sync with the rapid pace of DevOps, see https://www.shiftleft.io/.

  • ShiftLeft and CircleCI Strengthen DevOps Security by Inserting Code Analysis as Far Left as Developer Pull Requests

    New Partnership and Product Integration Delivers the Industry’s Fastest and Most Accurate Vulnerability Scanning at One of the Earliest Stages in the CI/CD Pipeline

    SANTA CLARA, Calif., Dec 04, 2019

    ShiftLeft Inc., an innovator in automated application security, today announced a partnership and deep integration with CircleCI that enables organizations to insert security directly into developer pull requests from code repositories. ShiftLeft Inspect is the first static application security testing (SAST) vendor to partner with CircleCI to provide these capabilities.

    Today’s organizations are working to insert security as far left in their DevOps process as possible, but many struggle to achieve the speed and accuracy necessary to automate security quality decisions. To date, the only tools that can run in the build phase take hours or days to scan, dramatically reducing developer velocity. These tools are also known to produce a large number of false positives, which means organizations aren’t willing to automatically fail builds without manually triaging results, which adds further delay.

    Pull requests represent a critical phase for developers, as it is the phase in which new individual developer code is integrated into the overall codebase. By enabling SAST at pull requests, the right developer gets the right vulnerability information at the right time. Developers can more efficiently address vulnerabilities in their respective code, improving the overall security of the final build.

    The partnership and integration enables CircleCI users to run ShiftLeft Inspect on CircleCI builds and pull requests from any code repository integrated with CircleCI. Pull requests and builds can then automatically be escalated, alerted upon or failed based on security criteria. Hence, CircleCI users can mirror their DevOps initiatives with DevSecOps goals.

    “As a technology company with multiple products available on many platforms, we are always looking for the best ways to ensure our code is the highest quality and the most secure. We are excited to be working with ShiftLeft and in partnership with CircleCI to ensure our code pipeline produces secure code. The time and resources we save working with this product allows us to be more agile and more productive.” Rick Bohm, Vice President, Information Security, HomeAdvisor.

    As part of the partnership, ShiftLeft Inspect will be free to CircleCI users for an unlimited number of applications and frameworks, totaling no more than 200,000 lines of code and 300 scans per year. The free license will include one programming language and enable CircleCI users to scan up to two applications concurrently.

    “Today’s developers are building and delivering software at incredibly high velocity, which is required to meet the demands of organizations and customers,” said Tom Trahan, Vice President of Business Development, CircleCI. “Historically, security has been viewed as a step that slows down that velocity. CircleCI is excited to partner with ShiftLeft to enable developers to insert security further left in the CI/CD pipeline, for accurate vulnerability scanning.”

    “When it comes to source code analysis, most of what’s being delivered today in application security is automation for automation’s sake. The tools on the market today aren’t actually enabling organizations to make the right decisions automatically,” said Alok Shukla, Vice President of Product Management, ShiftLeft. “With ShiftLeft and CircleCI, organizations and developers are able to make accurate, fast decisions when it comes to their release quality, further left in the development lifecycle than ever before. By inserting security as far left as the pull requests, we’re delivering industry-first SAST capabilities that will help our customers harness the benefits modern CI/CD pipelines without leaving security behind.”

    The integration is immediately available to ShiftLeft customers and CircleCI users via CircleCI Orb that can be found at https://circleci.com/integrations/.

    About ShiftLeft

    ShiftLeft is a continuous application security platform, purpose-built for the modern software development life cycle. It combines next-generation static code analysis (to quickly and accurately identify vulnerabilities) with application instrumentation (to protect the application) in an automated workflow. This combination of runtime-informed code analysis and code-informed runtime protection delivers the most accurate, automated, and comprehensive application security solution. To learn how ShiftLeft keeps application security in sync with the rapid pace of DevOps, see https://www.shiftleft.io/.

  • ShiftLeft Ocular Identifies Business Logic Flaws 10x Faster than Manual Code Reviews

    Support for New Programming Languages and Enhanced Regression Testing Delivers First-of-its-Kind Vulnerability Analysis Solution

    Santa Clara, Calif. – July 16, 2019 – ShiftLeft Inc., an innovator in automated application security, today announced enhancements to its Ocular solution that empower organizations to discover business logic flaws during application development 10 times faster than manual code reviews.

    Updates to Ocular include support for four new programming languages, C#, C, C++ and Scala, which improve development efforts with coverage for the top cloud, Internet of Things (IoT) and embedded applications. The updates also include blazing fast automated security regression testing in CI/CD, which ensures previously fixed business logic flaws are never reintroduced. Ocular can analyze two million lines of code in under eight minutes, which is 40 times faster than typical code analysis tools.

    With Ocular, a Fortune 500 customer is able to find vulnerabilities 10 times faster than manual code reviews. In less than the time it took to typically find one vulnerability, the company quickly found eight zero-day vulnerabilities in its custom code and open source libraries, including an insecure direct object reference, which would allow attackers to manipulate direct object references by merely changing the predictable sequence in order to access other objects without authorization.

    The pace and complexity of modern applications has grown beyond human scale. Even the best security reviewers cannot comprehend the logic of tens or hundreds of thousands of lines of code to find flaws. Yet, to date, the only way for organizations to detect business logic flaws in development is through manual code reviews, which are error prone and take weeks to complete. The result is the majority of releases have little or no checks for business logic flaws and the overwhelming majority go unnoticed in development.

    Unlike technical vulnerabilities — such as SQL injection, cross-site scripting and deserialization — business logic flaws often require little or no technical expertise to exploit. For example, in the recent First American Financial Corp. data breach, a control flow reachability business logic flaw was exploited by simply changing values in a URL.

    Matias Blanco, manager of application security at Okta, said of Ocular: “Millions of daily users rely on the Okta Identity Cloud to access the technologies they need. For an agile software development team, every minute is valuable, and the time spent on in-depth code audits can be especially challenging. ShiftLeft Ocular promises to turn weeks into hours when it comes to code security reviews.”

    Ocular is an interactive shell to query ShiftLeft’s Code Property Graph (CPG). The CPG is a graph of graphs that connects the functions of source code together into a fabric of information flows that can be traversed from source to sink. With Ocular, security researchers, code auditors and developers can iteratively interrogate the validity of business logic flows to identify flaws and demonstrate reachability. Ocular queries can then be automated as security policy checks and regression testing through CI/CD pipelines.

    “Business logic flaws are inherently unique to each organization, which makes them incredibly difficult to identify and fix,” said Manish Gupta, CEO of ShiftLeft. “Through our updates to Ocular, we’re making it easier for developers and application security teams to automatically find flaws in their software not covered by traditional static application testing tools. However, we also know fixing vulnerabilities before they make it to production isn’t always possible for every release. Since we know exactly how applications are vulnerable, we can also automatically generate a custom security profile to protect applications in production and buy security and development teams more time to fix their vulnerabilities.”

    To learn more about Ocular, visit the ShiftLeft website or sign up for a 14 day free trial here: https://go.shiftleft.io/ocular-free-trial.

    About ShiftLeft

    ShiftLeft is a continuous application security platform, purpose-built for the modern software development life cycle. It combines next-generation static code analysis (to quickly and accurately identify vulnerabilities) with application instrumentation (to protect the application) in an automated workflow. This combination of runtime-informed code analysis and code- informed runtime protection delivers the most accurate, automated, and comprehensive application security solution. To learn how ShiftLeft keeps application security in sync with the rapid pace of DevOps, see https://www.shiftleft.io/.

     

     

  • ShiftLeft Raises $20 Million Series B Funding to Accelerate Adoption of Automated Application Security

    Thomvest leads round with participation from Sinewave, Bain Capital Ventures and Mayfield; new advisory board includes prominent members of security and development community

     

    SANTA CLARA, Calif., Feb 12, 2019 – ShiftLeft™ Inc., an innovator in application-specific cloud security, today announced it has raised $20 million in Series B funding. This latest round, led by Thomvest Ventures and joined by new investor SineWave Ventures as well as existing investors Bain Capital Ventures and Mayfield, comes less than 18 months after the company announced its first round of $9.3 million, bringing the total raised to nearly $30 million. The company is also announcing the addition of Jim Sortino, who previously held executive roles at Trend Micro and Dome9 Security (acquired by Checkpoint), as vice president of worldwide sales.

    The company is using these funds to drive broader adoption of its code-informed runtime protection by expanding the breadth of its product portfolio, application coverage and global sales and marketing initiatives.

    Software is rapidly becoming the driver of innovation. From internal enterprise applications to connected systems and devices in markets such as automotive, HVAC and electronics, many industries now compete on the advantages and benefits their software delivers. Every facet of modern life has been impacted by software and the data collected has expanded massively. Traditional application security approaches simply cannot scale.

    “We are excited to lead ShiftLeft’s Series B financing. The company has an impressive team, led by CEO, Manish Gupta. ShiftLeft provides intelligent automation of code security, which addresses a major pain point for the CISOs of modern enterprises: to protect applications and data,” said Umesh Padval, venture partner at Thomvest Ventures. “ShiftLeft’s unique architecture provides a prioritized list of vulnerabilities with the least number of false positives and detailed vulnerability information, which helps developers remediate rapidly. A high-performance runtime solution that can protect applications in production empowers security teams to embrace automation as the solution which integrates seamlessly into the CI/CD [continuous integration/continuous delivery] workflow of an organization.”

    From containers and microservices to cloud and open source, a vast array of forces are rapidly changing and accelerating application development and deployment. This investment underscores both the importance of ensuring security despite this complex landscape, and ShiftLeft’s unique ability to empower application security teams to protect the enterprise. Unlike traditional application security approaches, which are focused on external threats and rely on manual efforts to triage inaccurate alerts, ShiftLeft is the first to use code analysis to deeply understand application vulnerabilities, and create a virtual security perimeter to detect and protect every application version against malicious or unauthorized activity targeted at those vulnerabilities.

    “Security has always been paramount, but traditional code analysis tools didn’t integrate into our CI/CD pipeline, created too many false positives and were just too slow,” said Harjot Gill, general manager of Nutanix Epoch. “The accuracy and speed of ShiftLeft enables Nutanix Epoch to automatically secure every release without slowing down new feature development.”

    According to Patricia Muoio, partner at SineWave and former chief of the NSA’s Trusted System Group, “We were particularly impressed by ShiftLeft’s combination of software assurance with runtime monitoring. This unique ability to not only automate code security, but also deliver the analytics that helps DevOps organizations understand, confirm and prioritize vulnerability patching enables enterprises to get ahead of threats and truly changes the game in cyber security.”

    As part of its growth initiative, ShiftLeft has also created an advisory board of prominent security and development thought leaders, including:

    • Bob Flores, former CTO of the Central Intelligence Agency
    • Craig Rosen, CISO of AppDynamics
    • Shahar Ben Hador, CIO of Exabeam
    • Aaron McKeown, head of security engineering and architecture at Xero
    • Manish Arya, founder and CTO of Tavant
    • Yonatan Ryabinski, chief enterprise architect at Vanguard

    ShiftLeft Quotes

    “Our founding vision is that application security needs to be a seamless part of the development process, not an afterthought,” said Manish Gupta, CEO and co-founder of ShiftLeft. “The problem has long been inaccurate tools and a heavily manual process, leaving security and development teams frustrated and applications vulnerable. ShiftLeft completely upends this paradigm, delivering automated and customized protection for every software release, and the analytics dev teams need to improve on the overall security posture.”

    “I’ve seen organizations struggle through a reactive, threat-focused security posture, resulting in overworked security teams and frequent breaches,” said Enrique Salem, partner at Bain Capital Ventures and former CEO of Symantec. “Yet ShiftLeft gets at the root problem – vulnerable software – by automating the process of accurately and rapidly analyzing and plugging vulnerabilities in the applications themselves. It’s exciting to be an investor in a company that is meaningfully helping security teams by reducing the overall attack surface and providing direct root-cause insight for developers.”

    “Every modern company has become a software company, making application security vital,” said Ursheet Parikh, partner at Mayfield. “So it’s no surprise security is daily news: as the volume and pace of new applications has skyrocketed, the number of vulnerabilities has exploded. The ability to customize security for each version of every application is what drew us to ShiftLeft, and why we think the company promises to have a remarkable impact on the overall market.”

    About ShiftLeft

    ShiftLeft is a continuous application security platform, purpose-built for the modern software development life cycle. It combines next-generation static code analysis (to quickly and accurately identify vulnerabilities) with application instrumentation (to protect the application) in an automated workflow. This combination of runtime-informed code analysis and code- informed runtime protection delivers the most accurate, automated, and comprehensive application security solution. To learn how ShiftLeft keeps application security in sync with the rapid pace of DevOps, see https://www.shiftleft.io/.