Shift Left Isn’t Enough

Some CNAPP vendors claim that their solution will identify so many misconfigurations and known vulnerabilities that an attacker will be unable to gain an attack surface within a cloud environment, rendering runtime security as a “nice to have" but not a necessity.

Statistics tell a different story. The CrowdStrike “2024 State of Application Security Report” showed that only about half of all major code changes go through full security reviews. For anyone familiar with software development, this statistic isn’t all that surprising. At the end of the day, features and innovation will always take precedence over security.

"Shift left" strategies have gained significant traction over the past years. The shift left approach emphasizes integrating security early in the software development lifecycle (SDLC), enabling developers to identify and address vulnerabilities during the coding and build phases. While this proactive approach is crucial, it’s not sufficient on its own. Ensuring robust cloud security also requires a strong focus on runtime security—what can be termed as “protect right.” This blog explores why runtime cloud security is essential even with comprehensive shift left efforts.

The Limitations of Shift Left

Despite its advantages, shift left alone cannot guarantee complete security. Several factors contribute to its limitations:

1. Runtime Environment Complexities:

Applications behave differently in production environments than in testing or development environments. Real-world traffic patterns, user interactions, and integration with other services can introduce unforeseen vulnerabilities.

2. Signature Based Approach (CVE-ID):

Shift left methodologies base their identification of vulnerabilities on signatures, such as CVE-IDs (Common Vulnerabilities and Exposures). This approach is problematic for several reasons:

1. Limited to Known Threats: Only threats that have already been discovered and cataloged can be identified. As a result, it is ineffective against CVE-Less threats (e.g. new vulnerabilities still being analyzed, unknown vulnerabilities, zero-day, AI-Hallucinations, library misconfigurations and malicious packages) that do not have signatures.
2. Reactive. It requires a vulnerability to be identified, analyzed, and a signature created before it can be detected. This leaves a window of exposure where the application is vulnerable to attacks exploiting newly discovered or emerging threats. Raven’s analysis of 28,660 CVEs published in 2023, reveals that it takes a CVE 103 days on average from assigned date to publish date.
3. False Sense of Security: Organizations may believe they are protected simply because no known signatures have been matched, ignoring the possibility of undetected threats.

Runtime is Money-time

Cloud runtime application security, or "protect right," focuses on securing applications while they are running in production environments. It complements shift left strategies by providing real-time protection and response capabilities, ensuring attacks are detected early in the kill chain, including CVE-Less attacks which are overlooked by “shift left” alone.

Integrating Shift Left with Protect Right

The most robust cloud security strategy integrates both shift left and protect right approaches:

• Shift Left: Embed security early in the SDLC to prevent vulnerabilities from being introduced.
• Protect Right: Implement runtime security measures to detect and respond to threats in real-time, ensuring ongoing protection.

This comprehensive approach ensures that security is maintained throughout the entire lifecycle of the application, from development through to production.

Conclusion

While shift left strategies are essential for building secure applications, they are not sufficient on their own. Cloud runtime application security, or protect right, is crucial especially as attackers are increasingly shifting their focus to applications. By combining shift left and protect right approaches, organizations can achieve a robust and comprehensive security posture, ensuring their applications are secure throughout their lifecycle.

Protect Right: Raven’s Runtime ADR platform protects-right and complements your shift-left strategy. Book a demo today.

‍