DevSecOps › Module 2 › Lesson 2
Shift Left
Shift left literacy names early testing, pre-merge gates, and cheaper fixes — map shift-left checkpoints on YOUR $DEVSEC_LAB before broad production deploy.
Visual · t36_shift_left
Shift left literacy. $DEVSEC_LAB only. Original Cyberlium.
Opening
Fix cost rises with stage — literacy teaches shift-left checkpoints so findings surface in PRs on repos you govern.
Shift left moves security testing earlier — IDE hints, pre-commit hooks, PR checks, build-stage SAST, container scan before push to registry. A secret caught in PR costs minutes; the same secret in production costs incident response. Each leftward step needs scope — YOUR repo, YOUR lab URL, YOUR artifacts. Cyberlium outlines shift-left on YOUR $DEVSEC_LAB — write checkpoint row for commit, PR, build, and deploy on one fictional app. Next: Pipeline Stages.
1. Shift-left checkpoints (named)
Commit: pre-commit secrets hook on YOUR repo. PR: SAST and lint gate before merge. Build: dependency and container scan on CI artifact. Deploy: IaC policy check and staged DAST on YOUR lab URL only.
On $DEVSEC_LAB, write checkpoint row — stage, tool class, gate action for one fictional repo.
Command guide
Try these commands — Shift-left checkpoints (named)
═══ DOCKER & CONTAINER AUDIT ═══
Check container running state and port bindings
Command — copy this
docker ps --format "table {{.ID}} {{.Image}} {{.Status}} {{.Ports}}" 2>/dev/null || echo "docker ps"Inspect container for elevated capabilities and root user
Command — copy this
docker inspect --format '{{json .HostConfig.Privileged}}' <container_id> 2>/dev/null || trueRun security vulnerability scan on container image using Trivy
Command — copy this
trivy image --severity HIGH,CRITICAL alpine:3.19 2>/dev/null || echo "trivy image alpine:3.19"
═══ KUBERNETES RBAC AUDIT ═══ Check current permissions in namespace
Command — copy this
kubectl auth can-i --list 2>/dev/null || echo "kubectl auth can-i"
Primary tools to practice this lesson: grep, python3. Reference sites: NIST SSDF (https://csrc.nist.gov/Projects/ssdf); CISA Secure by Design (https://www.cisa.gov/securebydesign); GitHub Actions security (https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Why shift left beats release-week audits
Late discovery blocks releases and forces hotfixes. Early gates give developers context while code is fresh. Version-controlled policy lets teams compare defect rates quarter over quarter on lab repos.
Students document lab checkpoints on notes — production shift-left follows org SDLC and merge policies.
3. Lab boundary
Forbidden: skipping left gates then scanning stranger orgs for 'coverage.' Allowed: shift-left card — four checkpoints with $DEVSEC_LAB fictional repo example.
Ship: shift-left card for YOUR lab pipeline. Next: Pipeline Stages.
4. What you ship: shift-left card for $DEVSEC_LAB
Four checkpoints with gate actions. $DEVSEC_LAB named. chmod 600.
5. What you record before the next lesson
Date. Shift-left card. $DEVSEC_LAB named. File t36-m02-l02-shift-left.txt chmod 600.
6. Wrong vs right: stranger orgs vs YOUR repos
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Defer all scans to production deploy. Point DAST at stranger URLs for early feedback.
Right
Write shift-left card for YOUR $DEVSEC_LAB. Next: Pipeline Stages.
Mission: document shift-left on YOUR lab
1) Define commit, PR, build, deploy checkpoints. 2) Write checkpoint row with tool class per stage. 3) Name gate pass/fail action. 4) chmod 600.
Stuck? Ask Cyberlium AI Mentor
Leftmost feasible gate wins — secrets belong in pre-commit, not post-incident.
Knowledge Check
APPLY: Shift left primarily means:
Multiple choice
Knowledge Check
APPLY: True or False: PR-stage SAST catches issues before merge on code you own.
True or False
Knowledge Check
APPLY: Shift-left literacy on Cyberlium uses:
Multiple choice