November 2022 Summaries

The concept of "Shifting Left" in cybersecurity emphasizes conducting security testing early in the development cycle to catch vulnerabilities before they reach production, but it is not a comprehensive solution. While it can significantly reduce risks and inefficiencies, relying solely on this approach is insufficient because it won't catch all vulnerabilities, and some assets might remain unprotected due to oversight. True DevSecOps requires a layered strategy that includes both "shifting right," which involves continuous testing in production environments to address any vulnerabilities that may still arise. Effective security should encompass a plan for continuously discovering and managing vulnerabilities across the entire attack surface, especially as organizations increasingly adopt complex digital and cloud infrastructures. Moreover, the traditional belief that later-stage vulnerability identification exponentially increases remediation costs is becoming outdated, as modern development processes with cross-functional teams and cloud-based architectures can reduce the time and cost of fixes. Therefore, while embracing the shift left movement is beneficial, it is crucial to maintain a balanced approach that includes vigilant monitoring and remediation strategies in production environments.

Recent enhancements to Attack Surface Custom Policies and Application Scanning aim to improve security monitoring and vulnerability detection for Surface Monitoring customers. The improvements include easier navigation of alerts, the ability to delete custom policies, and expanded coverage of modern web applications that utilize JavaScript and SPAs through enhanced crawling capabilities. Additionally, the Port Scanning feature now scans newly discovered domains instantly, providing insights on failed scans, while new vulnerabilities sourced from ethical hackers have been integrated into the system. Upcoming features promise to allow more tailored policy scoping to specific domains and technologies, and users can explore these capabilities through a demo or a free trial offered by Detectify.