Introducing cloud-native security
In light of what we have seen so far in previous chapters, we know that the cloud can help us develop and deploy solutions faster and at a better cost. However, that is only true if we also modernize the way that we secure our workloads. Cloud-native security relies on the Shift-Left principle, which consists of integrating security processes earlier in the life cycle of an asset. Considering security from the ground up prevents unexpected delays and surprises later, prior to the production deployment. However, this is easier said than done!
Often, we see developers (usually early adopters) and infrastructure engineers embracing this modernized way of working (with Infrastructure as Code (IaC)), while security remains organized in a traditional way (waterfall and reactive). Often, you must wait weeks, if not more, to have a firewall rule ticket request accepted and implemented. This way of working is the exact opposite of the Shift-Left mindset...