# Security in Cloud-Native Services: A Survey
## 6 Secure Software Development Lifecycle (SDLC)
### Shift Left and Static Testing Techniques for Enhancing Security  
One prominent challenge is the detection of vulnerabilities before attackers can exploit them. These vulnerabilities may be due to incorrect infrastructure configurations, vulnerabilities inherited from container-based images, or vulnerabilities in the application code. With this in mind, Shift Left approach [141] should be considered. Shift Left in the context of Secure SDLC refers to incorporating security measures and testing earlier in the development process. This way, security concerns are identified and addressed proactively as early as possible, rather than waiting until later stages or after the software has been released. By using Shift Left practices, security shall become a fundamental aspect of the development process rather than an afterthought. This shall help to prevent security vulnerabilities and flaws from being introduced into the codebase, reducing the risk of security breaches and other issues down the line. This approach also promotes better communication within the development team and ensures alignment of security goals and requirements, leading to more effective security solutions. Furthermore, the concept of Configuration as Code  
Figure 11: Infrastructure-as-Code. (CaC) [142], often employed in Shift Left practices, simplifies and automates configuration provisioning and management, facilitating the integration of security checks directly into code or configuration files. Finally, this approach assists towards complying with the requirements of the various regulatory and standardization bodies. Static Application Security Testing (SAST) [143] techniques are used to perform a static (application at rest) scan of an application component's source to assess the general code quality and detect potential security vulnerabilities. This technique is limited to the application code and does not examine environment or run-time-related vulnerabilities. Issues are detected at the early stages of the software development life-cycle, reducing the overall impact and the cost of mitigation. On the other hand, Static Container Image Security Testing [144] is used for statically scanning container images of application microservice components to search for known vulnerabilities, typically by parsing through image packages or other dependencies. Automated static application testing combined with container testing techniques allows the detection of a broad range of different vulnerabilities. They can be tightly integrated with the basic DevOps pipeline or put aside as an additional set of tools. Several open security assurance tools and software packages can potentially be part of a DevSecOps cycle for application developers. Their selection is based on aspects like license type, capabilities, open project activity and maturity, documentation, and the possibility of being extended. In this regard, various tools can be employed for Shift Left and automating the process and vulnerability search. Static Application Security Testing (SAST) tools like Check-mary [145] allow verifying source code against known bad patterns that risk the security of applications. Likewise, Dynamic Application Security Testing (DAST) [146] tools OWASP Zed Attack Proxy (ZAP) [147] can be used to dynamically assess the running behavior of applications as an attacker would. Moreover, tools like Microsoft Credential Scanner (CredScan) are useful for identifying credential-related vulnerabilities and leaks in source code and configuration files (e.g., default passwords, SQL connection strings, or exposed private keys). Furthermore, tools like Curiefense [[https://www.curiefense.io/](https://www.curiefense.io/)]([https://www.curiefense.io/](https://www.curiefense.io/)) (accessed on 15 August 2023) and Falco [[https://falco.org/](https://falco.org/)]([https://falco.org/](https://falco.org/)) (accessed on 15 August 2023) are also fundamental to detecting and reporting unexpected application runtime behaviors quickly.