* [Blog](https://www.paloaltonetworks.com/blog) * [Palo Alto Networks](https://www.paloaltonetworks.com/blog/corporate/) * [未分类](https://www.paloaltonetworks.com/blog/category/%e6%9c%aa%e5%88%86%e7%b1%bb/?lang=zh-hant) * 安全防护"左移"的 4 个实用步骤... # 安全防护"左移"的 4 个实用步骤 [](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fwww.paloaltonetworks.com%2Fblog%2F2019%2F08%2F4-practical-steps-shift-left-security%2F%3Flang%3Dzh-hans) [](https://twitter.com/share?text=%E5%AE%89%E5%85%A8%E9%98%B2%E6%8A%A4%E2%80%9C%E5%B7%A6%E7%A7%BB%E2%80%9D%E7%9A%84+4+%E4%B8%AA%E5%AE%9E%E7%94%A8%E6%AD%A5%E9%AA%A4&url=https%3A%2F%2Fwww.paloaltonetworks.com%2Fblog%2F2019%2F08%2F4-practical-steps-shift-left-security%2F%3Flang%3Dzh-hans) [](https://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fwww.paloaltonetworks.com%2Fblog%2F2019%2F08%2F4-practical-steps-shift-left-security%2F%3Flang%3Dzh-hans&title=%E5%AE%89%E5%85%A8%E9%98%B2%E6%8A%A4%E2%80%9C%E5%B7%A6%E7%A7%BB%E2%80%9D%E7%9A%84+4+%E4%B8%AA%E5%AE%9E%E7%94%A8%E6%AD%A5%E9%AA%A4&summary=&source=) [](https://www.paloaltonetworks.com//www.reddit.com/submit?url=https://www.paloaltonetworks.com/blog/2019/08/4-practical-steps-shift-left-security/?lang=zh-hans&ts=markdown) \[\](mailto:?subject=安全防护“左移”的 4 个实用步骤) Link copied By [Matthew Chiodi](https://www.paloaltonetworks.com/blog/author/matthew-chiodi/?lang=zh-hans&ts=markdown "Posts by Matthew Chiodi") Aug 15, 2019 1 minutes [未分类](https://www.paloaltonetworks.com/blog/category/%e6%9c%aa%e5%88%86%e7%b1%bb/?lang=zh-hant&ts=markdown) This post is also available in: [English (英语)](https://www.paloaltonetworks.com/blog/2019/07/4-practical-steps-shift-left-security/ "切换到 英语(English)") [繁體中文 (繁体中文)](https://www.paloaltonetworks.com/blog/2019/08/4-practical-steps-shift-left-security/?lang=zh-hant "切换到 繁体中文(繁體中文)") [日本語 (日语)](https://www.paloaltonetworks.com/blog/2019/08/4-practical-steps-shift-left-security/?lang=ja "切换到 日语(日本語)") [한국어 (韩语)](https://www.paloaltonetworks.com/blog/2019/08/4-practical-steps-shift-left-security/?lang=ko "切换到 韩语(한국어)") [Português (葡萄牙语（巴西）)](https://www.paloaltonetworks.com/blog/2019/08/4-practical-steps-shift-left-security/?lang=pt-br "切换到 葡萄牙语（巴西）(Português)") 自从现代计算出现以来，安全防护便与软件开发产生了巨大的脱节。[最近的漏洞研究](https://www.paloaltonetworks.com/resources/infographics/2019-state-of-the-industry-publicly-exposed-vulnerabilities?ts=markdown)证实了这一点。在过去五年间，所有已发布的漏洞中有 76% 来自应用。鉴于攻击者的重点产生了这种根本性的转变，到了将安全防护嵌入开发的时候了。为实现这一点，最好的方式是实施安全防护左移策略。 **安全防护左移定义** 用最简单的术语来解释，安全防护"左移"就是将安全防护尽可能地移到开发流程的早期。现代 [CI/CD](https://dzone.com/articles/what-is-cicd) 流程通常包括八个步骤，如图 1 所示。安全防护左移不仅有利于降低网络风险，还可以降低成本。[IBM](https://www.researchgate.net/figure/IBM-System-Science-Institute-Relative-Cost-of-Fixing-Defects_fig1_255965523) 的系统科学研究所发现，在设计过程中解决安全问题，比在实施过程中解决的成本要低六倍。同一项研究还发现，在测试过程中解决安全问题的成本甚至要高出 15 倍。 要有意识地将安全防护嵌入到每个步骤中，首先需要清晰地定义策略。 ![](https://www.paloaltonetworks.com/blog/wp-content/uploads/2019/07/Shift-Left.png) 图 1：CI/CD **步骤** **1** **：定义安全防护左移策略** 千里之行，目标为先。为您的团队勾画鲜明的图景，让成员了解怎样才算获得成功。在该文档中，需要包含的关键内容是愿景、所有权/责任、里程碑和指标。策略文档会随着时间而变得成熟，不要花费太多时间试图使其完美无缺。随时间的推移而迭代是必不可少的。 **步骤** **2** **：了解企业中创建软件的位置和方法** 安全防护左移最有挑战的一个方面，可能是首先掌握企业中软件创建的方法和位置。根据企业的规模，这项工作可能非常简单，也可能非常困难。 此步骤的目标是从企业范围开始了解，并记录下企业中软件的整体流程。大中型企业都希望从宏观入手，然后细化到单独的业务单位。很可能每个业务单位都有自己的软件开发流程和工具。在此阶段要识别的关键项目，包括谁开发代码（人员），如何从计算机开发推进到生产（流程），以及使用何种系统支持流程（技术）。这也可以称为 CI/CD 工具链。毫无疑问，很多软件开发的流程在公有云中进行。 **步骤** **3** **：识别并实施安全质量护栏** 质量保证一直是软件开发生命周期的一部分。但是在过去，安全防护从未包括在软件质量中。这种现状必须改变，之前的步骤中完成的工作会帮助您做到这一点。软件开发流程中的每个步骤都是提供反馈、查找安全问题的机会。最有效的安全团队从小事开始入手。他们为开发团队提供简单高效的工具，并让这些工具成为日常开发例程的一部分。Palo Alto Networks 最近公开了[一个此类工具](https://scanapidoc.redlock.io/)的源代码，意味着可以免费使用。 **步骤** **4** **：评估并不断训练开发团队的安全编码能力** 安全防护左移的其中一步，是确保作为编码主体的人员在开发初期便创建安全的代码。如果没有对他们现在的技巧进行客观衡量，也没有持续改善技巧的计划，那么实现这一步很难。一项调查表明，19% 的开发人员表示自己不熟悉 [10 大 OWASP](https://www.owasp.org/images/7/72/OWASP_Top_10-2017_%28en%29.pdf.pdf)，这一点不容忽视。DevOps 服务提供商 [GitLab](https://about.gitlab.com/developer-survey/2019/) 最近发布的一项调查进一步强调了这一点，其中发现有 70% 的程序员应该编写安全的代码，但只有 25% 认为所在企业的安全实践"还不错"。 **安全防护左移看起来如何** 让我们看一下这两个场景，其中我们将开发简化为构建、部署和运行阶段。在场景 1 中，开发在没有安全防护的情况下运行。仅在运行时检查软件质量。这经常导致在找到漏洞时，安全防护与开发之间的交流非常困难。 ![](https://www.paloaltonetworks.com/blog/wp-content/uploads/2019/07/Scenario-1-Shift-Left.png) 但是，在场景 2 中，安全团队花了很多时间了解企业中的开发流程。同时，他们花费时间将安全防护流程和工具嵌入到 CI/CD 过程中，结果实现了自动化的安全防护质量护栏。 ![](https://www.paloaltonetworks.com/blog/wp-content/uploads/2019/07/Scenario-2-Shift-Left.png) **结语** 利用上述四个步骤，您的组织不仅会稳步实现安全防护的左移，而且能够让安全防护与开发同步。在云旅程中，随着组织趋向左移，自动化且由 API 驱动的安全控制就会显得非常关键。Palo Alto Networks [Prisma](https://www.paloaltonetworks.com/prisma/cloud/cloud-workload-protection-platform?ts=markdown) 帮助安全团队保护 DevOps 和 CI/CD 渠道的安全，从而实现这一点。 *** ** * ** *** ## Related Blogs ### [未分类](https://www.paloaltonetworks.com/blog/category/%e6%9c%aa%e5%88%86%e7%b1%bb/?lang=zh-hant&ts=markdown) [#### AI代理已經來臨，威脅也隨之而來](https://www.paloaltonetworks.com/blog/2025/05/ai-agents-threats/?lang=zh-hant) ### [未分类](https://www.paloaltonetworks.com/blog/category/%e6%9c%aa%e5%88%86%e7%b1%bb/?lang=zh-hant&ts=markdown) [#### Strata Copilot - 加速迈向自主网络安全的未来](https://www.paloaltonetworks.com/blog/network-security/strata-copilot/?lang=zh-hans) ### [未分类](https://www.paloaltonetworks.com/blog/category/%e6%9c%aa%e5%88%86%e7%b1%bb/?lang=zh-hant&ts=markdown) [#### 防火墙已死？至少本世纪不会！](https://www.paloaltonetworks.com/blog/2023/08/ngfw-is-not-dead-yet/?lang=zh-hans) ### [未分类](https://www.paloaltonetworks.com/blog/category/%e6%9c%aa%e5%88%86%e7%b1%bb/?lang=zh-hant&ts=markdown) [#### 面对性命攸关的时刻，如何实现可靠的医疗物联网安全](https://www.paloaltonetworks.com/blog/2022/12/medical-iot-security-to-depend-on/?lang=zh-hans) ### [未分类](https://www.paloaltonetworks.com/blog/category/%e6%9c%aa%e5%88%86%e7%b1%bb/?lang=zh-hant&ts=markdown) [#### 利用业界首创的 AIOps for NGFW 革新防火墙运行](https://www.paloaltonetworks.com/blog/2022/03/industry-first-aiops-for-ngfw/?lang=zh-hans) ### [未分类](https://www.paloaltonetworks.com/blog/category/%e6%9c%aa%e5%88%86%e7%b1%bb/?lang=zh-hant&ts=markdown) [#### Prisma Access 是保护远程用户安全的领先云服务](https://www.paloaltonetworks.com/blog/2021/08/prisma-access-leading-cloud-service-secure-remote-users/?lang=zh-hans) ### Subscribe to the Blog! Sign up to receive must-read articles, Playbooks of the Week, new feature announcements, and more. ![spinner](https://www.paloaltonetworks.com/blog/wp-content/themes/panwblog2023/dist/images/ajax-loader.gif) Sign up Please enter a valid email. By submitting this form, you agree to our [Terms of Use](https://www.paloaltonetworks.com/legal-notices/terms-of-use?ts=markdown) and acknowledge our [Privacy Statement](https://www.paloaltonetworks.com/legal-notices/privacy?ts=markdown). Please look for a confirmation email from us. If you don't receive it in the next 10 minutes, please check your spam folder. This site is protected by reCAPTCHA and the Google [Privacy Policy](https://policies.google.com/privacy) and [Terms of Service](https://policies.google.com/terms) apply. {#footer} {#footer} ## Products and Services * [AI-Powered Network Security Platform](https://www.paloaltonetworks.com/network-security?ts=markdown) * [Secure AI by Design](https://www.paloaltonetworks.com/precision-ai-security/secure-ai-by-design?ts=markdown) * [Prisma AIRS](https://www.paloaltonetworks.com/prisma/prisma-ai-runtime-security?ts=markdown) * [AI Access Security](https://www.paloaltonetworks.com/sase/ai-access-security?ts=markdown) * [Cloud Delivered Security Services](https://www.paloaltonetworks.com/network-security/security-subscriptions?ts=markdown) * [Advanced Threat Prevention](https://www.paloaltonetworks.com/network-security/advanced-threat-prevention?ts=markdown) * [Advanced URL Filtering](https://www.paloaltonetworks.com/network-security/advanced-url-filtering?ts=markdown) * [Advanced WildFire](https://www.paloaltonetworks.com/network-security/advanced-wildfire?ts=markdown) * [Advanced DNS Security](https://www.paloaltonetworks.com/network-security/advanced-dns-security?ts=markdown) * [Enterprise Data Loss Prevention](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention?ts=markdown) * [Enterprise IoT Security](https://www.paloaltonetworks.com/network-security/enterprise-device-security?ts=markdown) * [Medical IoT Security](https://www.paloaltonetworks.com/network-security/medical-device-security?ts=markdown) * [Industrial OT Security](https://www.paloaltonetworks.com/network-security/medical-device-security?ts=markdown) * [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security?ts=markdown) * [Next-Generation Firewalls](https://www.paloaltonetworks.com/network-security/next-generation-firewall?ts=markdown) * [Hardware Firewalls](https://www.paloaltonetworks.com/network-security/hardware-firewall-innovations?ts=markdown) * [Software Firewalls](https://www.paloaltonetworks.com/network-security/software-firewalls?ts=markdown) * [Strata Cloud Manager](https://www.paloaltonetworks.com/network-security/strata-cloud-manager?ts=markdown) * [SD-WAN for NGFW](https://www.paloaltonetworks.com/network-security/sd-wan-subscription?ts=markdown) * [PAN-OS](https://www.paloaltonetworks.com/network-security/pan-os?ts=markdown) * [Panorama](https://www.paloaltonetworks.com/network-security/panorama?ts=markdown) * [Secure Access Service Edge](https://www.paloaltonetworks.com/sase?ts=markdown) * [Prisma SASE](https://www.paloaltonetworks.com/sase?ts=markdown) * [Application Acceleration](https://www.paloaltonetworks.com/sase/app-acceleration?ts=markdown) * [Autonomous Digital Experience Management](https://www.paloaltonetworks.com/sase/adem?ts=markdown) * [Enterprise DLP](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention?ts=markdown) * [Prisma Access](https://www.paloaltonetworks.com/sase/access?ts=markdown) * [Prisma Browser](https://www.paloaltonetworks.com/sase/prisma-browser?ts=markdown) * [Prisma SD-WAN](https://www.paloaltonetworks.com/sase/sd-wan?ts=markdown) * [Remote Browser Isolation](https://www.paloaltonetworks.com/sase/remote-browser-isolation?ts=markdown) * [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security?ts=markdown) * [AI-Driven Security Operations Platform](https://www.paloaltonetworks.com/cortex?ts=markdown) * [Cloud Security](https://www.paloaltonetworks.com/cortex/cloud?ts=markdown) * [Cortex Cloud](https://www.paloaltonetworks.com/cortex/cloud?ts=markdown) * [Application Security](https://www.paloaltonetworks.com/cortex/cloud/application-security?ts=markdown) * [Cloud Posture Security](https://www.paloaltonetworks.com/cortex/cloud/cloud-posture-security?ts=markdown) * [Cloud Runtime Security](https://www.paloaltonetworks.com/cortex/cloud/runtime-security?ts=markdown) * [Prisma Cloud](https://www.paloaltonetworks.com/prisma/cloud?ts=markdown) * [AI-Driven SOC](https://www.paloaltonetworks.com/cortex?ts=markdown) * [Cortex XSIAM](https://www.paloaltonetworks.com/cortex/cortex-xsiam?ts=markdown) * [Cortex XDR](https://www.paloaltonetworks.com/cortex/cortex-xdr?ts=markdown) * [Cortex XSOAR](https://www.paloaltonetworks.com/cortex/cortex-xsoar?ts=markdown) * [Cortex Xpanse](https://www.paloaltonetworks.com/cortex/cortex-xpanse?ts=markdown) * [Unit 42 Managed Detection \& Response](https://www.paloaltonetworks.com/cortex/managed-detection-and-response?ts=markdown) * [Managed XSIAM](https://www.paloaltonetworks.com/cortex/managed-xsiam?ts=markdown) * [Threat Intel and Incident Response Services](https://www.paloaltonetworks.com/unit42?ts=markdown) * [Proactive Assessments](https://www.paloaltonetworks.com/unit42/assess?ts=markdown) * [Incident Response](https://www.paloaltonetworks.com/unit42/respond?ts=markdown) * [Transform Your Security Strategy](https://www.paloaltonetworks.com/unit42/transform?ts=markdown) * [Discover Threat Intelligence](https://www.paloaltonetworks.com/unit42/threat-intelligence-partners?ts=markdown) ## Company * [About Us](https://www.paloaltonetworks.com/about-us?ts=markdown) * [Careers](https://jobs.paloaltonetworks.com/en/) * [Contact Us](https://www.paloaltonetworks.com/company/contact-sales?ts=markdown) * [Corporate Responsibility](https://www.paloaltonetworks.com/about-us/corporate-responsibility?ts=markdown) * [Customers](https://www.paloaltonetworks.com/customers?ts=markdown) * [Investor Relations](https://investors.paloaltonetworks.com/) * [Location](https://www.paloaltonetworks.com/about-us/locations?ts=markdown) * [Newsroom](https://www.paloaltonetworks.com/company/newsroom?ts=markdown) ## Popular Links * [Blog](https://www.paloaltonetworks.com/blog/?ts=markdown) * [Communities](https://www.paloaltonetworks.com/communities?ts=markdown) * [Content Library](https://www.paloaltonetworks.com/resources?ts=markdown) * [Cyberpedia](https://www.paloaltonetworks.com/cyberpedia?ts=markdown) * [Event Center](https://events.paloaltonetworks.com/) * [Manage Email Preferences](https://start.paloaltonetworks.com/preference-center) * [Products A-Z](https://www.paloaltonetworks.com/products/products-a-z?ts=markdown) * [Product Certifications](https://www.paloaltonetworks.com/legal-notices/trust-center/compliance?ts=markdown) * [Report a Vulnerability](https://www.paloaltonetworks.com/security-disclosure?ts=markdown) * [Sitemap](https://www.paloaltonetworks.com/sitemap?ts=markdown) * [Tech Docs](https://docs.paloaltonetworks.com/) * [Unit 42](https://unit42.paloaltonetworks.com/) * [Do Not Sell or Share My Personal Information](https://panwedd.exterro.net/portal/dsar.htm?target=panwedd) ![PAN logo](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/pan-logo-dark.svg) * [Privacy](https://www.paloaltonetworks.com/legal-notices/privacy?ts=markdown) * [Trust Center](https://www.paloaltonetworks.com/legal-notices/trust-center?ts=markdown) * [Terms of Use](https://www.paloaltonetworks.com/legal-notices/terms-of-use?ts=markdown) * [Documents](https://www.paloaltonetworks.com/legal?ts=markdown) Copyright © 2026 Palo Alto Networks. All Rights Reserved * [![Youtube](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/youtube-black.svg)](https://www.youtube.com/user/paloaltonetworks) * [![Podcast](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/icons/podcast.svg)](https://www.paloaltonetworks.com/podcasts/threat-vector?ts=markdown) * [![Facebook](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/facebook-black.svg)](https://www.facebook.com/PaloAltoNetworks/) * [![LinkedIn](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/linkedin-black.svg)](https://www.linkedin.com/company/palo-alto-networks) * [![Twitter](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/twitter-x-black.svg)](https://twitter.com/PaloAltoNtwks) * EN Select your language