Shifting Security Left: Where to Start