August 2020 Summaries

Shifting Dynamic Application Security Testing (DAST) left in the software development lifecycle allows for earlier detection of security vulnerabilities, but it introduces challenges like excessive alerts and high computational costs from frequent CI security jobs. The blog post outlines the configuration and optimization of DAST for the GitLab web application, addressing common issues such as managing scan durations, obtaining relevant results, and reducing alert fatigue. To optimize scan durations, techniques like excluding low-risk pages, using appropriate test data, and parallelizing jobs are recommended. The post emphasizes the importance of tailoring DAST rules to the application's specific context to avoid irrelevant tests, which can be achieved by disabling certain rules and running jobs in parallel. By sharing GitLab's internal practices and experiences, the post aims to inspire others to enhance their own DAST configurations and encourages feedback and shared learning within the community.

As the COVID-19 pandemic forced families to adapt to remote learning, a parent shares their experience of using GitLab's all-remote company values as a framework for managing the new challenges of balancing work and children’s educational needs from home. The approach involves applying risk management principles, beginning with identifying and analyzing potential risks by collaborating with family members to address individual educational needs and concerns, such as adapting teaching methods to suit different learning styles. Action plans are developed through iterations to address specific challenges, like internet bandwidth and social well-being, and involve communicating transparently with teachers and employers. Success is monitored through set goals for attendance and assignment completion, and the parent emphasizes the importance of collaboration, transparency, and iteration in refining the approach to remote learning. By integrating these principles, families can create a supportive and flexible learning environment that aligns with their risk tolerance and educational expectations.

GitLab's blog post delves into the challenges of maintaining engineering productivity as a company rapidly expands, particularly through the lens of the Merge Request (MR) Rate. As GitLab grew from 100 to 280 engineers in 1.5 years, it became crucial to continue its momentum by implementing Key Performance Indicators (KPIs) and Performance Indicators (PIs) to monitor productivity. The MR Rate, a primary focus, helps gauge productivity by encouraging smaller, faster-reviewed MRs, ultimately benefiting the product's quality. Despite its simplicity, MR Rate requires nuanced analysis to account for factors like team growth, individual contributions, and community input, which can complicate its effectiveness. GitLab balances using MR Rate as a team, rather than an individual metric, to foster collaboration and avoid non-collaborative behaviors. The company employs strategies such as improving iteration, setting KPIs, and empowering teams to enhance MR Rate while maintaining a healthy work-life balance. GitLab acknowledges the metric's limitations and continuously seeks to refine it, inviting feedback for further improvement.

DevOps is a modern approach to software development that surpasses traditional methods like the waterfall model due to its efficiency and benefits such as faster deployment, improved product quality, and enhanced scalability through automation and continuous delivery. Effective team communication and a solid grasp of DevOps terminology are crucial for success, as new terms and practices frequently emerge in this dynamic field. The text highlights a glossary of DevOps terms, including baklava code, dark launch, and yak shaving, among others, each with unique meanings relevant to the field. Cultivating a DevOps culture requires a concerted effort involving leadership engagement, open communication, and a clear roadmap of goals and responsibilities, emphasizing the importance of understanding new jargon and practices.

GitLab has achieved the status of a Kubernetes Certified Service Provider (KCSP), a program managed by the Cloud Native Computing Foundation (CNCF) and the Linux Foundation, aimed at supporting enterprises in deploying applications within Kubernetes environments. As a KCSP, GitLab offers consulting, training, support, and professional services to help organizations adopt a cloud-native approach, leveraging Kubernetes for operational efficiency and improved developer interactions. The widespread adoption of Kubernetes, highlighted by surveys showing significant use in production environments, has created a demand for expertise in managing containerized applications, which GitLab is positioned to address. With an open core business model, GitLab encourages community contributions and supports enterprises through guidance on GitOps, DevOps, and DevSecOps practices. This milestone underscores GitLab's dedication to supporting Kubernetes and the CNCF community as it helps businesses transition to cloud-native strategies while also providing opportunities for collaboration and innovation in the open-source space.

Over the past decade, the pace of software development has accelerated significantly, with DevOps practices enabling companies to release software updates more frequently, enhancing business value through rapid innovation delivery. However, security practices lagged behind, often acting as a barrier to frequent deployments or merely addressing past issues. To bridge this gap, the adoption of developer-centric application security tooling within the CI pipeline is advocated, ensuring that security vulnerabilities are identified and resolved swiftly before reaching production. This approach aligns engineering and security efforts, allowing developers to address issues independently, reducing fix times by leveraging the context of their current work. Modern teams employ security tests on microservices, enhancing bug detection and empowering developers with the tools to fix issues directly. Key security measures include software composition analysis (SCA), dynamic application security testing (DAST), and secrets detection, which can be integrated into CI pipelines without hindering development progress. The suggested process involves local testing, non-blocking CI instrumentation, bug triage, and eventually shifting to blocking tests, fostering a cultural shift where delivering secure applications becomes integral to quality engineering. This paradigm shift not only enhances application security but also supports the rapid pace of modern software delivery, encouraging collaboration between engineering and security teams.

GitLab's recent updates to its Static Application Security Testing (SAST) capabilities include several key changes aimed at enhancing security, efficiency, and user experience across its platform. The updates make open-source SAST analyzers free for all GitLab users, introduce a new Secret Detection scan type, and simplify configurations by transitioning to a managed CI template. Key changes involve replacing the old SAST secrets-sast job with a new Secret Detection template and removing the use of Docker-in-Docker (DinD) in favor of a more secure, non-DinD approach. Additionally, the transition from the Debian Buster to Alpine Linux for GitLab's Bandit Python Analyzer is set to improve speed and security, while ESLint has replaced the deprecated TSLint for TypeScript analysis, aligning with industry standards. These changes build on prior deprecations and removals, as GitLab continues to modernize its security tools, with the updates scheduled for release on GitLab.com in August and for self-managed customers with GitLab 13.4 in September. Users are encouraged to update their configurations accordingly to maintain compatibility and continue benefiting from these enhancements.

Arctic Engine is an open-source game engine developed in C++ under the MIT license, designed to rekindle the enjoyment of game development reminiscent of the '80s and '90s. The engine emphasizes the importance of testing, highlighting the challenges with traditional methods and the benefits of fuzz testing, particularly with GitLab's integration. Fuzz testing proved efficient in detecting critical issues like signed integer overflow and buffer overruns, transforming the testing process into an automated, time-saving endeavor akin to having a personal QA team. This experience has inspired the developer to expand Arctic Engine's capabilities, including adding a simple HTTP web server and multiplayer network interaction, with renewed enthusiasm and confidence in the code's robustness.

In a cloud-native ecosystem characterized by rapid changes and decentralized microservices development, it is essential to ensure application security throughout the development and operational phases. Utilizing GitLab's Secure and Protect product portfolio can streamline application security by incorporating practices such as DevSecOps and shifting security left into the developer lifecycle. GitLab Secure offers continuous assessment to identify vulnerabilities, while GitLab Protect enhances operational security through context-aware technologies. The text presents a real-world scenario involving a Golang application with input vulnerabilities, demonstrating how GitLab tools like Container Host Security, powered by Falco, and Container Network Security, managed by Cilium, can detect and mitigate security threats. Additionally, a Web Application Firewall using ModSecurity can block attacks at the network level, and Static Application Security Testing (SAST) can identify root vulnerabilities in the code using GitLab CI/CD integration. The article emphasizes the importance of comprehensive security measures and invites readers to a session at GitLab Commit 2020 for further insights into these security practices.

GitLab's approach to software development emphasizes the use of "boring" solutions, which are characterized by simplicity and reliability rather than novelty and complexity. This strategy is rooted in the belief that reducing complexity accelerates innovation and enhances stability, as evidenced by GitLab's track record of rapid and consistent releases. The company advocates for leveraging existing technologies and making incremental changes, such as using issue labels for new functionalities or opting for JSON Web Tokens over developing new interfaces. While sometimes counterintuitive for a tech startup, this method has proven effective in maintaining focus on adding value and ensuring seamless operations, as demonstrated in GitLab's migration from Azure to GCP using a simple checklist. GitLab leaders and team members share examples and anecdotes of how these straightforward solutions have led to successful outcomes, underscoring the principle that "boring" does not equate to ineffective or outdated practices.

Between May and August 2020, the author participated in the Engineering Internship Pilot Program at GitLab, working remotely in the Security department, which provided flexibility and opportunities for global collaboration. The internship encompassed exposure to various security teams, focusing on securing GitLab's products, protecting the company, and assuring customers. The intern gained hands-on experience with Application Security, Security Research, and Security Automation, contributing to security enhancements, bug bounty triage, and vulnerability identification. Additionally, they were involved in developing machine learning algorithms for detecting file obfuscation and secret scanning, improving the security framework. The experience highlighted GitLab’s commitment to collaboration, efficiency, and transparency while offering the intern insights into risk management and compliance, including SOC2 standards. This exposure to different security domains and the integration of machine learning into security practices underscored GitLab’s comprehensive approach to maintaining a robust security posture.

At GitLab, the collaboration between developers and security professionals is emphasized as critical for successful DevSecOps, though challenges remain in fully integrating security into the development process. The text highlights findings from their 2020 Global DevSecOps Survey, where 65% of security professionals felt their organizations had successfully "shifted left" to incorporate security earlier in the development cycle. Despite this positive outlook, issues persist, such as insufficient early bug detection by developers and confusion over responsibility for security. Brendan O'Leary and Ethan Strike of GitLab discuss the importance of a shared security culture and the need for developers to have adequate tools and support to run security tests like SAST and DAST. They stress the necessity for all stakeholders to collaborate, share knowledge, and align incentives to ensure security is part of the development flow, ultimately building a trustworthy product and protecting the company. The conversation underscores the importance of balancing security requirements with business needs and fostering open communication and trust between teams for a successful security integration.

In mid-March, the GitLab Application Security team launched a Capture the Flag (CTF) contest for GitLab team members, providing a hands-on application security experience with beginner-friendly challenges mainly focused on web security. The contest, initially intended for a company-wide event in Prague, was adapted for global online participation due to COVID-19, running from March 16 to March 27, 2020, with 50 participants. The CTF was made accessible for home use via Docker and Docker Compose, with all challenges and solutions available in a CTF-at-home repository. Participants were encouraged to share their experiences and feedback, with notable achievements from team members such as @cat and @ayufan, who solved all challenges in under three days. The event was well-received, fostering collaboration across different functional groups within GitLab, and plans for future CTFs were hinted at, inviting continued engagement through comments or social media.

As organizations grow, incorporating automated security tools into development pipelines becomes increasingly crucial, as indicated by the BSIMM10 study, which shows a low ratio of security personnel to developers. This blog post delves into WebGoat's lessons, examining the challenges and complexities of benchmarking security tools. When comparing security tools, it is important to consider factors like the tool's fit for the organization, the applications used for testing, and the consistency and actionability of results. Tools can vary in their focus, with some designed for developers and others for security teams, impacting their utility based on the organization's needs. Applications used in testing should closely resemble real-world scenarios to ensure accurate assessments, as synthetic examples like WebGoat may not reflect actual application environments. The post highlights potential pitfalls of using WebGoat as a benchmark due to its educational design, which may cause confusion for automated tools. It emphasizes the need for a thorough analysis methodology, noting that tools must be tuned to reduce non-actionable results and account for testing consistency. GitLab's Vulnerability Research Team, using WebGoat version 8.1.0, stresses that while WebGoat is a valuable learning tool, it is not a replacement for benchmarking against real-world applications. The analysis also underscores the importance of using a diverse set of applications to benchmark security tools effectively, ensuring they can handle the complexity of real-world data flows and potential vulnerabilities.

Anton, a Support Engineer at GitLab, reflects on his year-long journey since transitioning from a decade-long career as a full-stack web developer to a support role, a move initially prompted by redundancies at his previous job. Despite initial apprehensions about his ability to succeed in a support role and concerns over missing coding, Anton found the supportive GitLab team and the company's transparency instrumental in easing his transition. This new role allowed him to leverage his previous skills, leading him to develop a browser extension that improved his team's workflow. Over time, Anton became a knowledge specialist in areas like GitLab Geo and Kubernetes, finding fulfillment in solving complex customer issues alongside his colleagues. Recounting a recent call from a recruiter who offered him a Senior PHP Developer position, Anton decided to decline, realizing that his new career at GitLab had not only met but exceeded his expectations, providing him with a meaningful and rewarding work environment that he wouldn't trade for any other opportunity.

GitLab's integration with WhiteSource enhances application security by providing in-depth dependency scanning, actionable insights, and auto-remediation directly within the GitLab UI, thereby improving productivity, security, and compliance for development teams. The integration process involves setting up a GitLab on-prem instance, a WhiteSource account, and a Kubernetes cluster, followed by generating necessary credentials and configurations, building and deploying WhiteSource containers using Helm commands, and incorporating the integration into GitLab's Security Dashboard for comprehensive vulnerability management. Once installed, WhiteSource automatically scans repositories, generates detailed reports on vulnerabilities, and offers solutions, including potential auto-remediation, which can be accessed and managed via GitLab's Security Dashboard, enhancing the overall security posture of applications.

Intellectual property (IP) in the form of code is a vital asset for companies, and GitLab provides a platform to store, manage, and collaborate on this code while ensuring security through various access controls and features. GitLab supports multiple authentication methods like LDAP, SAML, and SSO, allowing users to access only specific projects and groups depending on their roles, which range from Guest to Owner. These roles dictate their permissions within projects, and features like protected branches and tags, push rules, and merge request approvals offer further protection and management of code changes. Additionally, GitLab's tools for assigning code ownership and conducting audit events help in maintaining traceability and compliance, ensuring a secure and collaborative environment for managing IP. Companies like Northwestern Mutual exemplify how GitLab can be used to manage permissions as code, providing a robust framework for safeguarding intellectual property while enabling efficient teamwork.

In response to the difficulty of finding up-to-date local COVID-19 infection rates necessary for school reopening decisions in Minnesota, the author developed a solution using GitLab Pages to automate the calculation and presentation of this data. Initially, the author manually calculated the infection rates per 10,000 residents, but soon created a Kotlin script automated with GitLab CI/CD pipelines to download data, calculate the rates, and publish the results on a static website using d3.js for graphing. By scheduling these processes to run multiple times a day, the author ensured the availability of the most recent COVID-19 statistics for personal use and community benefit, providing a valuable resource for gauging local pandemic conditions.

In response to evolving security threats, GitLab announced a significant policy change regarding Multi-Factor Authentication (MFA) resets for free accounts, effective August 15, 2020. Users are now responsible for maintaining their account security, as GitLab Support will no longer process MFA reset requests for free accounts. Users are encouraged to generate and securely store recovery codes, use hardware tokens, and add SSH keys to prevent account irrecoverability. The policy for paid accounts remains unchanged, allowing for MFA resets after passing security verifications. GitLab invites community feedback and suggestions for feature improvements, highlighting ongoing discussions about phone numbers as recovery methods and encouraging collaboration through merge requests and feature proposals.

Eric Rosenberg, a support engineer at GitLab, shares his experiences from a four-week security internship aimed at implementing security scanners on open-source projects hosted on GitLab. Throughout the internship, Eric focused on integrating GitLab Secure features to enhance project security and raise awareness of GitLab's security offerings, while also providing valuable feedback to improve the product. His initiative involved engaging with project maintainers, particularly with a project called ASE, to demonstrate the ease of incorporating security measures into their pipelines. Eric's hands-on experience with the Static Application Security Testing (SAST) scanner helped him identify vulnerabilities and understand the intricacies of interpreting security reports, including the challenges of discerning false negatives. Despite wishing for more time to work with additional projects, Eric appreciated the flexibility GitLab provided and expressed optimism about future opportunities for team members to engage with security roles. His overall positive experience underscored the importance of effective communication and mentorship, and he looks forward to applying his newfound knowledge to benefit others in the GitLab community.

GitLab has been recognized as a 'Visionary' by Gartner in the 2020 Magic Quadrant for Enterprise Agile Planning Tools, highlighting its innovative contributions despite being relatively new in the field. The company is committed to enhancing its single-application approach by focusing on improving Agile planning experiences, which are crucial for modern businesses to adapt rapidly and deliver continuously. GitLab's recent updates include enhanced features for work planning and management, a new requirements management feature, and an improved Jira import process to facilitate transitions to GitLab workflows. The company emphasizes visibility and value stream management by developing customizable analytics and dashboards, aiming to identify inefficiencies and enable actionable insights within the DevOps lifecycle. GitLab values user feedback and has made its maturity plan and product vision publicly accessible for community engagement to guide its future developments in enterprise Agile planning.

GitLab is enhancing its alert and incident management capabilities to streamline the process of responding to IT incidents, aiming to reduce the manual and stressful nature of current incident response practices. By centralizing alert management within GitLab, which is already a comprehensive tool for the DevOps lifecycle, users can manage alerts, delegate responsibilities, and investigate metrics all in one place, thereby improving the speed and efficiency of incident remediation. As part of its ongoing development, GitLab plans to introduce features such as embedded logs, linked runbooks, and a custom integration builder to further enhance its capabilities. The initiative, driven by the Health group within GitLab's Monitor stage, encourages community feedback and contributions to refine and expand these tools, ensuring they meet user needs effectively.

GitLab Pages enables users to create and host project websites from their GitLab accounts, utilizing either GitLab.com or self-managed instances. The service has evolved from relying on an NFS shared mount and a config.json file for loading website content and configurations to an API-based configuration system introduced in GitLab 12.10. This shift significantly reduced the startup time for the Pages daemon from approximately 25 minutes to about one minute, enhancing efficiency by caching configurations in memory and serving content through an internal API endpoint. Despite this improvement, GitLab Pages still serves content from the NFS shared mount, but plans are underway to transition to object storage, which will support future Kubernetes deployment. The API-based configuration has been rolled out on GitLab.com and is being prepared for self-managed instances, with ongoing efforts to further streamline the process and remove NFS dependencies entirely. Users can enable the API-based configuration by following a guide provided by GitLab, and ongoing updates continue to evolve the platform's capabilities and infrastructure to improve performance and scalability.