January 2021 Summaries

The OWASP Cheat Sheet Series is a highly regarded project offering detailed information on various security issues, serving as both a reference and educational tool. This series includes cheat sheets developed to identify potential cross-site scripting (XSS) vulnerabilities in code, providing recommendations that guide developers toward safer coding practices. By adhering to these guidelines, developers can significantly reduce the risk of XSS in their applications. Each cheat sheet offers an executable command to scan code for XSS issues, focusing initially on popular web frameworks such as Django, Flask, Java/JSP, and Ruby on Rails. The series encourages contributions to community resources like the semgrep-rules repository, and further cheat sheets are anticipated to follow.

r2c was honored with the "Disruptive Innovator" award at the Forbes Cybersecurity Awards 2020, recognized alongside notable entities like Corellium, Greynoise, and Maria Markstedter. The company, backed by Sequoia Capital and Redpoint Ventures, is celebrated for its creation of Semgrep, a static source code analyzer designed to assist app developers in identifying vulnerabilities in their tools through a user-friendly platform. Highlighting the technical expertise behind r2c, two of its three cofounders previously worked at Palantir, underscoring the company's strong technical foundation.

Jacob Kaplan-Moss, co-creator of Django, discusses the frequent disconnect between engineering and security teams in software development, emphasizing the importance of integrating security practices into continuous integration and continuous delivery (CI/CD) pipelines. He outlines a maturity model for collaboration between these teams, starting with basic problem identification and moving towards proactive discovery and systemic fixes. By embedding security tests into the CI pipeline, teams can maintain delivery speed while ensuring product security, fostering a collaborative environment rather than one of conflict. Kaplan-Moss illustrates this with a case study on addressing issues related to logging sensitive tokens, advocating for tools like Semgrep to automate the detection of security vulnerabilities across codebases. This approach not only addresses specific vulnerabilities but also helps in developing systemic solutions to prevent future issues, enabling security teams to shift from a reactive to a proactive stance in securing software.