February 2021 Summaries

At the Jenkins Online Meetup on February 10th, a presentation was given on Semgrep, an open-source static analysis tool that supports more than 12 programming languages and facilitates the creation of custom rules for organization-specific code patterns. The session demonstrated how to integrate Semgrep into a Jenkins Pipeline to enable scanning of every commit or pull request. The presentation was accompanied by a video and downloadable slides for further reference.

The text discusses the challenges of applying static analysis tools to software development, particularly the use of non-cryptographically secure functions like random() and the disconnect between theoretical accuracy and practical impact. It introduces the concept of "Fix Rate" as a new metric for evaluating the effectiveness of static analysis tools like Semgrep, which measures the percentage of merge-blocking findings that are fixed rather than muted in continuous integration (CI) processes. The text highlights the experience of r2c and Figma in using Fix Rate to refine security rules and practices, emphasizing the importance of real-world developer feedback in determining the efficacy of static analysis. The integration with platforms like GitHub is noted for bringing security analysis directly into the development workflow, allowing for rapid iteration and deployment of security rules.

At Snowflake, the rapid growth of the company necessitated a shift from a centralized, ad-hoc security review process to a more scalable and distributed model. Initially, security reviews were handled informally, leading to significant backlogs and delays. The solution involved integrating security into the software development process by empowering software engineers to take ownership of security through the introduction of Security Partners, who are engineers trained to handle security within their teams. This decentralized approach aimed to make teams more autonomous and reduced the reliance on the central security team. Despite initial successes, challenges persisted, such as inconsistencies in threat modeling and increased time spent on security assessments. To address this, a risk assessment process was developed to categorize projects by risk level, allowing low-risk projects to bypass extensive threat modeling, thereby streamlining the security review process. The company also focused on improving tools and processes, emphasizing the importance of collaboration between security engineers and software engineers. The ongoing effort is to make security reviews efficient and to embed security considerations early in project planning, ensuring that the process supports the business's growth without becoming a bottleneck.