September 2023 Summaries

Semgrep Supply Chain is an open-source dependency scanner designed to minimize false positives by employing reachability analysis, which has been well-received by the security community since its launch. It notably helped companies like Thinkific reduce false positives by over 85%. Recently, it expanded support to include C# in beta and PHP for lockfile-only, with C# users gaining the ability to scan for vulnerabilities in dependencies. The integration with NuGet, a package manager featuring over 370,000 packages and receiving about 3 million weekly downloads, enhances security and compliance for developers in the C# and .NET ecosystem. Unlike most SCA tools, which only flag the use of vulnerable libraries, Semgrep Supply Chain identifies vulnerabilities that are actually reachable, meaning the application uses a vulnerable method within a library. In addition to dependency scanning, the Semgrep platform also offers Semgrep Code, a static analysis security testing (SAST) tool, and Semgrep Secrets for scanning accidentally committed secrets, both available for free trial.

Transitioning from a Waterfall methodology in the Canadian Public Service to a role at Microsoft involving DevSecOps, the author recounts their journey of rapidly learning DevOps and DevSecOps through practical application and live coding on platforms like Twitch. This learning curve included both failures and successes, such as dealing with false positives during live presentations and struggling with tool implementations. Over time, the author gained expertise by assisting clients at IANS Research with Azure and AppSec issues and by coaching companies to develop their DevSecOps programs. Through continuous learning from conference talks, articles, and hands-on experience, the author gathered insights into common pitfalls in DevSecOps. This led to a conference talk and blog series discussing 15 'worst practices' to avoid, aiming to help others navigate the complexities of DevSecOps effectively by learning from past mistakes.

Secrets play a crucial role in computer authentication, allowing systems to verify identities through passwords, API keys, certificates, and connection strings, while emphasizing the importance of proper management to prevent unauthorized access. The text highlights the risks associated with embedding secrets in code, as they can be exploited by unauthorized users, and discusses the use of secret scanners to detect such vulnerabilities. It advises the use of secret management tools, which securely store and manage secrets, allowing systems to access them programmatically without human intervention. The implementation of pre-commit hooks is recommended to prevent secrets from being committed to code repositories, thus avoiding potential security breaches. The text also suggests that cleaning up exposed secrets is a labor-intensive but essential task to mitigate risks, making it a suitable job for less experienced team members who can benefit from the experience.

In the realm of software development, transitive dependencies—those dependencies of a project's direct dependencies—pose significant challenges due to their complex and often obscured nature. The 2020 GitHub Octoverse report highlights the extent of this issue, revealing that a JavaScript project with 10 direct dependencies can have an average of 683 total dependencies. These dependencies can introduce supply chain vulnerabilities akin to those in manufacturing, where a defect in one part can disrupt the entire operation. While direct dependencies are typically chosen after careful scrutiny, transitive ones often escape detailed evaluation, making them prime targets for malicious attacks. Version conflicts, licensing issues, and legal challenges further complicate the management of transitive dependencies. Despite the risks, not all vulnerabilities are immediately exploitable, and security engineers must prioritize their efforts, often relying on tools like static and dynamic analysis to determine which parts of a codebase are truly at risk. Ultimately, the challenge lies in effectively managing these vulnerabilities within the constraints of time and resources, ensuring the most critical threats are addressed promptly while balancing the need for comprehensive security.

The API security market has rapidly expanded since 2021, offering a wide array of tools, which can be overwhelming for those responsible for software security within organizations. Key considerations in selecting an appropriate API security tool include the specific needs of an organization's application security program, the level of developer engagement, the software development lifecycle (SDLC) methodology, and the types of applications being developed. Tools that support the OpenAPI/Swagger protocol are emphasized, as they provide more options compared to those using SOAP. Common features of API security tools include API inventory, fuzzing or dynamic testing, web application firewalls, and API gateways, which are crucial for authentication, authorization, and bot defense. The importance of understanding the "context" feature, static analysis, API linters, and using API-specific dynamic testing tools is highlighted, as they can identify vulnerabilities and ensure code quality. It is recommended to continue using existing software composition analysis tools for APIs and consider factors such as concerns and functionalities before conducting a proof of concept exercise to select the most suitable tool.