April 2017 Summaries

Serverless Security at Serverless Conf` The speaker presented on the importance of security in a serverless world, highlighting that it is a fundamental evolution of cloud computing and that best practices and tooling are being formed as they speak. The need for making security a core part of these practices was emphasized, with the speaker suggesting that security is not discussed nearly enough. The presentation focused on where serverless helps security and where it hurts, as well as what areas still require protection. The speaker also expressed gratitude to the team at A Cloud Guru for organizing ServerlessConf, which provided an opportunity to discuss serverless security. The talk's video and slides are available online, offering further insights into how serverless impacts security.

Serverless fundamentally addresses some of today's biggest security concerns by shifting the responsibility from application owners to platform providers, thereby eliminating infrastructure management-related vulnerabilities such as unpatched servers and vulnerable binaries. However, it also amplifies other security concerns, including the increased attack surface created by greater flexibility, making security monitoring more challenging due to the lack of traditional server-based monitoring solutions. Additionally, Serverless does not alleviate the need for secure coding practices, vulnerability management, and data protection, which are still critical in FaaS environments. Overall, Serverless introduces a new set of security challenges that require developers and platform providers to adapt their priorities and strategies accordingly.

Snyk has announced support for Java, expanding its existing support for Ruby and Node.js, and is shipping Java support for both the CLI and GitHub integration, allowing users to easily test their Maven repositories for vulnerable dependencies and receive alerts if a vulnerability is found. Snyk's Java integration is free for open source projects, and users can celebrate their newfound security by adding a GitHub badge. The company plans to add support for Gradle projects with a workaround in the future, and is working on adding support for Python and .net, with more languages to follow.

To do security well, you must continuously secure all apps. This is where Snyk's new pricing model comes in, which revolves around how often you run a test to find out if an application is vulnerable. Tests will be part of your GitHub workflow or invoked via the CLI, helping keep new vulnerable dependencies out. You'll get 100 tests in the free tier each month, with a quota that resets every month. Snyk remains free for Open Source projects and has simplified its setup process to protect more repos and scale better. The UI has also been upgraded for an easy onboarding experience.