March 2019 Summaries

**Package lock JSON and lock files are used to pin down versions of dependencies for a project, ensuring reproducible builds and avoiding potential issues with different versions being installed. Lock files serve as a rich manifest of dependencies, including metadata such as version numbers, integrity hashes, and registry locations. Both npm's `package-lock.json` and Yarn's `_yarn.lock` are used to manage dependencies, but they differ in how they handle transient dependencies and shrinkwrap files. Using lock files ensures that installations remain identical and reproducible throughout the entire dependency tree, across users and systems.

Regular expression denial of service (ReDoS) is a type of Denial of Service attack that can occur when regular expressions are used in a way that causes the regex engine to take an excessive amount of time to process, resulting in catastrophic backtracking. This vulnerability was recently found to have increased by 143% in the last year alone, according to a recent state of open source security report. A ReDoS attack can be triggered when an attacker passes a string that causes the regex engine to backtrack throughout all possibilities before failing, resulting in a denial of service. The ms package is vulnerable to this type of attack, and exploiting it can cause a significant delay or even bring the system down.

The Linux Foundation has launched CommunityBridge, a new funding and innovation platform designed to empower open source developers by providing access to capital, enhancing security, and accelerating project progress. Snyk is integrated into CommunityBridge, enabling automatic dependency scanning and security measurements for all projects, ensuring transparency and reassurance for potential supporters. This partnership demonstrates Snyk's commitment to supporting the open source community, with ongoing investments in research and education initiatives to improve security in open source development.

The Security Transformation track at QCon London focused on discussing how security should change to match digital transformation and dev/ops practices. The topic is often overlooked in discussions about digital transformation, but it's essential for evolving developer security practices. The speaker covered three aspects of DevSecOps: security technologies, methodologies, and the shared ownership philosophy. The conference was well-attended, with strong interest from developers who want to learn more about security and improve their own practices. QCon London is a great platform for in-depth discussions on complex topics like security transformation.

Snyk celebrates International Women’s Day by highlighting the contributions of women in their company, promoting diversity and inclusion efforts, and inviting the community to an event featuring top role models. The company values its female employees, who hold various positions, including leadership roles, and are proud of their achievements. Snyk is actively working to close the gender gap in their team, with statistics showing 35% of employees are women, but management and development teams have lower representation. The company invites those interested in joining their team to check out job postings and apply, offering a positive culture and useful product.

The top ten Docker images contain over 8,000 vulnerable paths, indicating a significant security risk for users of these images. A study found that 68% of developers feel they should own the security responsibility of their Docker container images, but only 15.5% actually test them for vulnerabilities during development. The study also revealed that there is a disconnect between who owns security and how it is practiced, with many developers owning security but not actively practicing it. The most vulnerable image was the Node image, which introduced an average of 14 vulnerabilities for every 10 dependencies added. However, most vulnerabilities were rated as low severity, accounting for 74.9% of all observed vulnerabilities, making it easier for users to prioritize and remediate them. To mitigate this risk, using minimal base images that bundle only necessary system tools and libraries can help minimize the attack surface and ensure a more secure container. Snyk's tools can also help developers find and automatically fix vulnerabilities in container images and Kubernetes workloads.

Docker container security is crucial to prevent vulnerabilities and ensure the integrity of Docker images. Key best practices include using minimal base images, least privileged user accounts, signing and verifying images to mitigate MITM attacks, finding and fixing open source vulnerabilities, not leaking sensitive information to Docker images, using fixed tags for immutability, and employing multi-stage builds for small and secure Docker images. Additionally, using a linter such as hadolint can help detect common mistakes and establish best practice guidelines for Dockerfile security issues. By following these practices, developers can build secure and reliable Docker containers that protect against various security threats.

Snyk now integrates with Bitbucket Pipes, allowing users to secure their continuous integration/continuous delivery (CI/CD) workflow by finding and fixing open-source vulnerabilities in their application or Docker image dependencies. With the integration, Snyk scans dependencies for vulnerabilities as part of the CI/CD workflow, gates the process according to configuration, and includes a patch module to fix vulnerabilities. The Snyk pipe also monitors deployed code for new vulnerabilities and notifies users when new relevant vulnerabilities are discovered. Additionally, Snyk offers Docker image scanning, allowing users to test for vulnerabilities in their Docker images. The integration provides a comprehensive security interface across the development workflow, including source code management, pipeline, and deployment phases.