September 2019 Summaries

The Secure Developer: talking DevSecOps in Azure with Microsoft’s Victoria Almazova` is a community platform launched by Snyk in February 2019, focusing on security best practices for developers through expert-led virtual sessions and discussions. The platform aims to help developers adopt a security mindset throughout their development process. Recent virtual sessions have covered topics such as microservice security and OWASP top 10 proactive controls, with experts like Victoria Almazova, a Cloud Solution Architect with Microsoft, sharing her expertise on implementing Azure security, developing secure applications, and securely deploying applications. Victoria emphasized the importance of integrating security into DevOps, starting with infrastructure management, using Infrastructure as Code, and following a Continuous Integration/Continuous Delivery pipeline, which intersects with various stages including pre-commit, commit, acceptance, production, and operations. The platform encourages developers to join the community to learn from experts like Victoria Almazova and improve their security posture.

A security vulnerability was discovered in the npm lockfile system, which can be exploited to inject malicious modules into packages. The author of the article created a pull request with a malicious package that was easily missed by project owners due to its innocuous name and version. The lockfile generated by npm was not thoroughly reviewed, allowing the malicious code to be injected into the package. This vulnerability highlights the need for careful review of lockfile changes, especially for libraries, where the risk is lower. To mitigate this issue, best practices such as using a linter like lockfile-lint and validating resources served over HTTPS from trusted sources can help reduce the risk of lockfile injection attacks.

As the Senior Manager of Product Security at Auth0, Marcin Hoppe empowers his security team to collaborate with engineering to ensure secure code deployment throughout the organization. His approach demonstrates modern leadership by building bridges with engineering, management, and beyond. Marcin focuses on empowering developers to incorporate security into their workflows through automation and easily repeatable processes. He measures security progress across teams and tracks vulnerabilities resolved each month, improving the organization's security posture over time. DevSecOps is a natural extension of the DevOps revolution, breaking down barriers between development, operations, and QA, as well as infosec and the rest of the enterprise. Scaling security requires measurement, staffing, automation, and collaboration between teams. Marcin emphasizes empathy, open communication, and starting early to integrate security into development processes. In the next five to 10 years, organizations will face challenges such as keeping up with new trends in software development, evolving threat landscapes, and supply chain risks. If he could change anything about the way security is handled today, Marcin would treat security as a quality attribute evaluated from the start, alongside reliability, performance, and user experience.

This Java security best practices cheat sheet provides 10 essential tips for developers to prevent common Java security vulnerabilities, including query parameterization, using OpenID Connect with 2FA, scanning dependencies for known vulnerabilities, handling sensitive data with care, sanitizing all input, configuring XML parsers to prevent XXE attacks, avoiding Java serialization, using strong encryption and hashing algorithms, enabling the Java Security Manager, and centralizing logging and monitoring.

Snyk, a developer-first security company, has raised $70 million in funding led by Accel and existing investors GV and Boldstart Ventures to accelerate its growth and leadership in the dev-first security market. The new investment will be used to further product development, expand global resources, and invest in community building. Snyk's unique value proposition of providing a developer-first approach to security has resonated with investors, who recognize the company's potential for growth and success. With hundreds of thousands of developers using its solutions, Snyk has reached major milestones, including expanding its global user community to over 300,000 developers worldwide. The company attributes its success to an amazing team, engaged customers, and a strong partnership with other security players.

As a software company, Snyk is taking steps to reduce its carbon footprint by partnering with One Tree Planted and planting trees for every new user who signs up. In addition to tree-planting efforts, the company aims to make well-considered decisions about business practices such as using green cloud providers like Google Cloud Platform and reducing international travel through remote-only workshops. Snyk also encourages employees to adopt environmentally friendly habits at home, such as bringing their own devices or reducing unnecessary purchases. The goal is not only to offset emissions but also to promote a culture of sustainability within the company. By taking these small actions, individuals can contribute to making climate-positive changes in their daily lives and workplaces.

Jest, a popular JavaScript testing framework, offers customization options for handling assertion errors when tests fail. This feature is often underutilized but can improve test readability and debugging experience. When a developer makes changes to the code, it may cause a test to fail without providing clear information about what broke. The `toHaveProperty()` function from Jest can help with this by highlighting missing properties in the error message. However, even with this feature, the error messages can be cryptic and difficult to interpret. Refactoring the test code to make it more explicit and intuitive can improve its readability and effectiveness. By using clear variable names, concise conditionals, and descriptive comments, developers can create tests that are easier to understand and debug, even when multiple validators are used. This approach can lead to a better debugging experience for both developers and testers.