April 2020 Summaries

Snyk has introduced the first phase of its Shared Policies initiative, enabling organizations to create customizable rule sets for managing license compliance across their development projects. This feature, beginning with License policies, allows group-level administrators to set and apply policies to multiple organizations, enhancing scalability and efficiency in open-source license compliance. The new system simplifies license management by consolidating numerous policies into fewer, more manageable ones, with changes automatically applied to all associated projects. Snyk has also implemented a default policy that can be adjusted to meet specific needs, serving as a baseline for new organizations. Looking ahead, Snyk plans to extend its policy capabilities to include security, dependency, and container policies, as well as support for project-level policy application through tags, promising a more granular control over compliance management.

The is-promise incident highlights the importance of proper testing, especially end-to-end package testing, to catch breaking changes before releasing them. The maintainer's swift response and post-mortem analysis demonstrate responsible maintenance practices. The incident also emphasizes the significance of semantic versioning, as adding support for ES Modules required a breaking change that was published as a minor update. Additionally, using Node.js LTS versions can help avoid issues caused by bleeding-edge versions, while holding back on swift upgrades is recommended to prevent similar problems. Lockfiles and package-lock.json files are not directly relevant in this case, but understanding how they work can be useful for dependency management.

Open source software is often misunderstood, with several common myths surrounding its security. One misconception is that it's free, but licensing allows the true owner of the code to know who's using it and when changes are available. Despite concerns about security, open source has benefits such as rapid development, ease of deployment, and a community base for problem resolution. However, some myths persist, including that open source programs are less secure than proprietary software, that open source code integrity is questionable, and that open source is just a fad with security being an afterthought. In reality, the transparency provided by open source allows for thorough examinations of code, and many developers review and improve open source projects continuously. With cautious selection and evaluation, organizations can manage open source security risks and promote application security.

To successfully implement developer-first license compliance, it is essential to empower developers to make the right decisions with the right tools and governance in place. This involves providing context on license issues, automating license testing throughout the development lifecycle, and fostering a relationship between developers and compliance teams. By doing so, organizations can minimize risk while maximizing developer productivity and autonomy.

The COVID-19 pandemic presented significant challenges to Snyk's community, including travel restrictions and conference cancellations. In response, the company's Developer Relations team came up with an innovative idea - a community-led charity conference that would deliver education and content despite these limitations. With the support of AllTheTalks.org, the conference was held on April 15th, 2020, and provided valuable content to over 11,000 attendees. The event raised $100,000 for the World Health Organization and was sponsored by over 30 organizations. Additionally, Snyk's CEO and President partnered with their personal funds to donate $1 million to various charities, while the company also launched a donation matching program for employees. These efforts demonstrate Snyk's commitment to supporting its community during the pandemic.

It's always a good idea to check for security issues in code that you review. Code reviews are hard to do well, particularly when you're not entirely sure about the errors you should be looking for. The DevSecOps approach pushes security testing left so that vulnerabilities can be found and fixed earlier, in the design, development, or CI/CD stages of the workflow. To help with code reviews, there's a handy checklist to give pointers for your next code reviews. Be sure when reviewing code to understand what lies behind the code you're reviewing and thus the data and assets you are trying to protect. This working knowledge isn't easy to add into a checklist, but using the tips in this cheatsheet alongside your domain knowledge will assist you in deciding where you should spend more of your time and where you should expect higher risk and different types of attacks. Sanitize and validate all input, as modern web applications have to interact with third-party input that can be unexpected. Never store secrets as code/config, as it's easy for this code to make its way into the repository because developers forgot to remove it. Test for new security vulnerabilities introduced by third-party open source dependencies, as attackers target these more and more. Enforce secure authentication, including password complexity, re-authentication before sensitive operations, and TLS client authentication. Enforce the least privilege principle, which means giving users or processes only the information and resources they need to perform their legitimate purpose. Handle sensitive data with care, by looking closely at your application's design, determining if you really need the data, not exposing it, storing it properly, and protecting against well-known attacks like XSS and SQL injection. Finally, statically test your source code automatically using a SAST tool like Snyk Code to find security-related bugs in your source code.

Snyk Container is now certified for use with VMware PKS, offering integration with Enterprise PKS clusters to monitor for vulnerabilities in container images and configurations, detect issues in containers during development and production, provide developer-friendly fix guidance, address vulnerabilities in open source dependencies with automated remediation, and offer a free sign-up process with instructions on integrating Snyk with PKS clusters.

Snyk has launched a responsible vulnerability disclosure program to support the open source community in keeping their software secure. The company aims to bridge the gap between researchers and maintainers by engaging in an open, mutual discussion from start to finish, taking into account both perspectives and factors such as package context, severity, and probability of exploitation. Snyk provides periodic updates to the person who has initially reported a vulnerability and credits them for their valuable finding. The company has responsibly disclosed 88 vulnerabilities so far, including a recent large-scale disclosure with Johns Hopkins University, which used a novel concept called Object Property Graph (OPG) to automate the finding of vulnerabilities. Snyk provides a dedicated disclosure form and email address (`[email protected]`) for researchers to submit vulnerability reports, which are then triaged, verified, and disclosed responsibly.

Snyk has released a new Kubernetes configuration security feature that integrates with source code managers to detect security issues in YAML, JSON, and Helm charts. The feature aims to make it easier for developers to handle security issues independently by highlighting problems directly in the context of their configuration files and providing explanations for recommended fixes. This feature is available on both free and paid Snyk plans and does not require a paid plan to use, with the goal of rolling out full availability within a week. The feature works across different Kubernetes environments and supports various file types, including YAML generators. It also provides customizable risk categorization settings and explanations for issues detected.

Snyk has announced two major pieces of news to take its ability to reach and service AWS customers to the next level, including achieving the AWS DevOps competency designation and making its products available on the AWS Marketplace. Snyk's strong product integrations into AWS DevOps, serverless, and container solutions have led to this designation, which showcases the company's technical proficiency and customer success in these areas. The AWS DevOps Competency badge gives customers and partners a high degree of confidence in choosing partner solutions from the tens of thousands available throughout the APN. Additionally, Snyk's products are now available for purchase through the AWS Marketplace, making developer-first security more accessible and easier to achieve for AWS customers. This move simplifies payment terms and supplier management for customers, offering a convenient way to discover and purchase trusted software from reputable vendors like Snyk.

It's a common misconception that making a vulnerability public immediately is the responsible thing to do. Instead, responsible vulnerability disclosure involves privately disclosing 0-day vulnerabilities to allow maintainers time to issue a fix or patch before making it public. This balance between minimizing private and public exposure is key. Many software companies have official disclosure policies in place, but open source packages often lack them, leading to challenges in following a responsible disclosure process. However, by following a proper vulnerability disclosure process, maintainers can triage the issue without urgency, assign fixes, and disclose publicly once the release is ready, ensuring the vulnerability cannot be abused negatively. Snyk has established a vulnerability disclosure program to bridge this gap, providing a secure way for researchers to report vulnerabilities and work with maintainers to get them fixed.

The author created a full CI/CD pipeline for a VS Code extension using GitHub Actions, allowing them to automate testing, releasing, and publishing their extension with automatic release notes generation based on Angular Commit Message Conventions. They used the vsce tool for publishing and utilized semantic-release for automating version management and release note generation. The pipeline runs tests on Mac, Windows, and Linux, creates a new GitHub release with proper release notes, and publishes the new version to Visual Studio's marketplace upon pushing a new commit to the master branch.

The Vuln Cost extension for Visual Studio Code (VS Code) is a free, open-source tool that helps JavaScript developers identify and address security vulnerabilities in their code. By integrating with the VS Code editor, it provides instant feedback on potential security issues in imported packages, allowing developers to take swift action to secure their projects. The extension also supports scanning of HTML files, including scripts from content delivery networks (CDNs), ensuring developers are not caught off guard by vulnerabilities. With its easy-to-use interface and free functionality, Vuln Cost helps developers adopt a more proactive approach to security, offering actionable insights and recommendations for fixing issues, including package upgrade advice to fix vulnerabilities.

Snyk is partnering with Atlassian to sponsor the Atlassian Remote Summit and promote a limited-time Bitbucket Cloud offer that includes free unlimited Snyk tests for public and private Git repositories and container images hosted on Bitbucket Cloud. This promotion, available through June 30th, also bundles other developer tools such as AWS and Sentry. The partnership aims to help developers build and ship applications faster and more securely by integrating Snyk's security scanning capabilities with Atlassian's Bitbucket Cloud platform. With this integration, developers can quickly identify and fix security vulnerabilities at different points of their CI/CD workflow, preventing issues after the fact and ensuring a safer development experience.