August 2020 Summaries

Snyk and Trend Micro are collaborating on a new solution to help security teams manage open source development risks, bridging the gap between DevOps and security operations teams by providing visibility into open source code vulnerabilities. The new solution will give security operations teams more visibility into the shift-left movement, allowing them to view open source risk in real-time, and enabling developers and security operations teams to work closer together. With over 90% of organizations using open source software, but often lacking controls or insights into open source vulnerabilities, this partnership aims to address these blind spots by providing scanning capabilities and reporting to sec operations teams.

The Snyk research team has uncovered malicious behavior in a popular Advertising SDK used by over 1,200 apps in the AppStore, which represent over 300 Million downloads per month. The malicious code, found in iOS versions of the SDK from Mintegral, dating back to July 2019, can spy on user activity and log URL-based requests made through the app, potentially exposing personally identifiable information (PII) and other sensitive data. The SDK fraudulently reports user clicks on ads, stealing potential revenue from competing ad networks and, in some cases, the developer/publisher of the application. Additionally, the SDK captures details of every URL-based request made from within the compromised application, sending this information to a remote logging server. This functionality has raised concerns over data privacy and the potential for Mintegral to monetize such data by selling it to other parties for purposes of data analytics. The malicious code was designed to avoid detection by Apple's app review process, using anti-tampering controls and custom proprietary encoding techniques.

This summary provides an overview of the article "Reachable vulnerabilities: how to effectively prioritize open source security" from Snyk. The article discusses the problem of managing third-party dependencies and their associated vulnerabilities, particularly when dealing with large enterprise applications. It highlights the importance of identifying reachable vulnerabilities, which are those that can be exploited by an attacker, as a way to prioritize fixing vulnerabilities. The article explains how Snyk uses expert security research and automated static analysis to identify reachable vulnerabilities. The discussion then delves into the challenges of creating call graphs for modern programming languages, including dynamic dispatch, control flow statements, and other complexities. Finally, the article concludes that while the output of such analysis is an approximation of reality, it provides a useful starting point for developers trying to tackle their security problems.

Career growth in a scale-up world is marked by the need to continuously give away parts of one's role to free up focus on newer challenges, as opposed to feeling under-appreciated despite hard work. This intentional embrace of change allows for growth to occur. In a scale-up environment, opportunities for growth are abundant, but require security, trust, and a willingness to take risks. To make the most of these opportunities, individuals must be willing to "give away their legos" and continually challenge themselves with new experiences and skills. This mindset is crucial for career growth in scale-ups, where the stakes are high and alternatives are few.

Snyk has been recognized with four Best Place to Work awards by Comparably, highlighting its strong culture and commitment to diversity, women's empowerment, leadership development, and employee growth. The company's CEO is praised for creating a unity between employees driving communication and collaboration, while the leadership team is commended for their transparency, support, and prioritization of personal wellbeing. Snyk's emphasis on professional development, including regular feedback, talent review programs, and paid platforms for learning and growth, has also been recognized as a key factor in its success. The company attributes its achievements to the dedication and enthusiasm of its employees, who are encouraged to learn and grow in a safe and accepting culture.

In a simple Spring Boot application, dependencies play a significant role in occupying a large space in the application, with some dependencies containing hundreds of thousands of lines of code. Analyzing the dependency tree reveals that even a small number of dependencies can have a substantial impact on the overall size and complexity of the application. To mitigate this issue, it is essential to implement a robust Java dependency management strategy, including tools like Snyk for vulnerability scanning and detection, to ensure the maintainability, scalability, predictability, and safety of the application. By taking care of dependencies, developers can reduce the risk of security vulnerabilities and improve the overall quality of their codebase.

Angular security best practices prioritize the use of interpolation ({{ }}) for safe encoding, avoiding concatenation of user input in templates, and using Angular's APIs to interact with HTML elements instead of native DOM APIs. The "Angular way" safeguards against Cross-site Scripting (XSS) vulnerabilities by default, while scanning open-source dependencies and components for security vulnerabilities is also crucial. Using tools like Snyk can help identify and fix potential issues in Angular projects, ensuring a secure web application.

Snyk has introduced a Priority Score feature to help prioritize vulnerabilities in Kubernetes deployments, making it easier for developers to identify and fix the most important issues first. The new feature takes into account configuration information and detailed vulnerability data to calculate a score that reflects the risk associated with each vulnerability. This allows developers to make informed decisions about which vulnerabilities to address first, based on their specific context and configuration. By using the Priority Score, developers can reduce the complexity of prioritizing vulnerabilities and focus on addressing the most critical issues in their systems.

The Snyk security badge provides instant security information for open source libraries, giving users better visibility into potential vulnerabilities and their severity levels. This badge can be generated for JavaScript, Java, and Python packages and is displayed on a website with a link to detailed security information. The badge score ranges from A (highest) to F (lowest) based on the number of vulnerabilities and their severity, with scores updated daily.

CRN has named Snyk as one of its 2020 Emerging Vendors in the Security category, recognizing the company's innovative solutions and dedication to driving growth in the IT channel. This honor is part of CRN's annual list that highlights pioneering technology suppliers who are shaping the future success of the channel with their commitment to innovation. By being selected for this list, Snyk acknowledges its focus on bringing developer-first security to every software-driven business, enabling partners to help their customers secure and scale application development in a rapidly changing digital landscape.