January 2021 Summaries

Snyk, a company that provides software security solutions, looks back on 2020 as a challenging year but also one of significant growth and accomplishment, including fixing over 4.5 million vulnerabilities and launching two new products. The company has raised over $350M in funding and completed two strategic acquisitions to further expand its platform and capabilities. With a strong team in place, Snyk is poised to lead the growing cloud native application security market in 2021, with a focus on resilience, boldness, and becoming a market force through collective effort.

Docker for Node.js developers is crucial to ensure security and production-readiness, as naive approaches can lead to many security risks. To make Docker a secure choice, it's essential to choose the right Node.js Docker base image, scan your Docker image during development, fix runtime vulnerabilities in your Docker images, monitor deployed Docker images for your Node.js applications, and follow security guidelines and production-grade recommendations for a secure and optimal Docker image. By following these steps, developers can create secure and performant Docker base images that minimize the risk of security vulnerabilities and ensure the reliability and performance of their web applications.

Typosquatting attacks involve malicious actors pushing fake packages with similar names to popular ones in public software registries, such as npm or PyPI, with the goal of tricking users into installing them. These attacks are common and can be difficult to countermeasure against due to their low barrier of entry. A notable example is the crossenv package, which was published on npm with a similar name to a popular package, but actually captured environment variables and sent them to an attacker-controlled remote server. The malicious package used the `postinstall` script to collect environment variables and send them to the server. To protect against such attacks, it's recommended to not store sensitive information in environment variables, use tools like Snyk to monitor dependencies, consult the Snyk Advisor before installing packages, and consider using flags or tools that ignore scripts from third-party packages during installation.

Tilt is an awesome tool for developers working with Kubernetes applications, providing a highly configurable local deployment workflow that updates in real-time as you work. It allows each individual developer to customize their workflow and provides a GUI and CLI environment which can be customized. Tilt also supports custom extensions, giving users even more options for how to set up and run their development environment. The Snyk extension for Tilt integrates Snyk scanning into the workflow, allowing developers to scan Kubernetes YAML files, container images, and source code dependencies for vulnerabilities. With this integration, developers can ensure that their cloud-native applications are secure and keep up with the latest security best practices. By using Tilt and the Snyk extension, developers can speed up local development of microservice-based applications for Kubernetes and have a huge amount of configuration possibilities to give them the exact workflow that works for them.

While applying dynamic risk assessment to software development can mitigate cybersecurity risks, it requires a combination of quantitative and qualitative approaches to accurately assess these risks. Common software risks include downtime, bugs, user interface issues, and security breaches, which can have severe consequences for businesses. Organizations can use tools like Snyk and Datadog to measure and mitigate these risks through automated risk management, creating a common language and framework for scoring the impact of software security risks. By setting a risk budget and using dynamic risk assessments, business leaders can drive decision-making and produce better software products without introducing unnecessary risk.