February 2021 Summaries

This article discusses the importance of proper Java configuration to prevent security misconfigurations, which is a top 10 vulnerability list issue. It highlights common examples of security issues caused by misconfigured Java applications, including XML parser vulnerabilities and improper error handling. The article also emphasizes the need to configure libraries and frameworks, such as Jackson and Spring Framework, correctly to avoid introducing security risks. Additionally, it advises developers to be aware of default configuration settings and their potential security implications, and to disable unnecessary features and endpoints in production environments to prevent exposing sensitive information.

The Snyk & Opsgenie integration aims to further integrate security into existing incident management and operations workflows, making it easier to scale and automate security processes. The new integration leverages Snyk's custom webhooks API beta release to seamlessly insert Snyk's security automation into Opsgenie workflows, providing proactive alerting of changes in source code that introduce vulnerabilities. This allows developers to respond to potential issues before they become incidents, enhancing the overall incident management process and reducing time to resolution. The integration is designed to be flexible and extensible, recognizing that development workflows are constantly changing, and provides actionable and reliable alerting with detailed contextual information on security vulnerabilities.

The company Snyk has enhanced its Infrastructure as Code (IaC) scanning tool with new features, including support for Azure, GCP, and AWS infrastructure as code. The updates expand the breadth of the tool's policies to better protect platforms from vulnerabilities and issues. Snyk's IaC scanning can help catch issues in templates before they reach provisioning, providing an automated review that compares existing templates against curated policies and best practices. This allows for compliance with security and architecture teams' standards, as well as testing changes as code is updated. The tool now supports Terraform AWS resources, logging best practices on Azure, and various checks related to sensitive data in Lambda, EC2, and EKS resources. Snyk's IaC scanning can be used by developers to actively make a difference in squashing vulnerabilities and security issues at the source.

Snyk-Watcher is an open source tool built by Twilio's product security team to automate the process of importing projects into Snyk for scanning at scale. It leverages the Snyk API and GitHub webhooks to listen for repository changes, pull requests, and other events, triggering automated actions in Snyk such as project import and configuration. By automating this process, developers can eliminate human error and catch more vulnerabilities, ensuring consistency in both developer experience and platform governance. The tool is now being open sourced, allowing others to automate the process of keeping their SCM and Snyk in sync without manual intervention.

The vulnerability remediation process is a critical workflow in maintaining the security of systems and assets, focusing on fixing or neutralizing detected weaknesses including bugs and vulnerabilities through four steps: finding, prioritizing, fixing, and monitoring. Finding involves detecting vulnerabilities through scanning and testing, while prioritization involves understanding which vulnerabilities pose a real and significant risk. Fixing vulnerabilities typically involves patching, blocking, or otherwise fixing them at scale and in real-time, with options to update configurations or remove unused components. Monitoring is essential for automatically tracking newly discovered vulnerabilities and providing real-time alerts and notifications via relevant channels. Effective remediation requires the right tools and a focus on empowering development teams to take ownership of security.

The Java ecosystem is being surveyed by Snyk in collaboration with Azul, aiming to create a comprehensive overview of the JVM 2021 landscape. The survey takes less than 3 minutes to complete and will be used to gather data on how developers use Java and the JVM ecosystem, as well as other available data points such as GitHub projects and Google searches. By participating, respondents can help the community share their data and contribute to a charity goal, with donations of $1000 for 2,000 responses and potentially up to $2000 if the target is exceeded.

Snyk has launched a Community Outreach Internship Program aimed at increasing diversity and addressing the economic impacts of COVID-19, particularly on women and underrepresented minorities. The program was designed to balance Snyk's growth goals with its social impact priorities, resulting in 15 internship positions being opened, with over 1,500 applications received. The selection process was challenging, but ultimately led to a diverse and talented group of interns who have made an immediate impact on the business. Through this program, Snyk has not only given back to the community but also learned from its interns' passion, conviction, tenacity, and savvy, incorporating them into the company's overall talent strategy.

The average cost of a data breach is increasing, with global cybercrime costs expected to reach $6 trillion in 2021. Understanding the difference between vulnerabilities, exploits, and threats is crucial for effective cybersecurity risk management. Security vulnerabilities can be found at all layers, including infrastructure, network, and application. The OWASP Top 10 Vulnerabilities and CWE (Common Weakness Enumeration) lists identify common software weaknesses that have security ramifications. These weaknesses include porous defenses, risky resource management, and insecure interaction between components. Finding and fixing security vulnerabilities is essential through formal vulnerability management programs, which involve cross-team best practices and procedures for identifying, prioritizing, and remediating vulnerabilities in a timely manner and at scale. Automated tools such as software composition analysis, static application security tools, dynamic application security tools, and open-source vulnerability scanners can help implement Secure SDLC (Secure Software Development Life Cycle) and improve cybersecurity risk management.

Snyk has integrated with Amazon Elastic Container Registry (ECR) and Amazon Elastic Kubernetes Service (EKS), allowing users to scan container images directly into their workflows, identify vulnerabilities in their code and dependencies, and receive recommendations for remediation. The integration enables Snyk's vulnerability scanning capabilities within ECR and EKS, providing a comprehensive security posture for cloud-native applications running on these platforms. By leveraging this integration, developers can ensure the security of their workloads and infrastructure in cloud native environments, reducing the risk of vulnerabilities and improving overall security.

Go security best practices for developers are essential to protect against common security vulnerabilities and exploits. The Go language itself provides built-in features like memory garbage collection and strongly-typed pointers, reducing the need for manual memory management and minimizing the risk of bugs that can lead to security issues. To further enhance security, developers should use Go Modules for dependency management, scan dependencies for known vulnerabilities using tools like Snyk, and utilize the standard crypto packages instead of third-party libraries. Additionally, using html/template to web encode content can help avoid XSS attacks, while being cautious with subshelling, unsafe, and cgo usage is crucial due to their potential risks. Reflection should be used sparingly, as it increases the risk of runtime typing errors, and minimizing container attack surface by using multi-stage Dockerfiles can also help reduce the risk of security vulnerabilities in Go applications running in containers. By following these best practices, developers can significantly improve the security posture of their Go-based projects.

Verdaccio is an open-source email agent package that scores high in terms of overall package health score. It's a lightweight private registry and proxy with no dependencies, built in Node.js, making it simple to set up for users who have published packages on npmjs. The project has gained popularity due to its simplicity, popularity of JavaScript and Node.js, and Docker reaching many users. Developers appreciate Verdaccio for its privacy, flexibility, simplicity, and being free. The project has seen a tendency of developers moving from Nexus and Artifcatory to Verdaccio, as it's simple and fast for publishing packages. To gauge the health of the project, one looks at factors like security patches, commit trends, pull request actions, and the feeling of security. As an open-source maintainer, Juan Picado faces challenges like time management and prioritizing tasks, but emphasizes enjoying the process and not being afraid to contribute.

The State of Cloud Native Application Security survey—2021` focuses on the security of code, open source dependencies, container and infrastructure as code in cloud native applications. Snyk is expanding its research to gain a holistic view of application developers' work and has launched a 2021 survey to gather community perspectives. The survey aims to understand how mature the adoption of cloud native application security is among deployed applications, including areas with greater or lesser security risks due to cloud native technology adoption. Snyk wants to know about the speed of remediation for security issues in cloud native applications and how fixing issues affects their adoption. The survey results will be released as a free report to benefit the community, with respondents receiving a gift card if among the first 500.