March 2021 Summaries

Snyk, an application security automation tool for GitHub repositories, has introduced several tools to help users manage their code at scale. These include snyk-api-import, which automatically imports new repositories as projects into Snyk, and snyk-scm-refresh, designed to ensure that all the projects in Snyk are in sync with relevant repositories on GitHub. The tools can detect new manifest files, remove projects for manifests that no longer exist, update projects when a repo has been renamed, and detect deleted repos. These automation features help organizations efficiently manage their code security while fitting into existing workflows.

The outdated version of snakeyaml contains a Denial of Service vulnerability, which can be prevented by updating to version 1.26 or higher. Parsing YAML files in Java with snakeyaml is straightforward and can be done in two ways: the generic way or parsing to a specific object. However, both methods can lead to memory overloads when dealing with complex data structures like YAML bombs, which can cause Denial of Service attacks. Updating to a newer version of snakeyaml resolves this issue by limiting the number of aliases for non-scalar nodes, preventing heap overflows and application crashes. It is essential to keep track of library dependencies and regularly scan for vulnerabilities to avoid such issues.

Snyk Code provides a feature called "Ignore" that allows users to suppress specific security warnings, such as when testing with hard-coded passwords or deciding not to fix an issue. The Ignore feature can be accessed through the Snyk Code web UI and allows users to classify whether the issue is to be marked as not vulnerable, ignored temporarily, or ignored permanently, setting a timer for how long to ignore the issue. However, traditional systems that rely on source code comments to identify issues with unique hashes are flawed, as changing the text changes the hash, leading to incorrect matches and ignoring similar reports. Snyk Code implements its Ignore feature by using an intermediate representation of the input code to generate a hash, allowing it to recognize the same issue even when code is refactored or renamed. The new implementation loosens exact match requirements, reducing irrelevant reappearances of reports.

SQL injection is a serious vulnerability for online applications that occurs when untrusted data is added to a database query, allowing attackers to steal valuable data or bypass authentication. To prevent SQL injection attacks, developers can follow best practices such as not relying on client-side input validation, using a database user with restricted privileges, and using prepared statements and query parameterization. Scanning code for SQL injection vulnerabilities and using an ORM layer can also help prevent these attacks. Additionally, performing input validation, being careful with stored procedures, and avoiding blocklisting are important measures to take. By following these best practices, developers can significantly reduce the risk of SQL injection attacks in their applications.

This summary provides an overview of the key points of the text, focusing on developer-driven workflows for securing and maintaining containerized applications. The article discusses the importance of well-formed container images, the role of Dockerfiles in building images, and various tools and practices used to identify, prioritize, and fix security issues before they reach production. It also covers image hardening techniques, such as setting a non-root user, enforcing root user controls, dropping capabilities, considering alternative base images like Alpine or Distroless, and researching non-Dockerfile image builders like Bazel or jib. The article concludes by highlighting the importance of developer-first container security and providing additional resources for further learning.

The software world is flooded with DevOps tools that facilitate automation and integration of development and operations, enabling fast and efficient software development in complex projects involving multiple teams and developers. These tools can be used to scan code for bugs and security vulnerabilities, run tests, build and package deployment artifacts, deploy to infrastructure, and stay on top of new releases. To empower teams, it's essential to invest time into building and improving automation rather than wasting time on manual tasks prone to human error. Top DevOps tools include Snyk for security vulnerability scanning, AWS CodeStar for managed code repository service, Docker for container image format and execution environment, Podman as a lightweight alternative to Docker, Prometheus & Grafana for monitoring tool, GitHub Actions for executing tasks in response to events on repositories, Selenium for UI tests, Sentry for monitored front-end and mobile applications, Slack for constant monitoring, and GitLab for managing Git repositories, issues, and CI/CD pipelines. The choice of tool depends on the IT strategy and specific needs of each project.

Backstage is an open-source platform that provides a centralized location for software development teams to manage their applications, infrastructure, and pipelines. Its plugin system allows users to extend the platform and provide visibility across the entire software development lifecycle. Backstage integrates with various systems, including CI/CD tools, monitoring, and alerting systems, providing a single source of truth for configuration and security information. The Snyk API integration enables developers to visualize security data directly in Backstage, along with prioritization and remediation advice, empowering teams to access and action security information efficiently. This integration supports cloud-native application development and security by surfacing security information early and often during the development process.

''` DevOps security is a critical aspect of the entire DevOps life cycle and value stream, as it involves applying information security policy and technology to every stage of the software development life cycle. The rapid pace of change in modern agile environments, cloud-based infrastructure, workload containerization, and collaboration challenges traditional IT paradigms. DevSecOps aims to integrate security objectives into the entire DevOps life cycle, particularly in the early stages of design and development, by shifting left and empowering developers to own security remediation. This approach can help alleviate remediation burdens held by security teams and improve overall security outcomes. By implementing DevSecOps, organizations can deliver software faster and more securely, generating more value for their customers and themselves.

The vulnerability in the Docker image is due to a third-party open-source component, ImageMagick, which has demonstrated many security vulnerabilities over the years, including the famous ImageTragick vulnerability (CVE-2016-3714). This vulnerability can be exploited by creating specially crafted image files that bypass the parsing functionality of the ImageMagick library, allowing an attacker to inject system commands. The exploit was demonstrated using a Node.js-based web application that uses a vulnerable Docker base image for Node.js. The attack completely bypasses all secure coding conventions and goes beyond the security of the Node.js runtime or open source node modules dependencies. Snyk recommends various alternate base image upgrades that can improve the security of the application by reducing the number of vulnerabilities and using more secure base images.

Snyk has expanded its operations into Asia Pacific and Japan (APJ) with a new Vice President of APJ Sales, Shaun McLagan, and partnerships with Temasek and Geodesic Capital. The company's developer-first security approach is well-suited to the growing demand for security in the region, where digital transformation initiatives are driving the need for continuous security integration into DevOps processes. With over 2.2 million developers worldwide adopting Snyk's platform, the company aims to capitalize on the strong growth potential of the APJ market and further fuel its expansion with investments from Temasek and Geodesic Capital. Snyk's platform supports cloud native application development using open source code, containers, and APIs, enabling businesses to mitigate risk and increase efficiency through automated vulnerability management.

The Kubernetes Security Context settings are a powerful tool to securely run workloads, but they require significant knowledge to implement correctly. The `runAsNonRoot` setting ensures that containers do not run as the root user, which is crucial to prevent exploitation of security vulnerabilities. The `runAsUser` and `runAsGroup` settings allow custom users and groups to be specified for container processes, while the `seLinuxOptions` setting enables SELinux for enhanced security. The `seccompProfile` setting restricts system calls made by containers, and the `privileged` flag should be avoided as it grants full access to the host system. The `capabilities` setting allows granular control over kernel call permissions, and the `readonlyRootFilesystem` setting ensures that containers do not write to the root filesystem. The `procMount` setting controls access to the `/proc` filesystem, while the `fsGroup` and `sysctls` settings provide additional security features. By understanding and using these security context settings correctly, developers can ensure secure deployment of their workloads in Kubernetes.

Today marks a significant milestone for the Snyk company as it closes its Series E funding round. The company has expanded from its original dev-first security product to adding three more products, including Container, Infrastructure as Code (IaC), and Code, all built on its industry-leading Cloud Native Application Security Platform. With over 2.2 million developers in the Snyk community, the company prioritizes developer experience and security. The funding will be used to accelerate growth, maintain a comprehensive vulnerabilities database, add to its customer roster, and recruit talent worldwide. The company aims to expand into Asia Pacific and Japan (APJ) and partner with new investment partners to build security into the fabric of software development. A strong team and culture are at the heart of Snyk's success, and the company is welcoming three new leaders as part of its mission to advance the DevSecOps movement.

The recent SolarWinds breach highlights a shift in the Software Supply Chain paradigm, where proprietary code is no longer considered more secure than open-source code. Open source code has been found to be more secure due to its faster fix/patch/update cycle and increased access to source code. Despite this, many companies still prefer proprietary code, with 96% of applications using open-source code and 80% of the code in the Software Supply Chain coming from open sources. The SolarWinds breach shows how malicious actors can exploit vulnerabilities in open-source code, demonstrating that no code is impenetrable. To address this, organizations must arm themselves with tools to scan their open-source code, proprietary code, containers, and infrastructure as code, implementing these processes early in the software development lifecycle (SDLC). A developer-first cloud-native application security platform, such as Snyk's, can help identify, prioritize, fix, and monitor vulnerabilities, providing timely and accurate information through its comprehensive vulnerability database.