April 2021 Summaries

The discussion at the Snyk roundtable with Intuit highlighted the need to break silos between security and developer communities, present security tasks in a way that resonates with developers, and make tools more accessible to them. The session also emphasized the importance of education, making security a natural part of software development processes, and recognizing the value of voluntary participation in champions programs. Celebrating achievements and measuring progress rather than just focusing on the absence of security issues were also key takeaways from the discussion.

SAST tools are static application security testing tools that analyze source code to identify potential vulnerabilities and weaknesses, such as sensitive data exposure, SQL injection, and code injection. Conventional SAST tools have failed due to slow running times, embedding security in separate CI processes, creating false positives, and not providing actionable fixes for identified issues. Developer-first SAST tools, like Snyk Code, aim to increase developer productivity by integrating security into workflows, providing real-time feedback loops, high accuracy, low false positives, empowering developers to fix code security issues, and offering contextual information about suggested fixes. These features enable developers to find and address security issues directly in their tools, making secure coding a seamless part of their workflow.

Snyk has announced support for Elixir, a functional, concurrent, and general-purpose programming language, allowing developers to easily find, prioritize, and fix vulnerabilities in their Elixir packages. With Snyk's CLI, Elixir developers can test and monitor their Mix/Hex projects manually or as part of their CI process, ensuring known vulnerabilities are caught early on and before code is deployed into production. This support is available across all Snyk plans for free. The Elixir ecosystem poses a security risk due to open source packages containing known vulnerabilities, but the number of known vulnerabilities remains relatively low compared to other ecosystems. Using Snyk enables developers to surface these vulnerabilities early on and quickly apply fixes. The Snyk CLI allows users to find and fix vulnerabilities in their dependencies manually or as part of their CI workflow. With its support for umbrella projects and dependency trees, Snyk provides a comprehensive solution for Elixir development security.

Atlassian Team ‘21 is a four-year celebration of developer-first integrations between Snyk and Atlassian, with key highlights including the integration of Snyk into Bitbucket tooling, becoming Atlassian's featured security partner for its Open DevOps Initiative, and supporting developer-friendly security processes through DevSecOps. The event aims to empower developers to design software with security in mind, rather than as an afterthought, by providing comprehensive security solutions that integrate with existing DevOps workflows. Snyk has expanded its integration with Bitbucket Cloud, simplifying how users experience and implement security, and will be showcasing this at the conference along with other sessions on topics such as live hacking, native vulnerability management, and capture the flag challenges.

Snyk Team is a new product plan designed for development teams, providing world-class security capabilities in an accessible and easy-to-purchase solution. The plan aims to empower teams to build applications securely together by automating security testing across all projects and stages of the software development lifecycle. Snyk Team offers affordable pricing starting at $25 per developer, per month, with discounts for additional products or annual purchases. It provides access to the Snyk Intel Vulnerability Database, base image recommendations, and automated fixes for containers, allowing teams to integrate security into their workflows without breaking the bank.

The latest release of Code Dx 5.3 integrates with Snyk for comprehensive vulnerability management, enabling customers to integrate open source and container security into their continuous development processes. As the adoption of containers continues to rise, container security scanning is becoming increasingly important, and Code Dx 5.3 supports this by providing a tool connector with Snyk that operates at scale with the latest technology stack. The integration allows developers to quickly find and fix vulnerabilities in container images, as well as manage open-source dependencies and license issues when building cloud native applications. This enables customers to deliver applications at the speed of DevOps without leaving security behind, streamlining workflows and prioritizing tracking and remediation of vulnerabilities.

Kubernetes RBAC (role-based access control) is a powerful tool that enables users to define roles inside namespaces and cluster roles outside namespaces, but it also requires careful management to prevent malicious use. To address this challenge, Snyk developed an internal security checklist for RBAC rules, which includes guidelines such as no wildcard resources or verbs, no usage of built-in rules, and no bindings to sensitive service accounts. This checklist is used to automate security checks with Snyk Infrastructure as Code (Snyk IaC), which scans Kubernetes manifests for compliance and provides feedback on any violations. By making IaC security ridiculously easy for developers, Snyk aims to empower its team while ensuring that security responsibilities are owned by the developers themselves.

Snyk Code now offers beta support for Python 2.x and 3.x projects, with security rules available but limited curated content at this time. The beta is part of an expansion of language support in Snyk Code, with more languages to be released in the future. Users can scan open source repositories and use plugins such as the JetBrains PyCharm plugin for enhanced integration. The feature is available instantly without requiring any installations or updates, and users are encouraged to provide feedback on additional language support.

Securing cloud-native applications is a growing concern as organizations shift towards iterative development and deployment using cloud-based tools and infrastructure. Modern applications now involve not only custom code but also containers, configuration files, and other aspects of the environment, making security a responsibility shared among developers. ActiveCampaign, which automates marketing, sales, and business processes for over 150,000 businesses globally, has adopted a DevSecOps approach with Snyk to ensure comprehensive cloud-native application security. This includes integrating security scanning into local development environments, using automation for continuous feedback and vulnerability remediation, and leveraging dashboarding and metrics to drive developer competition and iteration. By investing in the right security tooling, organizations can scale their security efforts without barriers to adoption, ensuring applications are built with confidence and delivered rapidly.

The text discusses code injection vulnerabilities in JavaScript and Node.js applications, which can be exploited by attackers to execute malicious code. To prevent such attacks, developers should avoid using dynamic code execution functions like `eval()`, `setTimeout()`, and `setInterval()`, as well as the `Function` constructor. Additionally, they should use a security linter like ESLint with the `security` plugin to detect potential issues, and consider using a static code analysis tool like Snyk Code to identify vulnerabilities in third-party dependencies and user-controlled input. By following these best practices, developers can significantly reduce the risk of code injection attacks in their applications.

Snyk and Shutterstock discussed building a DevSecOps culture, which is crucial for implementing new security processes in application development. The changing application development landscape, driven by cloud native computing and microservices architectures, puts more responsibility on developers than ever before. To overcome the challenges of introducing a security program, Shutterstock created events and games to make security more fun, chose developer-friendly tooling that fits seamlessly into existing workflows, and implemented governance around security processes. The company's experience highlights the importance of shifting left in DevSecOps, testing security throughout the entire development pipeline, and providing actionable feedback to help developers with remediation.

Snyk Container has integrated with Harbor, enabling users to scan their container images for vulnerabilities and find and fix them with the help of Snyk's vulnerability management capabilities. The integration provides base image upgrade recommendations, image layer identification features, and helps identify problematic Dockerfile statements. It also enables users to optimize their base images by selecting alternate base images with fewer vulnerabilities. With this integration, developers can focus on securing their containers and Kubernetes workloads using a developer-first approach.

Snyk has integrated with Red Hat's Quay registry to enable scanning of container images for vulnerabilities, providing recommendations for upgrades and prioritization of fix efforts. The integration is available on all Snyk plans, including free accounts, and offers features such as base image upgrade suggestions, built-in prioritization and dependency analysis, and the ability to focus on high-risk issues. Snyk helps developers identify and select alternate base images to reduce vulnerabilities in their container images, with recommendations for minor, major, and alternative upgrades available based on project requirements. The integration also enables users to add their Dockerfile to Snyk, allowing them to match vulnerabilities up to the instructions that introduce them, and provides full dependency information to trace vulnerabilities back to their source.