June 2021 Summaries

Machine learning is being explored as a potential game-changer for Static Application Security Testing (SAST), which finds security vulnerabilities in non-running source code, to improve speed, accuracy, and actionability. SAST has been around for a long time with incremental improvements but has not had significant disruption. The current limitations of SAST tools include computational intensity and providing actionable solutions. Machine learning can help address these issues by maintaining knowledge bases, detecting more vulnerabilities, and automating code fixes. However, the true disruption comes from applying machine learning to improve accuracy and actionability at scale. When implemented incompletely, machine learning can still be used as a distraction. To get the most out of SAST with machine learning, it's essential to consider whether some level of machine learning is already being applied, if the tool offers actionable solutions directly from developer tools, and if it integrates into an automated pipeline.

A freelance violinist shifted toward software engineering during the pandemic by attending a coding bootcamp, then found Snyk’s inaugural three-month software engineering internship after struggling to secure roles due to limited technical experience. Assigned remotely to the Runtime team within Snyk Container, the intern overcame initial anxiety by taking on a challenging end-to-end integration project that required learning Go, related frameworks, and Google Protocol Buffers. Their experience emphasized embracing difficult work as a learning opportunity, asking frequent questions and communicating transparently across distributed teams, and recognizing that junior perspectives can contribute meaningfully to technical discussions. The internship also highlighted Snyk’s focus on employee wellbeing, including discouraging excessive evening work, and its wider culture of support through mentorship from both engineering colleagues and employees in other departments. Having progressed substantially on the project and presented demos to the company, the intern was offered an Associate Software Engineer role and encouraged others to consider careers at Snyk.

This summary highlights the importance of preventing PHP code injection attacks, which can compromise an application's integrity and put users' data at risk. To achieve this, developers should adopt secure coding practices, such as sanitizing user input, avoiding dynamic code execution, and using security linters to identify potential vulnerabilities. Utilizing static application security testing tools like Snyk Open Source and PHPStorm can also help detect code injection issues early on. By incorporating these measures into their development workflow, developers can create more secure applications that protect users' data and prevent malicious attacks.

Open source software offers many benefits, including access to freely available libraries, frameworks, and processes that can speed up development and drive innovation. However, there are also five potential risks associated with open source software that should be considered when selecting projects for your stack. These include issues related to software quality, long-term sustainability, software licensing, copyright infringement, and software security. To mitigate these risks, it's essential to perform due diligence before adopting any open source software, use tools that provide clear visibility into your open source inventory, and adopt automated security and governance solutions to stay on top of application security and licensing compliance.

Cloud application security is a set of policies, governance, tools, and processes used to secure collaborative cloud environments and applications deployed to the cloud. As cloud native application development grows, it's becoming more important for security, development, and operations teams to share responsibility for cloud application security, with developers taking on additional AppSec responsibility through DevSecOps. Cloud application security issues include unauthorized access, exposed services due to misconfigurations, hijacking of user accounts, data leakage, and distributed denial of service attacks. Implementing effective security measures requires a comprehensive approach, integrating secure measures like identity access management, encryption, threat monitoring, data privacy & compliance, and automated security testing. These best practices can help organizations keep cloud native applications secure at speed and scale.

A Tel Aviv-born graphic designer reflects on experiencing both concealment and acceptance as an LGBTQIA+ professional, contrasting an earlier startup workplace where they hid their identity due to perceived judgment with Snyk’s inclusive culture. They describe Tel Aviv as broadly LGBTQIA+-friendly, while noting that their own prior work environment did not feel safe enough for openness. After joining Snyk in 2017, they felt comfortable discussing their British partner and long-distance relationship, received support to work between the company’s Tel Aviv and London offices, and later obtained assistance relocating permanently to the UK during the COVID-19 pandemic. Their account presents workplace inclusion and practical employer support as important factors in enabling employees to live authentically and pursue personal opportunities.

Snyk offers Java developers a suite of security tools for identifying vulnerabilities in open-source dependencies, container images, infrastructure as code, and custom code. Developers can create a free account and use the Snyk CLI locally or in CI pipelines to scan Maven or Gradle projects, including multi-project repositories, after authenticating and building the application. Git repository integrations can automatically detect manifests, perform recurring dependency scans, notify teams of newly discovered vulnerabilities and fixes, and optionally analyze Dockerfiles and custom code. Snyk also provides Maven and Gradle plugins for embedding security tests directly into builds, along with IDE plugins for IntelliJ IDEA, Eclipse, and VS Code that help developers find and address issues while coding.

Snyk Container is now generally available as a public extension in the AWS CloudFormation Registry, allowing AWS users to activate the integration and connect it with Amazon EKS through CloudFormation. The integration imports and tests running Kubernetes workloads for vulnerabilities in open-source dependencies, container images, and application configurations, while continuously monitoring deployments and configuration changes for new security issues. Existing paid Snyk customers can enable the extension immediately, while new users can access it through a free Snyk Teams trial. Snyk, an AWS Partner with DevOps Competency and several AWS readiness designations, also supports AWS DevOps, serverless, and Kubernetes tools, and customers can purchase its software through AWS Marketplace using direct or partner-led private offers.

SnykCon 2021 is presented as a free, virtual conference running October 5–7 that welcomes developers and security professionals to share and learn about developer-first security under the theme “Build Securely.” Its call for presentations, open until July 16, seeks sessions on topics including secure developer tools, shifting security left, vulnerability management, cloud and container misconfigurations, cross-team collaboration, and automated DevSecOps controls. The event will include main-stage and lightning talks, concurrent Build & Code, Govern & Empower, and Product tracks, plus demonstrations and hands-on workshops. Speakers can reach an expected audience of more than 10,000 attendees, highlight their teams’ security work, build professional connections, support recruiting, and receive Snyk merchandise if accepted. Registrations have drawn organizations ranging from startups to companies such as Salesforce, Volvo, Microsoft, RBC, and Google, with examples of prior popular sessions covering Git commit prevention, large-scale container scanning, and secure coding libraries.

This is a personal reflection on Juneteenth, written by Plushcap as Snyker Spotlight. The author shares their experience with Juneteenth, a holiday commemorating the emancipation of enslaved African Americans in the United States. They acknowledge that they and some colleagues at Snyk are not invested in the celebration, despite living in a predominantly white area. However, the recent murder of George Floyd and subsequent protests highlighted the need for awareness and action on racial issues. The author recognizes the importance of understanding the history behind Juneteenth and its significance in American history, including the role of African Americans during the Civil War and the Emancipation Proclamation. They express their gratitude to young people who have taken a stand against racism and encouraged companies to recognize the holiday. The author also encourages readers to support organizations working towards racial justice and equality.

The Snyk Infrastructure as Code (IaC) tool now supports scanning for AWS CloudFormation misconfigurations, allowing developers to integrate security checks into their development process early on. This feature is available both through the Snyk CLI and by importing a repository, making it easy to treat CloudFormation files like any other code. The new functionality uses comprehensive sets of security rules, including over 100 for AWS, and provides format-agnostic rules that can be viewed and modified in the Snyk organization's settings. With this update, users can scan their CloudFormation files using a simple command, such as "snyk iac test <path-to-file-or-folder>", and get comprehensive security feedback to secure their infrastructure from the source. The new features are available for free to all users, including those on the free plan, making it easy to get started with Snyk IaC today.

Comparing SAST tools is challenging due to limitations in using vulnerability lists, test suites, and benchmarking. These methods have scope limitations, are too generic, potentially outdated, and may not be relevant for all languages or environments. Test suites and intentionally vulnerable apps also come with their own limitations, such as limited language support, overfitting, and lack of semantic holism. As a result, these standards are not ideal for measuring SAST tools, but can still play a role in educating developers about common security issues.

The SPDX project aims to standardize how software bill of materials (SBOM) are defined and provided, with a machine-readable format that the industry can build tooling around to solve supply chain problems. This is increasingly helpful in solving software security challenges, as evident in the recent U.S. President Biden's executive order on improving the nation's cybersecurity. Snyk integrates with various package managers and developer tools to identify vulnerabilities in software components and has built a SBOM under its hood, normalizing lists of software and adding metadata from other sources. The company is working closely with the Linux Foundation to improve the SPDX standard and expand the ecosystem of tools, as SBOMs are expected to play a key role in addressing wider software supply chain security issues.

Snyk has released a native integration with Atlassian Bitbucket Cloud, enhancing their partnership and providing full availability of the new security integration that embeds Snyk into Bitbucket Cloud for security. This integration is free, easy to set up, and enables developers to see new vulnerabilities as they emerge, implement fixes early, and quickly in the process. It brings developer-first security to Bitbucket Cloud users by shifting the ownership of application components from IT security to the application security model, providing immediate insights into each open source component. The integration automates security to build, test, and release secure software faster and more reliably, empowering developers to design software with security in mind rather than as an afterthought. It provides a range of features, including repo scanning during coding, automated pull requests within Bitbucket Cloud, proactive repo scanning, and full security visibility into Bitbucket Cloud pipelines.

The new book "Cloud Native Application Security: Embracing Developer-First Security for the Cloud Era" by Guy Podjarny explores the changes in the security landscape driven by digital transformation, where more companies are becoming software companies. The book emphasizes the importance of modernizing to developer-first security, which involves embedding security into development practices early on and adopting a cloud native approach. This shift requires new tools, skills, and ownership around security, and Guy examines its benefits, challenges, and future implications for organizations. The book aims to help teams update their existing practices for the cloud native era, including Security and AppSec teams, executives, and DevOps practitioners.

Snyk is a developer-focused cloud security platform that identifies vulnerabilities in code, dependencies, containers, and infrastructure as code, while Cortex provides a service catalog that maps internal microservices, dependencies, ownership, and operational tooling. Their integration uses Snyk’s reporting API to associate security issues with the relevant services, displaying them in service-specific views and alongside deployments, Git commits, Kubernetes changes, and on-call incidents on a unified timeline. Cortex can also use Snyk findings in Scorecards that evaluate service readiness against security and operational standards, such as assigned owners, escalation policies, runbooks, logging links, dashboards, pre-production environments, and the absence of high-severity vulnerabilities. After connecting a Snyk organization ID or API key, Cortex can map services to Snyk projects based on repository associations and provide ranked assessments of service quality and deployment preparedness.

The US Federal Government's cybersecurity executive order recognizes the growing threat of software supply chain attacks and aims to minimize this risk by directing the Commerce Department to create strict standards for companies selling software to the Federal Government. The order requires software suppliers to implement secure development practices, provide a Software Bill of Materials (SBOM), attest to a secure development environment, and ensure open source integrity. To achieve these goals, developers are being empowered with developer-friendly tooling and proper guidance from security teams. The executive order also calls for early implementation of automated security testing across the software development process, securing all code making up modern software, and providing transparency through attestation and component-level reporting. As guidelines are introduced by NIST within six months to a year, companies selling to the Federal Government must start planning to identify major gaps with their existing software supply chain and comply with these new standards, which will likely trickle down into the private sector and affect the software market as a whole.

Microsoft's Visual Studio now supports a new free extension from Snyk, enabling developers to identify and fix security vulnerabilities and license issues in their open source dependencies. The extension is compatible with Visual Studio 2015, 2017, and 2019, and can be easily installed within the IDE or via the marketplace. It supports all languages supported by Snyk CLI: .NET, C#, Java, JavaScript, Python, Ruby, Swift, Objective-C, and Scala. The extension is based on the Snyk CLI, which scans dependencies and correlates findings with the Snyk Intel Vulnerability Database for accurate results. This helps developers address security early on in the development process, ensuring that code remains secure while maintaining a rapid pace of development.

Snyk announced an integration with AWS CodePipeline that brings automated Snyk Open Source vulnerability scanning directly into AWS’s continuous delivery console, allowing developers to include security checks in build, test, and deployment workflows without relying on additional tools such as AWS CodeCommit. Users can add Snyk as a scan action after the source stage, authenticate their account, set issue-severity thresholds that can fail builds, and choose between scanning full applications or dependency manifests. Snyk analyzes manifest files against its vulnerability database to identify direct and transitive dependencies, report vulnerabilities, explain their introduction paths, and recommend dependency upgrades or alternatives that minimize compatibility impact. Results are displayed in CodePipeline and can be filtered by severity, fix availability, exploit status, and priority, while detailed reports support ongoing project monitoring. The announcement also highlights Snyk’s broader AWS partnership and existing integrations for Kubernetes, Amazon ECR, EKS, serverless, containers, and DevOps tools, positioning the CodePipeline integration as part of an effort to reduce developer friction while improving early vulnerability detection.

At companies like Snyk, remote work flexibility is no longer a perk but a normalized way of life that has become essential for productivity and employee motivation. The company values its employees' autonomy and trust in their ability to do their best work, regardless of where they are located. By offering flexibility and allowing employees to craft their own work/life balance, Snyk aims to create a more inclusive and equal environment where everyone can thrive. The company's mission is centered around empowering developers to produce their best work faster, and it believes that this approach represents a great recruiting opportunity. Ultimately, Snyk encourages employees who value flexibility to join the team and find their next role in a more autonomous and trusting work environment.

DevSecCon24 2021 is a free, global conference that connects developers, security, and operations teams to learn about integrating security into development practices. The event aims to be inclusive, with three conferences running concurrently across different time zones, each featuring region-specific keynotes and sessions. The conference features diverse speakers, including women, and includes a "kid" track for parents. All proceeds will benefit global charities driving inclusiveness in technology. The event is free to register and offers on-demand content afterwards. It aims to support local organizations promoting diversity and inclusion in the tech sector.

Snyk Code now fully supports Python, joining Java, JavaScript, and TypeScript as a list of heavily used cloud native languages. The language was first introduced in beta and received positive feedback from users, who saw the Snyk Code knowledge base providing an enormous amount of insights even in early stages. After ensuring the quality standards were met during a public beta phase, Python is now available for use in Snyk Code, supporting instant scanning through the UI or IDE extensions like PyCharm and Visual Studio Code. The company continues to work on other languages and ecosystems, including .NET and Golang, based on user feedback.

This article discusses mitigating and remediating intent-based Android security vulnerabilities. It highlights various use cases that either significantly reduced or completely eliminated the attack vector, including setting permissions for an activity, setting flags on the redirected intent, avoiding the use of URI_ALLOW_UNSAFE flag, and more. The article also provides remediation recommendations from Google Play and showcases a fix in the rif is fun for Reddit app. It emphasizes that using intents carelessly can cause severe security issues and suggests raising awareness among mobile developers to mitigate them effectively.

** SnykCon 2021 is an annual conference that aims to empower developers and security professionals to build securely, without slowing down. The theme of this year's SnykCon is "Build Securely" which emphasizes the need for a change in both development and security practices. The event will feature various session formats such as main stage talks, lightning talks, code & build sessions, workshops, product demos, and more. Developers and security professionals are encouraged to submit their own sessions through the CFP until July 16. The conference is free and will take place virtually from October 5-7, 2021. The goal of SnykCon is to inspire attendees to become security champions in their organizations and share learnings with the community.

The 2021 Gartner Magic Quadrant for Application Security Testing recognizes Visionary, a company that empowers developers to be key security stakeholders in the future of application security testing. The report highlights the growing importance of DevSecOps and cloud native applications, where security starts with developers. Snyk has been positioned as a leader in this space, offering products like Snyk Open Source and Snyk Code that integrate directly into existing workflows and tools to make it easy for developers to find and remediate bugs in their code and dependencies. The company's vision is reflected in its alignment with the future of application security testing, where security starts with developers, and traditional siloed security workflows are becoming antiquated. Snyk has achieved this recognition by offering a holistic approach to vulnerabilities, integrating security expertise into the development lifecycle, and providing tools that support enterprise DevOps initiatives. The company is well-positioned to build on its vision, having recently launched new products and partnerships, and now with twice as many employees as last year.