June 2021 Summaries

Machine learning is being explored as a potential game-changer for Static Application Security Testing (SAST), which finds security vulnerabilities in non-running source code, to improve speed, accuracy, and actionability. SAST has been around for a long time with incremental improvements but has not had significant disruption. The current limitations of SAST tools include computational intensity and providing actionable solutions. Machine learning can help address these issues by maintaining knowledge bases, detecting more vulnerabilities, and automating code fixes. However, the true disruption comes from applying machine learning to improve accuracy and actionability at scale. When implemented incompletely, machine learning can still be used as a distraction. To get the most out of SAST with machine learning, it's essential to consider whether some level of machine learning is already being applied, if the tool offers actionable solutions directly from developer tools, and if it integrates into an automated pipeline.

This summary highlights the importance of preventing PHP code injection attacks, which can compromise an application's integrity and put users' data at risk. To achieve this, developers should adopt secure coding practices, such as sanitizing user input, avoiding dynamic code execution, and using security linters to identify potential vulnerabilities. Utilizing static application security testing tools like Snyk Open Source and PHPStorm can also help detect code injection issues early on. By incorporating these measures into their development workflow, developers can create more secure applications that protect users' data and prevent malicious attacks.

Open source software offers many benefits, including access to freely available libraries, frameworks, and processes that can speed up development and drive innovation. However, there are also five potential risks associated with open source software that should be considered when selecting projects for your stack. These include issues related to software quality, long-term sustainability, software licensing, copyright infringement, and software security. To mitigate these risks, it's essential to perform due diligence before adopting any open source software, use tools that provide clear visibility into your open source inventory, and adopt automated security and governance solutions to stay on top of application security and licensing compliance.

Cloud application security is a set of policies, governance, tools, and processes used to secure collaborative cloud environments and applications deployed to the cloud. As cloud native application development grows, it's becoming more important for security, development, and operations teams to share responsibility for cloud application security, with developers taking on additional AppSec responsibility through DevSecOps. Cloud application security issues include unauthorized access, exposed services due to misconfigurations, hijacking of user accounts, data leakage, and distributed denial of service attacks. Implementing effective security measures requires a comprehensive approach, integrating secure measures like identity access management, encryption, threat monitoring, data privacy & compliance, and automated security testing. These best practices can help organizations keep cloud native applications secure at speed and scale.

This is a personal reflection on Juneteenth, written by Plushcap as Snyker Spotlight. The author shares their experience with Juneteenth, a holiday commemorating the emancipation of enslaved African Americans in the United States. They acknowledge that they and some colleagues at Snyk are not invested in the celebration, despite living in a predominantly white area. However, the recent murder of George Floyd and subsequent protests highlighted the need for awareness and action on racial issues. The author recognizes the importance of understanding the history behind Juneteenth and its significance in American history, including the role of African Americans during the Civil War and the Emancipation Proclamation. They express their gratitude to young people who have taken a stand against racism and encouraged companies to recognize the holiday. The author also encourages readers to support organizations working towards racial justice and equality.

The Snyk Infrastructure as Code (IaC) tool now supports scanning for AWS CloudFormation misconfigurations, allowing developers to integrate security checks into their development process early on. This feature is available both through the Snyk CLI and by importing a repository, making it easy to treat CloudFormation files like any other code. The new functionality uses comprehensive sets of security rules, including over 100 for AWS, and provides format-agnostic rules that can be viewed and modified in the Snyk organization's settings. With this update, users can scan their CloudFormation files using a simple command, such as "snyk iac test <path-to-file-or-folder>", and get comprehensive security feedback to secure their infrastructure from the source. The new features are available for free to all users, including those on the free plan, making it easy to get started with Snyk IaC today.

Comparing SAST tools is challenging due to limitations in using vulnerability lists, test suites, and benchmarking. These methods have scope limitations, are too generic, potentially outdated, and may not be relevant for all languages or environments. Test suites and intentionally vulnerable apps also come with their own limitations, such as limited language support, overfitting, and lack of semantic holism. As a result, these standards are not ideal for measuring SAST tools, but can still play a role in educating developers about common security issues.

The SPDX project aims to standardize how software bill of materials (SBOM) are defined and provided, with a machine-readable format that the industry can build tooling around to solve supply chain problems. This is increasingly helpful in solving software security challenges, as evident in the recent U.S. President Biden's executive order on improving the nation's cybersecurity. Snyk integrates with various package managers and developer tools to identify vulnerabilities in software components and has built a SBOM under its hood, normalizing lists of software and adding metadata from other sources. The company is working closely with the Linux Foundation to improve the SPDX standard and expand the ecosystem of tools, as SBOMs are expected to play a key role in addressing wider software supply chain security issues.

Snyk has released a native integration with Atlassian Bitbucket Cloud, enhancing their partnership and providing full availability of the new security integration that embeds Snyk into Bitbucket Cloud for security. This integration is free, easy to set up, and enables developers to see new vulnerabilities as they emerge, implement fixes early, and quickly in the process. It brings developer-first security to Bitbucket Cloud users by shifting the ownership of application components from IT security to the application security model, providing immediate insights into each open source component. The integration automates security to build, test, and release secure software faster and more reliably, empowering developers to design software with security in mind rather than as an afterthought. It provides a range of features, including repo scanning during coding, automated pull requests within Bitbucket Cloud, proactive repo scanning, and full security visibility into Bitbucket Cloud pipelines.

The new book "Cloud Native Application Security: Embracing Developer-First Security for the Cloud Era" by Guy Podjarny explores the changes in the security landscape driven by digital transformation, where more companies are becoming software companies. The book emphasizes the importance of modernizing to developer-first security, which involves embedding security into development practices early on and adopting a cloud native approach. This shift requires new tools, skills, and ownership around security, and Guy examines its benefits, challenges, and future implications for organizations. The book aims to help teams update their existing practices for the cloud native era, including Security and AppSec teams, executives, and DevOps practitioners.

The US Federal Government's cybersecurity executive order recognizes the growing threat of software supply chain attacks and aims to minimize this risk by directing the Commerce Department to create strict standards for companies selling software to the Federal Government. The order requires software suppliers to implement secure development practices, provide a Software Bill of Materials (SBOM), attest to a secure development environment, and ensure open source integrity. To achieve these goals, developers are being empowered with developer-friendly tooling and proper guidance from security teams. The executive order also calls for early implementation of automated security testing across the software development process, securing all code making up modern software, and providing transparency through attestation and component-level reporting. As guidelines are introduced by NIST within six months to a year, companies selling to the Federal Government must start planning to identify major gaps with their existing software supply chain and comply with these new standards, which will likely trickle down into the private sector and affect the software market as a whole.

Microsoft's Visual Studio now supports a new free extension from Snyk, enabling developers to identify and fix security vulnerabilities and license issues in their open source dependencies. The extension is compatible with Visual Studio 2015, 2017, and 2019, and can be easily installed within the IDE or via the marketplace. It supports all languages supported by Snyk CLI: .NET, C#, Java, JavaScript, Python, Ruby, Swift, Objective-C, and Scala. The extension is based on the Snyk CLI, which scans dependencies and correlates findings with the Snyk Intel Vulnerability Database for accurate results. This helps developers address security early on in the development process, ensuring that code remains secure while maintaining a rapid pace of development.

At companies like Snyk, remote work flexibility is no longer a perk but a normalized way of life that has become essential for productivity and employee motivation. The company values its employees' autonomy and trust in their ability to do their best work, regardless of where they are located. By offering flexibility and allowing employees to craft their own work/life balance, Snyk aims to create a more inclusive and equal environment where everyone can thrive. The company's mission is centered around empowering developers to produce their best work faster, and it believes that this approach represents a great recruiting opportunity. Ultimately, Snyk encourages employees who value flexibility to join the team and find their next role in a more autonomous and trusting work environment.

DevSecCon24 2021 is a free, global conference that connects developers, security, and operations teams to learn about integrating security into development practices. The event aims to be inclusive, with three conferences running concurrently across different time zones, each featuring region-specific keynotes and sessions. The conference features diverse speakers, including women, and includes a "kid" track for parents. All proceeds will benefit global charities driving inclusiveness in technology. The event is free to register and offers on-demand content afterwards. It aims to support local organizations promoting diversity and inclusion in the tech sector.

Snyk Code now fully supports Python, joining Java, JavaScript, and TypeScript as a list of heavily used cloud native languages. The language was first introduced in beta and received positive feedback from users, who saw the Snyk Code knowledge base providing an enormous amount of insights even in early stages. After ensuring the quality standards were met during a public beta phase, Python is now available for use in Snyk Code, supporting instant scanning through the UI or IDE extensions like PyCharm and Visual Studio Code. The company continues to work on other languages and ecosystems, including .NET and Golang, based on user feedback.

This article discusses mitigating and remediating intent-based Android security vulnerabilities. It highlights various use cases that either significantly reduced or completely eliminated the attack vector, including setting permissions for an activity, setting flags on the redirected intent, avoiding the use of URI_ALLOW_UNSAFE flag, and more. The article also provides remediation recommendations from Google Play and showcases a fix in the rif is fun for Reddit app. It emphasizes that using intents carelessly can cause severe security issues and suggests raising awareness among mobile developers to mitigate them effectively.

** SnykCon 2021 is an annual conference that aims to empower developers and security professionals to build securely, without slowing down. The theme of this year's SnykCon is "Build Securely" which emphasizes the need for a change in both development and security practices. The event will feature various session formats such as main stage talks, lightning talks, code & build sessions, workshops, product demos, and more. Developers and security professionals are encouraged to submit their own sessions through the CFP until July 16. The conference is free and will take place virtually from October 5-7, 2021. The goal of SnykCon is to inspire attendees to become security champions in their organizations and share learnings with the community.

The 2021 Gartner Magic Quadrant for Application Security Testing recognizes Visionary, a company that empowers developers to be key security stakeholders in the future of application security testing. The report highlights the growing importance of DevSecOps and cloud native applications, where security starts with developers. Snyk has been positioned as a leader in this space, offering products like Snyk Open Source and Snyk Code that integrate directly into existing workflows and tools to make it easy for developers to find and remediate bugs in their code and dependencies. The company's vision is reflected in its alignment with the future of application security testing, where security starts with developers, and traditional siloed security workflows are becoming antiquated. Snyk has achieved this recognition by offering a holistic approach to vulnerabilities, integrating security expertise into the development lifecycle, and providing tools that support enterprise DevOps initiatives. The company is well-positioned to build on its vision, having recently launched new products and partnerships, and now with twice as many employees as last year.