March 2022 Summaries

This article discusses building a secure GraphQL API with Node.js using Fastify and Mercurius. The author creates a basic server, sets up a schema, resolvers, and implements authentication and authorization using the Mercurius Auth plugin. The API is secured by defining custom auth directives on fields in the schema, applying custom auth policies to these protected fields, and masking errors. The article also covers strategies for securing GraphQL APIs, including query depth limit, sanitizing and validating inputs, and more. The author tests the API using GraphQL Playground and demonstrates how to authenticate and authorize requests. Overall, this article provides a comprehensive guide on building a secure GraphQL API with Node.js using Fastify and Mercurius.

Meet (and join) our newest Snyk Ambassadors, a group of cybersecurity professionals who share their knowledge and passion for secure development, DevSecOps, and the developer community. The Snyk Ambassador program was launched in 2021 and has recruited a fresh cohort of ambassadors, including experts from various fields such as cloud security, DevSecOps, threat modeling, and more. These ambassadors are passionate about spreading the word of secure development, developing themselves, and engaging with the developer community. They share their expertise through speaking engagements, community activities, and personal projects, promoting cybersecurity awareness and best practices in software development. The Snyk Ambassador program offers benefits such as neat swag, speaking opportunities, support for learning and personal development, access to early features, spotlight to grow your personal brand, and more. If you're interested in joining the program, head to the Snyk Ambassadors page to register and become a part of this community of cybersecurity professionals.

There are multiple ways to store sensitive passwords, and choosing the wrong method can be a security nightmare. When deciding how to store sensitive passwords, consider using an authentication and authorization service that provides open standards like OpenID Connect and supports MFA for improved user security. If you need to store passwords in your Java application yourself, use a strong password hashing algorithm that consumes computational resources and is slow to run, making brute force attacks less effective. The recommended password hashing algorithms include Argon2id, scrypt, and BCrypt, each with its own strengths and weaknesses. When implementing password hashing, follow best practices such as never implementing the algorithm yourself, keeping up-to-date with security news and trends, using secure libraries and techniques, and learning from capture the flag challenges to improve your skills.

Drift detection of managed resources has been deprecated. Snyk IaC helps developers discover cloud resources not under Terraform control, or that have drifted from their expected state, by listing them as Terraform resources. It also provides a built-in way to ignore resources in bulk and reports everything in Terraform terms with the right information to help developers import those resources into their HCL code. However, automatically reverting changes might not always be the desired outcome, and a lightweight drift detection alerting system is needed in conjunction with the deployment pipeline. Snyk IaC drives faster fixes by closing the feedback loop between cloud security and engineering teams and reporting actionable fixes direct to engineer, in engineer-friendly terms.

The White House has issued a fact sheet with security best practices to enhance cybersecurity and protect data and critical infrastructure in response to potential cyberattacks by Russia. These recommendations include building security into products from the ground up, developing software on secure systems, using modern tools to check for known and potential vulnerabilities, ensuring software developers are responsible for all code used in their products, and implementing security practices mandated by the President's Executive Order. Snyk, a modern application security platform, aligns with these recommendations by providing integrations into popular IDE, CI/CD, and Git tools, automated vulnerability scanning, and developer-first approach to secure software development workflows.

This summary provides an overview of the key points from the provided text on containerizing a Go application using Docker. The article covers creating a sample Go API, preparing a Dockerfile, building and optimizing images, deploying containers with security best practices in mind, including running as a non-root user, limiting access to system resources, and improving overall efficiency and security of the containerized application.

Snyk has reported on a new type of threat vector in the open source community called protestware, which is being used to express support for Ukraine amid the ongoing conflict. Protestware comes in different forms, including repo banners that add political messages to README files or package descriptions, CLI protest logs that display messages on users' machines during installation, out-of-env protest logs that run code outside of the installation environment, and destructive protests that overwrite files with protest information. Snyk is providing guidance on how to differentiate between these types of protestware and will add advisories for packages that exhibit undesired behavior or malicious activity. The company aims to help the community reach a consensus on how to approach protestware and promote safe open source practices.

The dompdf library, a popular PDF generation library used extensively within the PHP ecosystem, has been found to have a remote code execution (RCE) vulnerability due to its handling of custom font styles and loading of external style sheets. Researchers from Positive Security discovered that by manipulating these features, an attacker could load arbitrary PHP code into a PDF file, which would then be executed on the target server. This vulnerability affects versions 0.8.5 and above of dompdf, with no fix currently available. To mitigate this issue, developers can disable the loading of custom fonts or restrict access to the Composer install location, or use alternative libraries that do not have this vulnerability. The vulnerability was first identified by researchers who created a working demo using the php-goof application on a Snyk GitHub repo, showcasing how an attacker could exploit it to execute arbitrary PHP code.

Infrastructure drift detection is crucial for maintaining secure cloud environments, as it helps identify deviations from desired configurations. This article explores the principles of drift detection, different kinds of drift, and tools to help detect drift with a simple example using Hashicorp Terraform. The three tools discussed are terraform plan, CloudQuery, and driftctl. Each tool has its strengths and weaknesses, but all can be useful in managing infrastructure drift.

A software bill of materials (SBOM) is a complete list of all software components used across an organization, including third-party open source libraries, vendor-provided packages, and first-party artifacts built by the organization. Maintaining an up-to-date SBOM is crucial to track license and security risks associated with software components, ensuring rapid software development can be kept up with changing components and their versions. The use of open source software has increased significantly, making it essential for developers to understand the impact on supply chain security. Security concerns include vulnerabilities in third-party libraries, such as event-stream and Log4Shell, which can lead to security incidents if not addressed promptly. Developers need to be aware of legal implications of using software components, including copyleft licenses like GPL, and ensure they are using permissive licenses like MIT. A software bill of materials is essential for standardizing open source library usage, providing insights into package health, and accelerating supply chain security readiness. By maintaining an up-to-date SBOM, developers can mitigate concerns of software supply chain security across their entire software development lifecycle. Tools like Snyk provide solutions for generating SBOMs and managing license compliance, ensuring secure open source dependencies.

The "Dirty Pipe" Linux vulnerability (CVE-2022-0847) is a kernel-level flaw that allows any process to modify files regardless of their permission settings or ownership, posing a significant risk to containerized applications. Upgrading the host operating system to one of the specified kernel versions (5.16.11, 5.15.25, or 5.10.102) is the only known fix for this vulnerability. Container images are particularly vulnerable due to the use of read-write layers that can be modified by malicious actors, even if the volume was mounted with the `:ro` flag set. The vulnerability can also be exploited in host-mounted volumes, allowing attackers to gain elevated privileges and bypass normal protections.

Infrastructure drift refers to the difference between what's defined in your Infrastructure as Code (IaC) configuration and the real-time state of infrastructure in the cloud. This can be caused by human input, poor configuration, applications making unwanted changes, or other factors. Drift detection is a continuous process that identifies deviations from IaC configurations that pose security risks to organizations. If left unmanaged, drift can lead to data breaches, application downtime, and deployment failures. However, with effective drift management, organizations can standardize infrastructure setup, reduce errors, and improve security controls. A comprehensive approach to IaC security includes increasing IaC coverage, adopting a tool for scanning configurations during development and build pipelines, leveraging IaC to detect synchronized infrastructure, employing an open-source drift detection tool, taking action on findings, and closing the feedback loop. When choosing a drift management tool, consider factors such as access levels and least-privileged policies to ensure effective security.

A virtual Chief Information Security Officer (vCISO) is a part-time or remote security practitioner who offers expertise to an organization on a temporary or ongoing basis, providing benefits such as cost savings and access to security expertise without adding a full-time employee. vCISOs can be hired through talent agencies or freelance arrangements, and their role can vary from short-term to long-term based on the organization's needs. They can assist with tasks such as security policy development, risk assessment, compliance, and incident resolution, offering flexibility and scalability for companies that want to scale at lightning speed while maintaining security standards. With a vCISO program, organizations can reap the benefits of having a CISO without the long-term commitment and cost associated with hiring a full-time employee, making it an attractive option for businesses looking to enhance their security posture.

This International Women’s Day, members of SnykHer reflect on the theme #BreakTheBias, which means challenging internal biases and promoting a diverse, equitable, and inclusive environment. They share personal experiences and insights on how to break unconscious assumptions, value differences, and celebrate individuality. The group emphasizes the importance of paying it forward, reflecting on past achievements, and calling for change and action to overcome future challenges. By recognizing and addressing bias, individuals can create a more open-minded and inclusive world that benefits everyone.

The Payment Card Industry Data Security Standard (PCI DSS) is a set of guidelines to secure sensitive data, particularly in the payments industry. To achieve PCI compliance, organizations must implement various security measures, including installing and maintaining firewalls, protecting stored cardholder data through encryption and hashing, and restricting access to authorized personnel. The PCI compliance requirements cover aspects of software development lifecycle (SDLC) and infrastructure, emphasizing the need for secure systems, applications, and networks. Automation of security scanning with tools like Snyk can streamline the process of identifying vulnerabilities and ensuring compliance. By integrating Snyk into CI/CD pipelines, organizations can automatically scan their code, detect issues, and provide remediation advice, making it easier to maintain PCI compliance.

The Snyk and Bitbucket best practices cheat sheet provides guidance on securely managing and storing code in Bitbucket, continuously monitoring for potential vulnerabilities using Snyk, and implementing strong access controls to protect against human errors and unauthorized access. The seven best practices outlined include never storing credentials in code or configs, removing sensitive data, tightly controlling access, adding a SECURITY.md file, validating Bitbucket apps, receiving security tips as part of the workflow with code insights, and adding security testing to pull requests. These measures can help prevent security breaches, protect intellectual property, and ensure that development teams receive timely security insights.

Container monitoring is a practice that collects metrics and tracks the health of containerized applications and microservices architectures to ensure security, performance, and availability. It's a subset of container observability and helps DevOps teams reduce mean time to recovery (MTTR) of performance issues, meet critical KPIs, and troubleshoot root cause analysis. However, traditional monitoring tools often struggle with distributed microservices environments, making cloud-native monitoring tools necessary. A suitable container monitoring tool should provide an overview of the application and infrastructure components, correlate logs and system events, and visualize the topology of the container ecosystem. Advanced features like automated resource utilization recommendations are also important. Container scanning can help DevSecOps teams proactively find new vulnerabilities in custom code, open-source dependencies, containers, and Dockerfiles. A developer-first container security approach complements container monitoring by empowering developers to fix security issues through direct guidance and automating fixes through pull requests.