June 2022 Summaries

Snyk announced organizational changes intended to improve customer service, operational efficiency, and resilience amid economic uncertainty following a period of rapid expansion in which it more than doubled its customer base, tripled its workforce, acquired six companies, and expanded to five developer-security products. The company reduced its global workforce by approximately 5% after reassessing roles and skills, while restructuring research and development into Application Products, Cloud Products, and a Security division focused on security professionals. Its go-to-market organization was also reorganized around retaining customers, acquiring new ones, and expanding existing accounts, with solution engineering and customer success incorporated into a unified customer-experience model. Snyk has accelerated its target for becoming free-cash-flow positive to 2024, emphasizing a strategy that balances profitability with growth and aims to strengthen the company for future market volatility.

Snyk marked Pride Month 2022 through employee-focused educational, community, and fundraising activities supporting LGBTQIA+ inclusion. Its PRIDE action campaign, run with Impact Tree, exceeded a target of 1,000 actions and triggered a $10,000 donation to OutRight Action International. The company hosted Bianca Lewis in Tel Aviv to discuss her experience as a transgender woman and technology sales leader, while author and activist Matthew Todd led a session on LGBTQIA+ history, progress, and continuing challenges. Employees in several locations also participated in Drag Bingo, raising $800 for LGBTQIA+ organizations. Snyk stated that it will continue its year-round efforts through its Queer@Snyk resource group and donation matching program for eligible social-impact charities.

Announcing customized role-based access controls for Snyk Snyk has introduced a new customizable role-based access control (RBAC) model, allowing Group Admins to create their own custom roles and assign specific permissions to them. This feature is designed to provide the right people with the right access to the right resources at the right time, aligning with an organization's internal structure and access policies. The new RBAC model builds upon the principle of least privilege and provides flexibility in managing Snyk access within organizations. Key features include easy-to-use role creation, flexible permission assignment, service account support, and customized SSO setup. This update aims to empower developers to take more responsibility for securing their applications while enabling security teams to guide them through the process, striking a fine balance between security and developer productivity. The new feature is available on the Enterprise plan, with future improvements planned to include group-level permissions, multi-group support, and API support.

Following the U.S. Supreme Court’s decision to overturn Roe v. Wade, Snyk expressed opposition to the ruling and affirmed its support for employees’ reproductive-health choices. The company said it would confidentially cover travel expenses for employees seeking critical reproductive care, donate $25,000 through Snyk Impact to Planned Parenthood, continue matching eligible employee donations to reproductive-rights nonprofits, and develop health benefits intended to preserve access to reproductive care for employees and their families. Snyk also pledged to support employees who advocate for reproductive rights at federal, state, and local levels.

Snyk is now hosting its developer security platform in the EU with regional data residency, providing a secure way for companies to store their data within EU borders while using Snyk's platform to secure their applications. This move aligns with growing trends of digital transformation and cloud adoption, as well as increasing regulatory demands on data governance and processing. With this new deployment option, customers can enjoy fast time-to-value, superior uptime, performance, and resiliency, all while adhering to leading international standards of data security and privacy. Snyk's commitment to enterprise-grade security and compliance continues to expand with the addition of support for data residency in additional regions around the world.

This GitHub Actions workflow automates building a secure CI/CD pipeline for a Java Spring-Boot application, integrating security scanning using Snyk and ensuring vulnerability-free deployment to production. The workflow consists of three main jobs: `build`, `opensource-security` and `code-security` which run in parallel, and a fourth job `release` that publishes the package to GitHub after successful completion of the previous jobs. The workflow uses Snyk's predefined actions for security scanning, including Open Source and Code tests, and integrates with Maven for building and releasing the application.

Shift-left application security aims to identify and address vulnerabilities, insecure dependencies, and code-quality problems earlier in development, when remediation is generally less costly, but the post argues that many current tools remain reactive because they primarily flag issues after code has been written and committed to build pipelines. It contrasts DevSecOps, which integrates security into DevOps processes, with a security-first SecDevOps approach that more directly equips developers to make secure decisions during coding. The author presents Snyk’s IDE plugins as a way to move security controls further left by alerting developers in real time to open-source dependency vulnerabilities, code security issues, and code-quality concerns within their development environments. By enabling developers to identify, remediate, and validate fixes before committing code, the plugins are described as supporting a more proactive and developer-centered application security workflow.

Safely handling containers involves understanding the importance of secure container formats, prioritizing vulnerability fixes, and automating analysis to minimize risks. Developers can leverage tools like Snyk Container to identify potential security issues in their applications, prioritize fixes based on severity scores, and automate updates to reduce risk. By adopting a developer-first approach to container security, teams can break down barriers between development and security teams, ensuring that both groups work together to create safer software applications.

The use of open source software is widespread in modern applications, with 70-90% of any piece of modern software including open source code. Open source libraries often build upon other open source libraries, creating a complex tree of dependencies that introduces many layers of code into applications, increasing the risk of vulnerabilities. Many organizations are unprepared to deal with these risks, with 41% having low confidence in their open source software security and 51% lacking an open source security policy. The average application in development contains 49 vulnerabilities and 69 dependencies, and it takes more than double the time to fix vulnerabilities compared to 2018. Understanding the scope of potential vulnerabilities in open source packages is crucial for organizations to build protection against those risks and use open source technology efficiently and safely.

This Sunday marks Father's Day in many countries around the world, and Snyk is celebrating by highlighting its amazing dads who share special moments with their kids on social media. The company has a strong company culture that values work-life balance and family, and it encourages employees to celebrate milestones like Father's Day. Snyk also invites interested individuals to explore its open job roles and learn more about the company culture.

Juneteenth commemorates June 19, 1865, when federal troops arrived in Galveston, Texas, and informed the remaining enslaved people that they were free, two years after the Emancipation Proclamation had been issued. The author reflects on learning about the holiday only in adulthood and argues that its limited treatment in historical education obscures the delayed and incomplete reality of emancipation. While welcoming broader recognition since 2020, the piece cautions against reducing Juneteenth to a commercialized long weekend and emphasizes education, remembrance, and continued commitment to racial justice. It highlights the Black-ish Juneteenth episode as an example of accessible historical storytelling and describes Snyk’s Black@Snyk campaign, educational resources, charitable-giving partnership, and donation matching as efforts to encourage meaningful action.

Snyk's guide to disclosing pronouns` highlights the importance of gendered pronouns in respectful communication, emphasizing that everyone has and uses them, regardless of their gender identity. Disclosing one's pronouns early and often makes life easier for others, fosters communication and understanding, and helps move away from assumptions and guessing. Listing pronouns in profiles is a simple solution to increase understanding, while apologizing sincerely when mistakes occur is crucial. Every effort towards inclusivity and holistic gender perspectives matters, and organizations like Snyk are taking action to support the LGBTQIA+ community through PRIDE campaigns and charitable contributions.

The shift to cloud has created a complex world where everything is code, making security increasingly the responsibility of development teams. Developers must now consider the security of their application, open source dependencies, containers, infrastructure as code, and even the run state configuration. To bring application security and cloud security together, scanning for vulnerabilities during development is crucial, using tools that developers want to use. Monitoring for security threats in production provides valuable insights, but connecting this information back to the source code and configuration files is essential. A comprehensive implementation of cloud native application security requires vulnerability scanning and actionable insights from the code to the cloud and back to the code again. This can be achieved with a unified platform that combines application security, configuration security, and cloud security, such as Snyk, which unites cloud security and configuration security, scans all components of the cloud native application stack, and delivers runtime insights back to engineers.

Kubernetes is a powerful platform for container orchestration but lacks built-in runtime security measures. To enhance the security of your Kubernetes clusters, consider implementing network policies, role-based access control (RBAC), policy admission control, secrets management, audit logs, and ephemeral containers. Network policies allow you to fine-tune network behavior around containers, while RBAC helps manage permissions at the pod or cluster level. Admission controllers enforce rules that address specific attack vectors, and secrets management tools like Vault and CyberArk can store sensitive information securely. Audit logs provide a way to analyze threats using auditing tools like Falco, and ephemeral debug containers help with troubleshooting without compromising security. By incorporating these strategies into your Kubernetes deployments, you can significantly reduce the risk of security breaches and unauthorized access.

Snyk and CISPA collaborated on security research, identifying vulnerabilities in JavaScript and NodeJS environments, including sandbox escape gadgets and type-confusion issues in native NodeJS extensions. The collaboration resulted in the disclosure of several vulnerabilities, including CVE-2021-23771 and CVE-2022-21144, with Snyk's assistance in issuing CVEs and notifying maintainers. The partnership aims to make the open-source world safer for everyone, calling on other academic institutions to collaborate with Snyk to achieve this goal.

Open Policy Agent (OPA) is an open-source, general policy engine that enables organizations to define policies as code and enforce them across various systems, including microservices, API gateways, CI/CD pipelines, and Kubernetes. OPA's policy language, Rego, allows developers to write scalable and declarative rules for different types of services. Rego is a high-level language that works with JSON data, making it suitable for use in various systems. By using OPA and Rego, organizations can improve the security and governance of their software systems, reduce the risk of policy changes, and make it easier to maintain and scan policies for vulnerabilities.