June 2022 Summaries

Announcing customized role-based access controls for Snyk Snyk has introduced a new customizable role-based access control (RBAC) model, allowing Group Admins to create their own custom roles and assign specific permissions to them. This feature is designed to provide the right people with the right access to the right resources at the right time, aligning with an organization's internal structure and access policies. The new RBAC model builds upon the principle of least privilege and provides flexibility in managing Snyk access within organizations. Key features include easy-to-use role creation, flexible permission assignment, service account support, and customized SSO setup. This update aims to empower developers to take more responsibility for securing their applications while enabling security teams to guide them through the process, striking a fine balance between security and developer productivity. The new feature is available on the Enterprise plan, with future improvements planned to include group-level permissions, multi-group support, and API support.

Snyk is now hosting its developer security platform in the EU with regional data residency, providing a secure way for companies to store their data within EU borders while using Snyk's platform to secure their applications. This move aligns with growing trends of digital transformation and cloud adoption, as well as increasing regulatory demands on data governance and processing. With this new deployment option, customers can enjoy fast time-to-value, superior uptime, performance, and resiliency, all while adhering to leading international standards of data security and privacy. Snyk's commitment to enterprise-grade security and compliance continues to expand with the addition of support for data residency in additional regions around the world.

This GitHub Actions workflow automates building a secure CI/CD pipeline for a Java Spring-Boot application, integrating security scanning using Snyk and ensuring vulnerability-free deployment to production. The workflow consists of three main jobs: `build`, `opensource-security` and `code-security` which run in parallel, and a fourth job `release` that publishes the package to GitHub after successful completion of the previous jobs. The workflow uses Snyk's predefined actions for security scanning, including Open Source and Code tests, and integrates with Maven for building and releasing the application.

Safely handling containers involves understanding the importance of secure container formats, prioritizing vulnerability fixes, and automating analysis to minimize risks. Developers can leverage tools like Snyk Container to identify potential security issues in their applications, prioritize fixes based on severity scores, and automate updates to reduce risk. By adopting a developer-first approach to container security, teams can break down barriers between development and security teams, ensuring that both groups work together to create safer software applications.

The use of open source software is widespread in modern applications, with 70-90% of any piece of modern software including open source code. Open source libraries often build upon other open source libraries, creating a complex tree of dependencies that introduces many layers of code into applications, increasing the risk of vulnerabilities. Many organizations are unprepared to deal with these risks, with 41% having low confidence in their open source software security and 51% lacking an open source security policy. The average application in development contains 49 vulnerabilities and 69 dependencies, and it takes more than double the time to fix vulnerabilities compared to 2018. Understanding the scope of potential vulnerabilities in open source packages is crucial for organizations to build protection against those risks and use open source technology efficiently and safely.

This Sunday marks Father's Day in many countries around the world, and Snyk is celebrating by highlighting its amazing dads who share special moments with their kids on social media. The company has a strong company culture that values work-life balance and family, and it encourages employees to celebrate milestones like Father's Day. Snyk also invites interested individuals to explore its open job roles and learn more about the company culture.

Snyk's guide to disclosing pronouns` highlights the importance of gendered pronouns in respectful communication, emphasizing that everyone has and uses them, regardless of their gender identity. Disclosing one's pronouns early and often makes life easier for others, fosters communication and understanding, and helps move away from assumptions and guessing. Listing pronouns in profiles is a simple solution to increase understanding, while apologizing sincerely when mistakes occur is crucial. Every effort towards inclusivity and holistic gender perspectives matters, and organizations like Snyk are taking action to support the LGBTQIA+ community through PRIDE campaigns and charitable contributions.

The shift to cloud has created a complex world where everything is code, making security increasingly the responsibility of development teams. Developers must now consider the security of their application, open source dependencies, containers, infrastructure as code, and even the run state configuration. To bring application security and cloud security together, scanning for vulnerabilities during development is crucial, using tools that developers want to use. Monitoring for security threats in production provides valuable insights, but connecting this information back to the source code and configuration files is essential. A comprehensive implementation of cloud native application security requires vulnerability scanning and actionable insights from the code to the cloud and back to the code again. This can be achieved with a unified platform that combines application security, configuration security, and cloud security, such as Snyk, which unites cloud security and configuration security, scans all components of the cloud native application stack, and delivers runtime insights back to engineers.

Kubernetes is a powerful platform for container orchestration but lacks built-in runtime security measures. To enhance the security of your Kubernetes clusters, consider implementing network policies, role-based access control (RBAC), policy admission control, secrets management, audit logs, and ephemeral containers. Network policies allow you to fine-tune network behavior around containers, while RBAC helps manage permissions at the pod or cluster level. Admission controllers enforce rules that address specific attack vectors, and secrets management tools like Vault and CyberArk can store sensitive information securely. Audit logs provide a way to analyze threats using auditing tools like Falco, and ephemeral debug containers help with troubleshooting without compromising security. By incorporating these strategies into your Kubernetes deployments, you can significantly reduce the risk of security breaches and unauthorized access.

Snyk and CISPA collaborated on security research, identifying vulnerabilities in JavaScript and NodeJS environments, including sandbox escape gadgets and type-confusion issues in native NodeJS extensions. The collaboration resulted in the disclosure of several vulnerabilities, including CVE-2021-23771 and CVE-2022-21144, with Snyk's assistance in issuing CVEs and notifying maintainers. The partnership aims to make the open-source world safer for everyone, calling on other academic institutions to collaborate with Snyk to achieve this goal.

Open Policy Agent (OPA) is an open-source, general policy engine that enables organizations to define policies as code and enforce them across various systems, including microservices, API gateways, CI/CD pipelines, and Kubernetes. OPA's policy language, Rego, allows developers to write scalable and declarative rules for different types of services. Rego is a high-level language that works with JSON data, making it suitable for use in various systems. By using OPA and Rego, organizations can improve the security and governance of their software systems, reduce the risk of policy changes, and make it easier to maintain and scan policies for vulnerabilities.