September 2022 Summaries

Choosing the best Node.js Docker image is crucial as it affects your CI/CD pipeline and security posture. The ideal Node.js Docker image should have a small software footprint, minimal vulnerabilities, and support from the official Node.js team. Out of all options, the most recommended one is node:lts-bookworm-slim due to its stable Long Term Support version of Node.js, reduced size, and compatibility with modern Debian OS. Google's distroless image tag is also a good choice if your DevOps team can support custom base images.

### How Snyk can help secure supply chains per Executive Order M-21-30` The White House released Executive Order M-21-30 on September 14, emphasizing the need for software vendors to follow NIST guidelines for securing any software sold to the US Government. The order requires self-attestation forms that highlight secure development practices. Snyk can help meet compliance standards by providing a holistic view of an organization's application, managing access in different environments and groups, automating vulnerability scanning and remediation, and offering actionable fix advice for vulnerabilities in open-source libraries. Additionally, Snyk supports environments that are developer-friendly, compatible with most popular languages, IDEs, and CI/CD tools, and contributes to the security of various open-source environments through its 2022 State of Open Source Security Report. By using Snyk's platform, organizations can mitigate risk across their software supply chain, making the transition as seamless and secure as possible.

The new Snyk UI introduces standardized UI components, an updated color palette, and breadcrumbs to provide context as users navigate through the application, making it easier to switch between organizations and groups, and providing a more scalable vertical menu orientation.

Snyk has expanded its partnership with HashiCorp by integrating Snyk IaC with Terraform Enterprise, a self-hosted private distribution of Terraform, to empower developers to automate security checks and ensure public cloud environments are secure and compliant pre-deployment. This integration enables developers to treat Terraform like any other form of code and proactively test Infrastructure as Code (IaC) early and continuously monitor infrastructure post-deployment. By implementing IaC security in their pipelines, DevOps and security practitioners reported a median 70% reduction in cloud misconfigurations and a 70% median increase in deployment speed due to automated approvals and less rework required. Snyk IaC trims tedious tasks within developer workflows by identifying and fixing misconfigurations early across Terraform workflows and provides high-level configuration fixes and security advice during the Terraform plan stage, helping organizations combat misconfigurations that can impede the development of cloud native applications and multi-cloud environments.

Ruby is installed on a macOS for local development, avoiding pre-installed Ruby versions that are outdated and may conflict with Homebrew or other installations. The native Ruby interpreter can be checked using the command `1/usr/bin/ruby --version`, and the Ruby folder location is typically in `/usr/bin/ruby` or `/usr/local/bin/ruby`. A virtual environment like rbenv or rvm is used to manage different Ruby versions, fetching source code from the internet, compiling it locally, and making it available under a path. The rbenv tool is recommended for its simplicity and ease of use, but other tools like chruby and ruby-install are also available. To install a new Ruby version using rbenv, one can list available versions with `1curl -fsSL https://github.com/rbenv/rbenv-installer/raw/main/bin/rbenv-doctor | zsh`, install a specific version with `1rbenv install 3.1.2`, and set the global configuration with `1rbenv global 3.1.2`. It is also important to consider security vulnerabilities and use tools like Snyk for gem dependency management and code analysis.

The text discusses the importance of implementing DevSecOps best practices in modern-day development shops, which involves shifting security left and creating collaboration across teams. It highlights eight core principles of DevSecOps that can help integrate security into every development stage, including developer-first security, accuracy, actionability, accountability, work on a DevSecOps maturity model, establish a culture of continuous improvement, measure success, and open communication. The text also emphasizes the need for a cultural and organizational mindset shift, as well as developer-first DevSecOps tools that empower teams to take action in discovering and remediating vulnerabilities. Additionally, it mentions Snyk's security tools that help developers achieve these best practices and provide solutions for integrating security into pre-existing CI/CD pipelines.

Disaster recovery testing methodologies are crucial for assessing the readiness of an organization's disaster recovery plan. These methodologies include checklist testing, walk-through testing, simulation testing, parallel testing, and full-interruption testing. By implementing these strategies, organizations can ensure their recovery plans are robust, effective, and ready to be executed when needed. Regularly conducting disaster recovery tests helps identify gaps, weaknesses, or overlooked details that might present roadblocks during a real crisis.

The importance of disaster recovery testing cannot be overstated as it helps organizations gauge the effectiveness and robustness of their disaster recovery plans, identify flaws, and make necessary amendments to ensure business continuity in the event of a disaster. To achieve this, it is crucial to test multiple scenarios, including equipment failures and malware attacks, regularly to keep pace with system updates and evolution. Documenting everything about the tests, keeping everyone updated, defining metrics such as recovery time objective and recovery point objective, evaluating the results, and testing the plan itself are also essential best practices for disaster recovery testing. By incorporating these measures into a comprehensive testing cycle, organizations can ensure that their disaster recovery plans remain reliable and effective over time.

The OWASP API Security Top 10 provides a framework for securing APIs by identifying the top ten most common threats to APIs and giving recommendations on how to prevent them. The list covers various types of risks, including broken object-level authorization, excessive data exposure, lack of resources and rate limiting, and insufficient logging and monitoring. To address these risks, teams can take steps such as scanning for vulnerabilities, educating their team about API risks, and improving secure coding skills. Tools like Snyk offer resources to help organizations run more secure APIs and provide application and cloud security solutions to support their security posture.

Black Hat USA 2022` was a highly anticipated event in the cybersecurity world, marking its 25th anniversary, with a hybrid model of training and traditional conference events. The conference offered extensive training sessions covering various aspects of cybersecurity, including cloud security, appsec, and IoT. Notable speakers included industry leaders such as Kenneth Geers and Joanna Burkey, who discussed topics like cyber war and the importance of cybersecurity in ESG. The author, a seasoned expert, attended multiple talks, including their own presentation on reshaping cybersecurity career requirements. They also participated in panels and discussions with prominent figures, including Wendy Nather and Mikko Hypponen. The event provided an opportunity for networking, learning, and growth, solidifying its position as a premier cybersecurity conference.

Snyk has welcomed its newest cohort of Snyk Ambassadors, a group of security champions who will help developers build more secure applications. These ambassadors come from around the world and have diverse backgrounds in technology, education, and entrepreneurship, bringing expertise in areas such as DevSecOps, cloud native practices, and cybersecurity. They will share their knowledge through various channels, including blog posts, videos, conference talks, and live streams, while also contributing to Snyk's community Discord server and participating in events. The new ambassadors join a growing group of nearly 30 people who have been advocating for developer security and the shift left movement since last year.

Establishing security and compliance standards is crucial for businesses to demonstrate trust and loyalty from their customers, with internationally recognized standards such as ISO 27001, PCI-DSS, and SOC 2 serving as industry benchmarks. To get started, organizations must identify their specific requirements, conduct a gap analysis to assess their current state against the desired framework, establish controls to meet those requirements, and remain aware of evolving compliance standards. A dynamic plan for compliance is essential, with tools like Snyk providing integrated and automated security features that can help meet governance and compliance needs.

SMTP Injection is a vulnerability that occurs when an attacker injects arbitrary SMTP commands as part of an SMTP communication between a client and server, often through injecting CRLF characters into user-controlled parameters without validation or adequate sanitization. This issue can exist in libraries and applications that use the SMTP protocol to send emails, such as third-party libraries like smtp-client, Email MIME, and Net::SMTP, as well as low-level libraries like smtp-channel. The impact of this vulnerability can vary depending on the context of the application affected, including sending copies of emails to a third party, modifying email content, or leveraging the application as a proxy for phishing attacks. To prevent SMTP Injection, developers should validate and sanitize user input, especially in low-level libraries, and ensure that well-known libraries like JavaMail, PHPMailer, and RubyMail prevent this vulnerability by sanitizing CRLF characters. The Python security team has also remediated this issue in their 3.X releases.

This guide provides production-grade best practices for building optimized and secure Node.js Docker images, covering topics such as using explicit and deterministic base image tags, installing only production dependencies, optimizing tooling for performance and security, safely terminating processes, finding and fixing security vulnerabilities, using multi-stage builds, keeping unnecessary files out of the image, mounting secrets into the build image, and securing sensitive information. By following these guidelines, developers can create secure and performant Docker base images for their Node.js applications, ensuring a reliable and scalable application deployment.

The 2022 State of Cloud Security report from Snyk highlights the growing challenges of cloud security as organizations adopt cloud-native tools and processes, creating a larger attack surface for malicious actors. The report reveals widespread cloud security events, with 80% of organizations experiencing at least one severe incident in the past year. Many teams struggle to define clear security goals, with 42% of cloud engineers believing their team is responsible for cloud security, but only 19% of security professionals agreeing. The survey also emphasizes the importance of effective cross-team collaboration and training, as well as the use of infrastructure as code (IaC) to secure cloud environments before applications are deployed. To address these challenges, Snyk aims to empower teams with developer-first security tools, including its new focus on cloud security.

The software development lifecycle (SDLC) at Spotify was redesigned to prioritize security, with Snyk being a key component of this effort. Spotify's SDLC now includes security assessment scans to identify vulnerabilities before they're released, and the company can use Snyk throughout all stages of the SDLC, including design, development, deployment, maintenance, and product delivery. To address the complexities of the software supply chain, Spotify uses Snyk's vulnerability management platform to track the lifecycle of relevant vulnerabilities and provides internal vulnerability policies to ensure that asset owners and operations teams can prioritize and remediate vulnerabilities. With Snyk's automation, Spotify can keep its software up-to-date, providing a base layer of protection against common vulnerabilities. The company prioritizes comprehensiveness and flexibility in its security testing efforts, choosing Snyk for its ability to support multiple languages and package managers and integrate into its existing CI/CD pipeline. By making security scanning simple and seamless, Snyk has helped Spotify build a stronger security program that enables developers to focus on their priorities while putting security into practice.

"Best practices for creating a modern npm package with security in mind" is a tutorial that guides developers through the process of creating and publishing a secure and maintainable npm package using modern best practices as of 2022. The tutorial covers topics such as setting up a project, building for both CommonJS and ECMAScript module formats, setting up and writing unit tests, implementing security checks, automating version management and publishing, and continuous security monitoring with Snyk via GitHub. By following this tutorial, developers can create modern and sustainable npm packages that are ready for production environments and widely consumable by the community or their company.

Onna Technologies, a data centralization software company, integrates security across every facet of their development process by using Snyk and Sysdig to secure the SDLC while saving time and money. The company's Director of Security, Brent Neal, highlights three vital areas their customers expect them to uphold: privacy of individuals and sensitive information, confidentiality of client data and business activities, and compliance with applicable regulations. Onna uses Snyk for complete container security, improving vulnerability management and prioritization efforts, while Sysdig provides threat detection in the production environment. The company also leverages Snyk's software composition analysis to improve their SDLC by making it more secure. Additionally, Onna has adopted DevSecOps, using tools that integrate security seamlessly into their existing processes and workflows, and has implemented container scanning and static application security testing (SAST) to protect customer data and satisfy internal needs. The Snyk + Sysdig integration is expected to refine the company's shift left approach, reduce costs, deliver products faster, and improve security posture.

XML entity vulnerabilities are a security risk that can be exploited by attackers through XML external entity (XXE) injection attacks, which allow them to gain access to files or infrastructure on their target server or network. XXE injections occur when an attacker takes advantage of external entity declarations in an XML document to execute malicious code. This can lead to various vulnerabilities such as data retrieval, server-side request forgery, remote code execution, and out-of-band exfiltration. To prevent these attacks, it is essential to disable support for external entities, use a web application firewall (WAF), implement zero-trust security, run automated XXE vulnerability scans, keep security patches up-to-date, reduce risks with Snyk protection capabilities, and follow best practices in error handling and input validation. By understanding the potential vulnerabilities of XML and taking proactive measures to secure it, developers can prevent these types of attacks and protect their applications from exploitation.

API gateways play a critical role in securing public-facing APIs by acting as a proxy between clients and backend microservices, aggregating responses, and eliminating unnecessary requests. To increase security, API gateways can implement policy enforcement, traffic overload protection, circuit breakers, decoupling of backend services from front-end applications, HTTPS encryption, request validation, logging, rate-limiting, web application firewalls, and designating separate API gateways for different use cases. By following these best practices, organizations can minimize the risk of successful attacks on endpoints and data in transit, mitigating common API threats such as SQL injection, cross-site scripting, and denial of service attacks.

There's a week-long event in Las Vegas where cybersecurity professionals, hackers, blue teamers, red teamers, bug bounty hunters, and cloud security researchers come together to learn, share, and attend conferences such as Blackhat, Defcon, Bsides Vegas, and The Diana Initiative. These events are part of the Hacker Summer Camp, which includes a variety of talks, workshops, and training sessions on cybersecurity and hacking topics. Cloud security is a top focus area at these events, with talks and activities centered around supply chain security, API security, IAM, and cloud security research. The industry is shifting towards more complex and mature cybersecurity issues, and there's a need for hands-on training in cloud security to keep pace with the rapid changes. The community is urging itself to recognize its influence and work together to solve these challenges, as Chris Krebbs aptly put it. With the rise of cloud security research and databases for repositories, there's an increased focus on identifying vulnerabilities and addressing gaps in software supply chain, IAM, and CSP defaults. The industry is also moving towards more automation and hands-on training in cloud security to stay ahead of threats.

The National Security Agency (NSA), Cybersecurity and Infrastructure Security Agency (CISA), and the Office of the Director of National Intelligence (ODNI) recently published a Practice Guide for Developers on Software Supply Chain Security, which covers topics such as secure design, comprehensive testing, and emerging threats. However, the guide has some flaws, including its presentation style, which may not appeal to all developers due to the use of technical jargon and PDF format. To improve future guides, it is suggested that they meet developers where they are, communicate in a developer-friendly way, provide real-life samples, and offer practical resources such as cheat sheets and code examples. The goal is to make security information approachable and actionable for developers, similar to how Snyk has approached the topic in its own materials.

The npm faker package and the unexpected demise of open source libraries refer to the stories of two popular open-source software libraries, Faker and left-pad, which were removed from the npm registry due to various reasons such as environmental concerns, legal disputes, and the maintainer's decision to discontinue the project. The left-pad library, with only 17 lines of code, caused a significant impact on the JavaScript ecosystem when it was suddenly removed, affecting projects like Node.js and Babel. The Faker PHP library, which had been downloaded over 121 million times, was discontinued due to its large size and environmental concerns, with its maintainer, François Zaninotto, opting not to continue maintaining the project. These stories highlight the importance of considering the sustainability and environmental impact of open-source software libraries, as well as the need for developers to be aware of their dependencies and take proactive measures to ensure the security and stability of their projects. Maintainers like Marak Squires, who removed the source code from his library, are making statements about open-source sustainability, but it's unclear if anyone actually felt the pain of these actions. The article concludes with practical recommendations for developers to manage their open-source library infrastructure, vet open-source libraries, use lockfiles to pin dependencies, and pin transitive dependencies.