December 2022 Summaries

HSTS headers are an essential security measure for protecting web applications from man-in-the-middle (MITM) attacks. By enabling HSTS, websites can ensure that users' data is encrypted and secure, even when accessing the site via HTTP. The HSTS header tells browsers to use HTTPS on subsequent visits, preventing potential attackers from intercepting data. With only 25% of mobile and 28% of desktop responses including HSTS headers, implementing this security measure in Node.js applications can significantly enhance web security. By setting the max-age parameter, enabling the includeSubDomains directive, and using the preload parameter, developers can effectively secure their web applications against MITM attacks.

How to build a secure API gateway in Node.js` is an article that guides the reader through building a secure API gateway using Node.js and various open-source packages. The article covers key topics such as creating a basic web server, setting up authentication and rate limiting, logging, cross-origin resource sharing (CORS), proxying, and configuration. The final app combines all these features into a single codebase, demonstrating how to build a secure API gateway from scratch using Node.js.

Snyk is a developer security tool that helps developers build secure applications without needing to be security experts themselves. It offers various tools and integrations to improve security, including static analysis for code vulnerabilities in IDEs, pre-commit and CI integrations through the CLI, easy dependency management, online code checking, and continuous learning opportunities. By using Snyk, developers can find and fix security vulnerabilities quickly, reduce development time, and stay up-to-date with the latest security best practices.

Kubernetes NetworkPolicy provides firewall-like control over Pod traffic, addressing Kubernetes’ default behavior in which Pods can communicate freely unless restrictions are configured. The discussion uses a WordPress and database workload to explain how policies select Pods by labels, define ingress and egress rules, permit specific ports and IP ranges, enable required DNS access, and restrict unnecessary internal or external connections, while emphasizing that communication must be permitted in both directions where applicable. Policies are applied through YAML manifests and kubectl, and can be inspected with kubectl describe for validation and troubleshooting. Recommended practices include adopting default-deny rules, limiting communication to explicitly required Pods and namespaces, and periodically reviewing policies as workloads evolve. Because NetworkPolicy enforcement relies on a compatible Container Network Interface implementation, administrators may need to select and install a CNI plugin such as Cilium, Calico, or Antrea to meet their networking and security requirements.

AWS re:Invent 2022 saw a return to in-person events after two years of virtual and hybrid conferences, with over 52,000 attendees. The event featured six keynotes from various AWS executives, including Adam Selipsky, Werner Vogels, and Ruba Borna, covering topics such as sustainability, cloud security, data, and innovation. AWS made several significant security announcements, including the launch of AWS Security Lake, a managed security data lake that combines various security datasets, and Amazon Verified Access, a new secure connectivity service. Other notable updates include Amazon Inspector now scanning AWS Lambda functions for vulnerabilities, Amazon GuardDuty RDS Protection with container runtime threat detection, and AWS Config Rules now supporting proactive compliance. Additionally, AWS released several new features and tools for existing products, such as delegated administrator for AWS Organization, AWS Backup supporting attaching a CloudFormation stack to data protection policies, and Amazon EventBridge Pipes being generally available. The event also featured various sessions and playlists from popular speakers, including CJ Moses, Baker Tilly US, LLP, Robinhood, Netflix, Neiman Marcus, JP Morgan Chase, Molex, Warner Bros Discovery - HBO Max, Delta Airlines, Asurion, Thomson Reuters, NAB, Commonwealth Bank, and others.

Corey Quinn and Clinton Herget discussed various AWS security "horrors" from 2022, including the disconnect between development and production environments, excessive implicit trust in software supply chains, and incomplete Software Bill of Materials (SBOMs). They emphasized the importance of prioritizing meeting people over attending sessions at AWS re:Invent, and highlighted the need for organizations to supplement SBOMs with other best practices. The duo also stressed the significance of understanding an organization's existing processes, working with developers to create frictionless security practices, and empowering human beings to solve security problems rather than just relying on technology. They previewed various AWS security opportunities for 2023, including a focus on developer-first security and increased transparency in software supply chains.

In the spirit of Home Alone, a good application security plan should cover every "floor" of an application, including source code, software supply chain, and infrastructure, with each element playing off others to create a cohesive defense strategy. Automated static application security testing can help identify insecure code, while securing the software supply chain requires specialized tools to scan for vulnerabilities and provide clear remediation steps. The structural elements of the app, such as cloud environment and infrastructure as code, must also be considered and secured with contextual approaches that align with each other. A centralized platform and developer training are necessary to bring all these security efforts together and empower development teams to collaborate on security efforts effectively.

Cloud Security Podcast was launched in 2019 by Ashish and Shilpi to make cloud security knowledge accessible to everyone and create a space for community experts to share their knowledge. The podcast has grown significantly, with over 165 episodes published since its launch, featuring discussions with industry experts on tips, practices, and lessons learned for staying secure in the cloud. In 2022, the podcast partnered with Snyk, allowing Ashish and Shilpi to focus on creating more content and education for cloud security advocates worldwide. The podcast has consistently ranked among top technology podcasts globally, including ranking #71 in USA and #63 in UK in 2022, and was recently awarded the SANS Difference Makers Award for Podcast of the Year. The podcast's lineup is filled with exciting guests and topics, including AWS and Kubernetes Security, and will continue to provide cloud security knowledge and education to its audience.

A new authorization bypass vulnerability (CVE-2022-31692) has been discovered in Spring Security 5, affecting a specific set of use cases. The issue allows non-admin users to access admin pages without proper authorization. To mitigate this security problem, it is advised to upgrade to the newer version of Spring Security (version 5.6.9 or beyond). If updating is not possible, changing the filter definition can also help. Keeping dependencies up to date is crucial for maintaining application security.

Snyk’s webinar on Snyk Open Source highlights the importance of managing vulnerabilities and license risks in the open source dependencies that underpin modern software, particularly following widely publicized issues such as Log4Shell. It argues that security tools should integrate into developers’ existing workflows rather than create excessive alerts or disrupt delivery, and positions open source security as part of a broader application-security strategy encompassing code, containers, infrastructure as code, cloud services, and CI/CD pipelines. The Snyk App for Bitbucket Cloud provides vulnerability details, priority scoring based on factors including exploitability and fixability, and remediation recommendations directly within Bitbucket repositories. Developers can prioritize risks, create pull requests that update vulnerable dependencies to secure versions, or generate prepopulated Jira tickets for security teams, while Snyk also offers integrations with other development and CI/CD tools.

AWS re:Invent’s 11th annual conference returned to full scale in Las Vegas with more than 52,000 attendees, featuring major product announcements and partner activities. A key security announcement was the preview of Amazon Security Lake, a customer-owned data lake that centralizes cloud and on-premises security data in AWS accounts, uses the Open Cybersecurity Schema Framework to normalize information from multiple sources, and supports faster threat detection, investigation, and incident response through existing analytics tools. Snyk promoted its developer security platform through demonstrations, expert consultations, an augmented-reality vulnerability hunt, airport advertising, a networking event with StackHawk, a Neiman Marcus customer session on developer-first security, and a breakfast event with Sysdig, VMware, and HashiCorp. The company also highlighted its AWS partnership, including integrations across AWS development workflows, native AWS CodePipeline support, Amazon Inspector’s use of Snyk’s vulnerability intelligence, AWS competency and service-ready designations, and availability through AWS Marketplace.

CVE-2022-1471 affects SnakeYAML, a widely used Java YAML 1.1 parser included indirectly in many Spring Boot applications, by allowing unsafe deserialization that may result in arbitrary code execution. Its default `Yaml.load()` behavior can instantiate arbitrary classes found on an application’s classpath before an expected type cast occurs, enabling attackers who control YAML input to trigger malicious “gadget” classes or chains, including mechanisms involving JDK classes, remote URLs, LDAP lookups, or reverse shells. Actual exposure depends largely on whether applications deserialize YAML from untrusted sources; framework-managed configuration files are generally less concerning unless attackers can modify them. At the time discussed, maintainers had accepted a proposed blocklist for a future 1.34 release but no comprehensive change to the default behavior, while documentation advised against using `Yaml.load()` on untrusted input and recommended safer constructors. The discussion also emphasizes dependency vulnerability scanning because third-party libraries can introduce exploitable classes and known security flaws.

Azure Bicep is gaining popularity as a replacement for Azure Resource Manager (ARM) templates, and it's essential to understand its security fundamentals to ensure secure configuration deployment. Keeping secrets out of source control is crucial, and methods such as passing parameters via command line or using a parameters JSON file can help achieve this. The `@secure` decorator can be used to secure inputs, but outputs defined in Bicep can pose a risk if not handled properly. To mitigate this, it's recommended to not return secrets as outputs in Bicep. Instead, resources can be accessed using the existing keyword or Key Vault to retrieve secrets securely. Additionally, Snyk's free CLI can be used to perform IaC scans locally against security and compliance standards, even if it doesn't directly support Bicep format.

At the AWS re:Invent conference, Neiman Marcus' Cyber Security Architect Omar Peerzada discussed his team's transition from older security practices to a developer-first security strategy. The company moved from legacy infrastructure and applications to cloud, choosing AWS as their cloud partner and creating a Cloud Center of Excellence responsible for deploying DevSecOps practices across the organization. Neiman Marcus decided that its Cloud Center of Excellence was best suited to run the cloud security program, enabling the team to operate at scale without blocking product teams in the company's fast-paced environment. The team focused on automation and deployed several security designs by default, encrypting everything and ensuring tight identity access management controls for a "zero trust" framework. They also connected cloud security posture management and application security, allowing developers to make security part of their work instead of an afterthought.

Snyk’s open-beta reporting platform provides centralized, flexible access to security data across its products, including Snyk Code, through built-in reports, filtering, sorting, sharing, and export capabilities. Organizations can use the tools to prioritize vulnerability remediation by severity, business criticality, project attributes, or Snyk’s Priority Score, which incorporates factors such as exploit maturity, fix availability, and reachability. Reporting also supports security-program measurement through KPIs and SLAs, including mean time to resolution, identified versus resolved issues, exposure windows, and weekly resolution trends. For compliance efforts, users can document risk assessment and vulnerability-management activities and filter findings by CWE and CVE to align reports with frameworks such as OWASP Top 10 and SANS Top 25. Reports can be shared through persistent URLs or exported as CSV and PDF files for performance reviews, incident response, risk breakdowns, and executive security-posture updates. Snyk recommends that teams train on the reporting features, establish clear measurement goals, and save useful filtered views; the capabilities are available to Business and Enterprise customers through the Snyk Preview settings.

Fastify, a Node.js framework known for performance and plugin-based design, can handle file uploads through the @fastify/multipart plugin, which parses multipart/form-data requests required for HTML forms containing files. The tutorial builds a Fastify project, configures ES modules, registers the multipart plugin, and creates an /upload endpoint that accepts multiple uploaded files and saves them locally in an uploads directory. It uses Node.js streams with pipeline and createWriteStream to write incoming file data directly to disk without buffering entire files in memory, improving efficiency for large uploads and avoiding event-loop blocking. The endpoint can use request.files() when only files are expected or request.parts() to process both files and ordinary form fields, distinguishing them by checking whether a part contains a file stream. Uploads are tested with Tap, form-auto-content, and Fastify’s inject method, allowing multipart POST requests to be simulated without starting a live server and verifying that the endpoint returns a successful status code.

This article discusses best practices for developing React applications with TypeScript, focusing on security concerns. It highlights the importance of strict mode in enforcing type constraints and catching type mismatch errors early. The article also warns about command injection attacks, HTML injections, and the use of opaque types to prevent duplicate values and ensure data integrity. Additionally, it emphasizes the need to sanitize user input when using `dangerouslySetInnerHTML` to prevent Cross-Site Scripting (XSS) attacks. By following these guidelines, developers can build fast and secure React applications with TypeScript.

Rising threats to cloud-native applications have led many organizations to add security products, but excessive tool adoption can create costly complexity, strain understaffed teams, slow development pipelines, fragment reporting, generate alert overload, and hinder developer adoption. As a result, security vendor consolidation has become a priority for many organizations, with the goal of unifying cloud, application, software supply chain, container, and infrastructure security around developers’ existing workflows. Consolidation can improve risk coverage, simplify training and compliance activities, reduce procurement effort and costs, and provide clearer visibility across code and cloud environments. Snyk positions its developer security platform as a consolidated solution that combines code, cloud, container, infrastructure-as-code, and open-source security tools within a shared platform supported by a common security intelligence database.

Mastodon is a free open-source self-hosted federated social network platform that has gained interest due to Twitter's account verification process. To verify an account on Mastodon, users can follow a simplified process by adding a verification link to their website and updating its content accordingly. The verified account status is not directly tied to the user's identity but rather to the ownership of the linked website. However, security concerns exist as malicious users could exploit vulnerabilities in the website to introduce fake verification or steal passwords. Users should be aware that Direct Messages are not encrypted by default on instances and hope for a resolution soon.

The golden era of application security has arrived, with assessment tools and good literature making knowledge more accessible. To make the most of this era, companies should focus on three key areas: setting clear security requirements, embedding a security champion into development teams, and building credibility with developers to create trust. Clearing the way for learning by defining what application security is will help developers understand their role in it. By making development teams self-sufficient with a security champion, teams can become more proactive in securing their applications. Finally, building credibility with developers to create trust is crucial, as many developers are passionate about good quality and want to do the right thing, but often lack mutual understanding with information security professionals.