December 2022 Summaries

HSTS headers are an essential security measure for protecting web applications from man-in-the-middle (MITM) attacks. By enabling HSTS, websites can ensure that users' data is encrypted and secure, even when accessing the site via HTTP. The HSTS header tells browsers to use HTTPS on subsequent visits, preventing potential attackers from intercepting data. With only 25% of mobile and 28% of desktop responses including HSTS headers, implementing this security measure in Node.js applications can significantly enhance web security. By setting the max-age parameter, enabling the includeSubDomains directive, and using the preload parameter, developers can effectively secure their web applications against MITM attacks.

How to build a secure API gateway in Node.js` is an article that guides the reader through building a secure API gateway using Node.js and various open-source packages. The article covers key topics such as creating a basic web server, setting up authentication and rate limiting, logging, cross-origin resource sharing (CORS), proxying, and configuration. The final app combines all these features into a single codebase, demonstrating how to build a secure API gateway from scratch using Node.js.

Snyk is a developer security tool that helps developers build secure applications without needing to be security experts themselves. It offers various tools and integrations to improve security, including static analysis for code vulnerabilities in IDEs, pre-commit and CI integrations through the CLI, easy dependency management, online code checking, and continuous learning opportunities. By using Snyk, developers can find and fix security vulnerabilities quickly, reduce development time, and stay up-to-date with the latest security best practices.

AWS re:Invent 2022 saw a return to in-person events after two years of virtual and hybrid conferences, with over 52,000 attendees. The event featured six keynotes from various AWS executives, including Adam Selipsky, Werner Vogels, and Ruba Borna, covering topics such as sustainability, cloud security, data, and innovation. AWS made several significant security announcements, including the launch of AWS Security Lake, a managed security data lake that combines various security datasets, and Amazon Verified Access, a new secure connectivity service. Other notable updates include Amazon Inspector now scanning AWS Lambda functions for vulnerabilities, Amazon GuardDuty RDS Protection with container runtime threat detection, and AWS Config Rules now supporting proactive compliance. Additionally, AWS released several new features and tools for existing products, such as delegated administrator for AWS Organization, AWS Backup supporting attaching a CloudFormation stack to data protection policies, and Amazon EventBridge Pipes being generally available. The event also featured various sessions and playlists from popular speakers, including CJ Moses, Baker Tilly US, LLP, Robinhood, Netflix, Neiman Marcus, JP Morgan Chase, Molex, Warner Bros Discovery - HBO Max, Delta Airlines, Asurion, Thomson Reuters, NAB, Commonwealth Bank, and others.

Corey Quinn and Clinton Herget discussed various AWS security "horrors" from 2022, including the disconnect between development and production environments, excessive implicit trust in software supply chains, and incomplete Software Bill of Materials (SBOMs). They emphasized the importance of prioritizing meeting people over attending sessions at AWS re:Invent, and highlighted the need for organizations to supplement SBOMs with other best practices. The duo also stressed the significance of understanding an organization's existing processes, working with developers to create frictionless security practices, and empowering human beings to solve security problems rather than just relying on technology. They previewed various AWS security opportunities for 2023, including a focus on developer-first security and increased transparency in software supply chains.

In the spirit of Home Alone, a good application security plan should cover every "floor" of an application, including source code, software supply chain, and infrastructure, with each element playing off others to create a cohesive defense strategy. Automated static application security testing can help identify insecure code, while securing the software supply chain requires specialized tools to scan for vulnerabilities and provide clear remediation steps. The structural elements of the app, such as cloud environment and infrastructure as code, must also be considered and secured with contextual approaches that align with each other. A centralized platform and developer training are necessary to bring all these security efforts together and empower development teams to collaborate on security efforts effectively.

Cloud Security Podcast was launched in 2019 by Ashish and Shilpi to make cloud security knowledge accessible to everyone and create a space for community experts to share their knowledge. The podcast has grown significantly, with over 165 episodes published since its launch, featuring discussions with industry experts on tips, practices, and lessons learned for staying secure in the cloud. In 2022, the podcast partnered with Snyk, allowing Ashish and Shilpi to focus on creating more content and education for cloud security advocates worldwide. The podcast has consistently ranked among top technology podcasts globally, including ranking #71 in USA and #63 in UK in 2022, and was recently awarded the SANS Difference Makers Award for Podcast of the Year. The podcast's lineup is filled with exciting guests and topics, including AWS and Kubernetes Security, and will continue to provide cloud security knowledge and education to its audience.

A new authorization bypass vulnerability (CVE-2022-31692) has been discovered in Spring Security 5, affecting a specific set of use cases. The issue allows non-admin users to access admin pages without proper authorization. To mitigate this security problem, it is advised to upgrade to the newer version of Spring Security (version 5.6.9 or beyond). If updating is not possible, changing the filter definition can also help. Keeping dependencies up to date is crucial for maintaining application security.

Azure Bicep is gaining popularity as a replacement for Azure Resource Manager (ARM) templates, and it's essential to understand its security fundamentals to ensure secure configuration deployment. Keeping secrets out of source control is crucial, and methods such as passing parameters via command line or using a parameters JSON file can help achieve this. The `@secure` decorator can be used to secure inputs, but outputs defined in Bicep can pose a risk if not handled properly. To mitigate this, it's recommended to not return secrets as outputs in Bicep. Instead, resources can be accessed using the existing keyword or Key Vault to retrieve secrets securely. Additionally, Snyk's free CLI can be used to perform IaC scans locally against security and compliance standards, even if it doesn't directly support Bicep format.

At the AWS re:Invent conference, Neiman Marcus' Cyber Security Architect Omar Peerzada discussed his team's transition from older security practices to a developer-first security strategy. The company moved from legacy infrastructure and applications to cloud, choosing AWS as their cloud partner and creating a Cloud Center of Excellence responsible for deploying DevSecOps practices across the organization. Neiman Marcus decided that its Cloud Center of Excellence was best suited to run the cloud security program, enabling the team to operate at scale without blocking product teams in the company's fast-paced environment. The team focused on automation and deployed several security designs by default, encrypting everything and ensuring tight identity access management controls for a "zero trust" framework. They also connected cloud security posture management and application security, allowing developers to make security part of their work instead of an afterthought.

This article discusses best practices for developing React applications with TypeScript, focusing on security concerns. It highlights the importance of strict mode in enforcing type constraints and catching type mismatch errors early. The article also warns about command injection attacks, HTML injections, and the use of opaque types to prevent duplicate values and ensure data integrity. Additionally, it emphasizes the need to sanitize user input when using `dangerouslySetInnerHTML` to prevent Cross-Site Scripting (XSS) attacks. By following these guidelines, developers can build fast and secure React applications with TypeScript.

Mastodon is a free open-source self-hosted federated social network platform that has gained interest due to Twitter's account verification process. To verify an account on Mastodon, users can follow a simplified process by adding a verification link to their website and updating its content accordingly. The verified account status is not directly tied to the user's identity but rather to the ownership of the linked website. However, security concerns exist as malicious users could exploit vulnerabilities in the website to introduce fake verification or steal passwords. Users should be aware that Direct Messages are not encrypted by default on instances and hope for a resolution soon.

The golden era of application security has arrived, with assessment tools and good literature making knowledge more accessible. To make the most of this era, companies should focus on three key areas: setting clear security requirements, embedding a security champion into development teams, and building credibility with developers to create trust. Clearing the way for learning by defining what application security is will help developers understand their role in it. By making development teams self-sufficient with a security champion, teams can become more proactive in securing their applications. Finally, building credibility with developers to create trust is crucial, as many developers are passionate about good quality and want to do the right thing, but often lack mutual understanding with information security professionals.