March 2023 Summaries

There is a significant data leak in the Netherlands, with numerous prominent companies affected, including VodafoneZiggo and NS, resulting in substantial exposure of customer data for millions of Dutch consumers. This incident highlights the importance of developers taking responsibility seriously to ensure scalability, maintainability, and security in their software systems. Common vulnerabilities such as cross-site scripting and SQL injection are still prevalent, emphasizing the need for education and awareness among developers to tackle these problems. Developers can take proactive measures to protect their applications by educating themselves on common vulnerabilities, using tooling to scan for security issues, correctly reviewing code, keeping dependencies up-to-date, refining build and release systems, monitoring applications, and collaborating with others to implement secure coding practices.

Avoiding mass assignment vulnerabilities in Node.js is crucial to prevent SQL injection attacks and protect sensitive data. Mass assignment occurs when properties are not filtered when binding client-provided data to data models, allowing attackers to create additional objects and modify properties that should be immutable. Node.js applications can be vulnerable to mass assignment due to the use of third-party packages from the npm registry. To defend against mass assignment attacks, developers must remove sensitive fields from user models, use schema validation for user input, and limit acceptable POST request variables. Additionally, using robust solutions like Zod can help prevent prototype pollution and weak validation mechanisms. By implementing these measures, Node.js developers can protect their applications from mass assignment vulnerabilities.

This article discusses the importance of securing the web and its various components, including secure transport, server-side vulnerabilities, client-side vulnerabilities, software supply chain, advanced security specs, and the need for better communication between web developers and security experts. The author emphasizes that security is a prerequisite for privacy and that users' trust can be easily subverted by bad actors. The article highlights the importance of thinking about security in terms of a supply chain, using tools like vulnerability scanning and monitoring, and being aware of emerging threats like cross-site scripting vulnerabilities and phishing attacks. It also discusses the need for more communication between web developers and security experts to implement security best practices and bring security analysis front and center.

The landscape of malicious open-source packages continues to evolve, with Snyk identifying over 3,600 malicious packages in 2024 and more than 1,000 new cases so far in 2025. The primary targets are npm (3,000+) and PyPI (600+), with JavaScript being the most affected ecosystem. Malicious packages can pose a significant risk to developers, including those that require user interaction beyond downloading the package, which can steal sensitive information from the target's machine. To avoid falling victim to malicious packages, developers should verify package names before installation, scan their projects regularly, and inspect the source code of downloaded packages for suspicious indicators. While the number of malicious packages is increasing, open-source security organizations and the community are developing automation and ML tools to catch these packages on time, and cooperation among peers and experts is crucial in this "malicious packages battle".

The recent PulseMeter Report highlights concerns over software supply chain attacks and the need for organizations to detect and deter such threats. The report shows that 78% of respondents are worried about software supply chain attacks, with many already using software bill of materials (SBOMs) to identify potential vulnerabilities. However, SBOMs alone are not enough, and a joint effort between security and development teams is necessary to secure code. The report also emphasizes the importance of open source security, particularly in manual processes, where automated SBOM-generating technology can provide improved vulnerability tracking. Ultimately, securing software supply chain requires a dynamic approach at all stages, from component integration to deployment.

The Biden-Harris administration has released a National Cybersecurity Strategy, which outlines their vision for securing the nation's digital infrastructure and ensuring the safety of American citizens online. The strategy consists of five main pillars: Defend critical infrastructure, Disrupt and dismantle threat actors, Shape market forces to drive security and resilience, Invest in a resilient future, and Forge international partnerships to pursue shared goals. The strategy also calls for fundamental shifts in rebalancing the responsibility to defend cyberspace, with the digital ecosystem's most capable actors taking on a more significant share of the burden when it comes to mitigating cyber risk. Key highlights include enhancing supply chain security, improving incident response and recovery, promoting cybersecurity workforce development, and strengthening partnerships with the private sector.

The Docker project has come a long way since its introduction in 2013, revolutionizing the way developers build, ship, and run applications. The community around Docker has grown significantly, with many people adopting containers as a key part of their work. The benefits of containers have been widely recognized, including simplified deployment pipelines, improved scalability, and reduced costs. However, there were also challenges in getting teams to adopt containers, with some individuals struggling to convince others of the value proposition. As the years went on, more and more people started to see the potential of containers, especially with the advent of container orchestration platforms like Kubernetes, Mesosphere, Rancher, Swarm, and Nomad. These platforms have played a crucial role in pushing containers over the edge, making them a mainstream technology. The Docker community has been instrumental in driving innovation and adoption, with many individuals having their careers changed by the project. The Docker project's 10-year anniversary is a testament to its enduring impact on the tech industry.

AWS is a dominant cloud provider with 40.8% market share, but common misconfigurations can lead to security breaches or gaps in infrastructure. Using the root user as the main AWS account user is a major no-no, as it leaves all AWS resources and services vulnerable if the credentials become compromised. Instead, use Federation or AWS IAM Users for human users, and create an IAM user for yourself with administrative permissions. Long-living secrets should not be stored in application codebases; instead, rotate access keys every 90 days and delete unused ones. Using * permissions in IAM policies can grant too much access to resources, so assign policies to IAM Users, Roles, Groups, and workload profiles. UnAuthorized AWS services should not be used in accounts, as compliance requirements vary by industry and region. Data stored in AWS storage services should be encrypted with organization-managed encryption keys. Monitoring tools like CloudTrail, CloudWatch, VPC Flow logs, and S3 Access Log should be enabled to detect security breaches. Security groups can control traffic from the internet, but having all services in one account is a recipe for disaster. AWS RDS instances should be configured securely, with limited access to Security Groups and default credentials changed. Finally, prevent dangling DNS entries by regularly auditing processes and monitoring for unknown or expired DNS records.

XSS attacks are a type of vulnerability that can compromise user browser environments, and Django offers built-in protections against them, but it's essential to follow best practices such as quoting dynamic data, avoiding template literals, validating attribute URLs, escaping JavaScript and CSS data, and limiting the use of certain filters. Using dedicated security tools like Snyk can help detect and fix XSS vulnerabilities early in development, reducing the risk of these attacks occurring in Django applications.

To establish a thriving security culture across an organization, a CISO must engage with developer teams early and often, considering the unique mindset of each team type - trailblazing, adopter, or inertia teams. This involves empathy, top-down prioritizations, collaboration, education, recognition, process changes, and tooling integration to drive alignment and success. By understanding developer needs and tailoring security initiatives accordingly, a CISO can foster a culture that encourages dev buy-in, cultural change, and automation to accelerate secure development.

Snyk Code is a real-time SAST tool that helps Java developers identify vulnerabilities, including path traversal in file uploads, through static analysis and machine learning models. It scans code to identify potential security risks, such as using user-specified file paths without proper validation, which can lead to unauthorized access to restricted files and directories. To prevent path traversal vulnerabilities, developers should avoid using `file.getOriginalFilename()` and instead check if the normalized path starts with the intended upload folder. This can be done by normalizing the path and throwing an exception if it does not start with the expected directory. By implementing proper validation and using tools like Snyk Code, developers can help ensure the security of their Java applications and protect against potential attacks.

Snyk is a developer-first security platform that empowers developers to find and fix security issues as they work within their projects, from coding in an IDE to deploying in the cloud. The platform provides tools such as static application security testing (SAST) to scan code within seconds, software composition analysis (SCA) to identify insecure third-party dependencies, and integration with code repositories to monitor and spot new zero-day vulnerabilities. Snyk also automates security checks for containers and deploys in the cloud, providing a unified policy engine for security teams to manage. The platform is designed to make security as straightforward as possible for developers, while also providing centralized visibility and reporting for security teams. By focusing on developer-first security, Snyk aims to simplify the complex software supply chains of modern apps and make it easier for developers to secure their applications from code to cloud.

AWS provides a secure foundation for its services, but customers must take responsibility for securing everything that interacts with the cloud instance, including data, containers, internal users, etc., under the shared responsibility model. The top 10 AWS security risks include insecure S3 buckets, IAM permissions, and lack of cloud security visibility, among others, which can be prevented by implementing best practices such as strong access control measures, data security measures, secure application code, and establishing a Risk Management Framework and Policies. Snyk provides comprehensive security solutions for both applications and cloud environments, including AWS, to help organizations strengthen their cloud security posture.

Cybersecurity hygiene is a set of continuous practices that organizations can implement to keep sensitive data and assets secure from unauthorized individuals and malicious actors, similar to personal hygiene. The threat of cyber attacks has increased, with 3 million more incidents in 2022, making regular cybersecurity hygiene essential to reduce the likelihood of being a victim. Common security gaps include lost or misplaced data, application performance issues, outdated software, poor controls around data access and sharing, and incomplete incident response protocols. Good cybersecurity hygiene provides vulnerability detection and remediation, strengthens security posture, lowers costs, increases productivity, and provides additional time to focus on higher priorities. However, the costs of poor cybersecurity hygiene are high, including government fines, operational downtime, and legal liability. To assess cybersecurity hygiene, organizations should review their methods and practices regularly, consider a cyber resilience assessment, and apply best practices such as identity and access management, encryption, and regular backups. The challenges of implementing good cybersecurity hygiene include monotony, user buy-in, lack of visibility, and cost of implementation and ROI. Various tools can help with cybersecurity hygiene, including IAM tools, EDR solutions, antivirus software, code scanners, and asset management software. Cyber hygiene is also important for developers, as it secures application code and cloud misconfigurations, and resources like Snyk's dev-first tooling provide integrated and automated security that meets governance and compliance needs.

To cultivate secure software development practices, security teams must approach developers with empathy and humility, recognizing that they have multiple responsibilities beyond security. Providing top-down support, automation, and recognition can help motivate developers to prioritize security. Establishing a mindset of shared responsibility among developers can also lead to successful adoption of secure development practices. The key is to understand the nuances of each organization's business and workflows, and tailor a plan accordingly. By following these expert tips, security teams can make secure software development practices a reality and improve overall security posture.