April 2023 Summaries

This summary provides an overview of finding and fixing vulnerabilities in software supply chains, particularly with regards to open source dependencies and container images. To find vulnerabilities, tools such as Snyk can be used to scan for occurrences of vulnerable libraries and packages, including scanning source code repositories and container image registries. A centralized view of the entire ecosystem is crucial in identifying where vulnerabilities exist. Once identified, fixing vulnerabilities often involves waiting for updates from vendors or project maintainers. Tools like Snyk Container can help navigate image dependency trees to find better base images, enabling more secure builds. The process also requires preparation and communication to address vulnerabilities effectively.

The example Java code retrieves user input from an HTTP request parameter, writes it directly to the HttpServletResponse object, and then displays it on a web page without proper validation or sanitization, making it vulnerable to Cross-Site Scripting (XSS) attacks. Reflective XSS is a type of attack where malicious code is injected into the user's input, which is then executed by other users who view the web page. Stored XSS is another type of attack where malicious code is stored on the server and served to all users who access the affected page. Snyk Code identifies two distinct XSS security issues in this method and provides solutions to mitigate them, including using libraries like Apache Commons Text to encode user input and prevent malicious code execution. Templating frameworks like Thymeleaf can also help protect against XSS vulnerabilities by encoding user input that is included in the rendered HTML. It's essential for developers to identify and address XSS vulnerabilities early in the development process and use the right tools, such as Snyk Code, to catch security issues before they reach production.

Multi-cloud security is the practice of securing applications, data, and infrastructure across multiple cloud environments. Implementing a comprehensive security framework requires considering identity and access management, data security, network security, compliance, incident response, and cloud provider security. To avoid vendor lock-in and ensure flexibility, companies use a multi-cloud approach to leverage different cloud providers' strengths while mitigating their weaknesses. This approach offers benefits such as increased redundancy and resilience, improved performance and scalability, cost savings, and optimized cloud spending. However, it requires additional management and monitoring to ensure effective workload distribution and data security. Organizations must address unique security challenges, including data breaches, compliance challenges, cloud misconfigurations, lack of visibility, shadow IT, and vendor lock-in, by implementing a comprehensive multi-cloud security strategy that combines security best practices, risk assessments, and security tools and technologies.

API security is a crucial aspect of application security, focusing on securing API services to prevent data breaches or misuse. APIs are vulnerable to various threats, including implementation errors, lack of rate limiting, and insecure authentication methods. Implementing best practices such as using API gateways, proper authentication, encryption, and regular security testing can significantly enhance API security. Conducting regular security tests and scans, collecting API log data, establishing quotas and throttling API requests, educating the team about OWASP API security top 10, validating and sanitizing API data, and updating API services and documentation are also essential to protect APIs from malicious access and control. Leveraging tools like Snyk can help identify vulnerabilities and maintain API security.

Implementing adequate software supply chain security is challenging due to the growing complexity of modern applications, increasing sophistication of attackers, and the need for rapid business deployment. To address these challenges, experts recommend enabling developers to secure their applications throughout the entire development process, from code to production, by adopting a workflow mentality rather than an audit mindset, requiring both bottom-up and top-down efforts, providing frictionless developer experiences, and supporting security teams through education and training. Establishing a culture of collaboration between development and security teams is crucial for making developer security adoption a reality across organizations.

You should be prepared to check your physical hosts, virtual machines, cloud instances, container images, and source code for vulnerable libraries, as well as considering the software dependency trees of your applications and potentially even including OpenSSL libraries directly in your application builds. This includes taking into account ephemeral and dynamic workloads, such as those running on containers or serverless platforms, where vulnerabilities can be present in hundreds or thousands of images. You should also consider using tools like Snyk to monitor your software supply chain for vulnerabilities and provide fix advice for fast resolutions.

Insecure deserialization in Node.js can expose sensitive data and allow attackers to manipulate serialized objects, leading to arbitrary code execution (ACE) vulnerabilities. The `node-serialize` package is vulnerable to insecure deserialization due to its ability to serialize functions, making it susceptible to prototype pollution attacks. By using the `serialize-javascript` package, which sanitizes user inputs before serialization, developers can prevent these types of attacks. Additionally, avoiding deserialization of user inputs altogether is the best way to protect against insecure deserialization vulnerabilities. The Snyk Code extension can help identify potential security issues in code and recommend fixes, including the use of `serialize-javascript` to secure deserialization processes.

Developer-centric DAST is a type of dynamic application security testing that focuses on integrating security testing into the software development lifecycle, shifting security testing left in the development process to detect and remediate vulnerabilities early. This approach complements static application security testing (SAST) by providing a more comprehensive approach to application security testing. Dev-centric DAST can be integrated into the development process, allowing developers to test their code for security vulnerabilities right after they build it, and provides developers with immediate feedback on the security of their code. By automating security testing and incorporating it into the continuous integration and delivery (CI/CD) pipeline, dev-centric DAST enables developers to address security vulnerabilities in real-time, minimizing the impact of security issues and reducing the likelihood of vulnerabilities going undetected. Dev-centric DAST is a modern approach that can help organizations improve their security posture, reduce the risk of security breaches and data loss, and meet compliance requirements.

Platform engineers play a crucial role in an organization's security program, as their work has a significant impact on the product's security posture. Despite this, their role remains ill-defined and they face various challenges such as hard-to-secure infrastructure, complex change management, and vulnerabilities in infrastructure that are costly to patch. To address these challenges, platform engineers need tooling to find misconfiguration early in the software development lifecycle (SDLC) and assistance in improving the design of their paved paths. Emerging best practices and investments in platform maturity will eliminate and mitigate security risks, enabling application developers to fix application vulnerabilities at a lower cost and higher speed than ever before.

Snyk’s Evolution: A Message From CEO Peter McKay``` Snyk, a company specializing in developer security, has chosen to adapt to challenging market conditions by evolving its structure and focus. The company will rightsize its GTM organization to prioritize customer success, particularly in the enterprise sector, and solidify its AppSec leadership. Additionally, Snyk aims to simplify its organizational layers to improve agility, speed, and communication with customers. The company remains committed to its developer security market leadership, investing in partner ecosystem growth and investing in its platform to meet evolving customer needs. With these changes, 128 employees are leaving the company, but CEO Peter McKay is confident that Snyk is positioned for long-term success.

Snyk has launched the Snyk Partner Speak Series, a new YouTube playlist featuring videos about technology solutions created in collaboration with its Technology Alliance Partner Program (TAPP) members. These videos highlight how Snyk's platform is integrated into various custom tools and enterprise workflows to advance developer security. The series aims to showcase the latest partner integrations and their potential impact on application and developer-focused software companies building with Snyk solutions. To stay updated, users can subscribe to the Snyk YouTube channel for notifications when new videos are posted, and explore other developments within the TAPP, such as the new Partner Solutions Directory and recently joined members.

The Snyk Docker Desktop Extension has been updated with new features to enhance container image vulnerability scanning, providing base image recommendations, risk-focused vulnerability identification, and integration with Snyk Container workflows for managing approved base images. This update aims to free developers from worrying about base image vulnerabilities, supporting a range of enterprise container workflows and ensuring the security of applications and containers across the software development lifecycle.

5 ways to improve security during digital transformation` The software development industry is experiencing unprecedented growth, pushing developers to deliver faster, with more eye-catching features and better functionality. However, this growth has led to a disparity between development and security teams due to the lack of collaboration and education on both sides. Security teams often struggle to keep up with modern-day development environments, leading to frustration for both teams. To bridge this gap, security teams need to increase awareness, select the right tools, ask the right questions, initiate effective internal practices, and celebrate success. A mindset shift is necessary, creating a culture of collaboration amongst developers, DevOps/platform, and security teams, enabling them to work together effectively.

IaC security is a crucial aspect of DevSecOps, as it prevents configuration drift and automates previously-manual processes. However, IaC can become a huge security risk if not implemented correctly. A new workshop from Snyk, HashiCorp Terraform, and AWS demonstrates how to implement IaC security with a specific suite of tools, providing a seamless experience for developers. The workshop sets up an integrated environment using AWS CodeBuild, HashiCorp Terraform, and Snyk IaC, allowing users to discover and remediate misconfigurations in seconds. Key takeaways include the importance of automated IaC tooling, common security issues with IaC environments, the need for integration within developers' workflows, and the value of remediation guidance provided by security tools.

This solution uses the vm module in Node.js to run a script in a separate context, which allows for better performance and avoids some of the issues encountered with using worker threads. The vm module provides a built-in timeout option, which can be used to limit the execution time of the script. By creating a closure that captures the regex and tag variables, the script can be executed multiple times without having to recreate the context and script every time. The solution has been benchmarked and shows better performance than using worker threads or RE2 objects, with a significant improvement in throughput when a timeout is added.

Snyk has announced several new features at its April '23 SnykLaunch event, including C/C++ expansion for Snyk Code and Open Source, cloud and IaC updates, custom container security, new integrations with enterprise tools like ServiceNow and Dynatrace, and more. The company's focus on developer security aims to empower teams to build applications innovatively and securely, addressing the challenges of modern-day development practices and the complex software supply chain. Key principles of developer security include developer adoption, fixes prioritization, security scale, coverage for the entire app, DevSecOps realization, and a multi-cloud unified platform. Snyk's new features are designed to support these principles, including faster scan times, seamless integration with developers' tools, and actionable results, as well as improved visibility into the software supply chain across enterprise tools. The company aims to pave the way for a developer-centric security experience, enabling teams to build applications securely and innovatively.

Snyk has launched its Open Beta for C/C++ support, providing a developer-first application security solution that enables quick issue detection and fix application, revolutionizing security in the C/C++ ecosystem. Snyk's C/C++ support addresses the pain points of dependency management and secure coding challenges faced by modern C++ developers, offering low developer productivity due to slow tools and lack of proper data flow analysis. The platform provides fast, actionable fixes for developers and gives security teams full visibility into open source dependencies and license terms, ensuring compliance. Snyk's modern approach offers seamless integrations into developer workflows, easy-to-understand messages, and data flow analysis on top of the original code, making it easy for developers to find and fix security issues in less time.

Custom Base Image Recommendations (CBIR) is a feature of Snyk Container that provides organizations with more flexibility and automation capabilities, allowing them to leverage CBIR in their CI/CD pipelines. This feature extends the powerful base image recommendations at the core of Snyk Container, making recommendations available to organizations and enterprises that follow more advanced DevOps workflows. It helps users find better images to start from, eliminating full swaths of vulnerabilities with a single click, rather than patching individual vulnerabilities one at a time. CBIR is particularly useful for advanced DevOps workflows where there is a division of labor between platform teams building curated base images and security teams prioritizing fixes. The feature provides automation for container supply chain workflows, allowing developers to focus on delivering more secure software. Snyk Container's Custom Base Image Recommendations are currently available to customers on the Enterprise Tier but will be available to other tiers in the future.

This blog post discusses the challenges of current cloud security tools that create silos between engineering and security teams, leading to wasted time managing tickets and policy changes in administrative consoles. The ideal approach is to secure cloud infrastructure as code, bringing IaC and cloud security together with a unified policy-as-code engine. Snyk IaC takes a proactive approach by empowering engineering teams to secure the cloud from the start, finding and enabling fixes for misconfigurations in IaC code pre-build and pre-production. This approach improves the risk posture of deployed infrastructure, reduces developer and security rework, and enables developers to secure the entire cloud engineering lifecycle and codify security standards from IaC code to cloud and back to code.

The software development world relies heavily on third-party components, which can bring numerous benefits but also introduce significant risks, particularly in terms of supply chain security. The use of open source packages and containers can lead to vulnerabilities, typosquatting/brandjacking, data management issues, access rights problems, and human error, all of which can compromise the entire software development lifecycle. To mitigate these risks, organizations must implement a range of best practices, including scanning for vulnerabilities, using secure packages, maintaining accurate Software Bills of Materials (SBOMs), implementing Role-Based Access Control (RBAC) policies, and prioritizing team education and training. By leveraging tools like Snyk, which provides visibility into supply chain security issues and offers fix advice for fast resolutions, development teams can come together to secure their software supply chain and prevent lasting repercussions.

Snyk recently hosted a virtual event on stress-free security for developers and operations teams on AWS, covering topics such as developer challenges in cloud-native AppDev, top vulnerabilities from last year, hands-on workshops with industry-leading technology vendors, and practical guidance to help engineering and security teams build a successful DevSecOps workflow. The event featured sessions led by experts who shared their experiences and insights on common mistakes made by developers, the importance of treating backing services as attached resources, identifying critical vulnerabilities, automating security controls, defining and securing infrastructure as code, and cultivating a developer security culture. Attendees could watch the sessions on demand and learn about Snyk's developer security platform, which offers automated security scanning and monitoring to help teams catch security issues early in the development process and fix them before they can be exploited in production.

Snyk has achieved Red Hat Vulnerability Scanner Certification, demonstrating its commitment to providing customers with high security assurance for their applications. The certification validates Snyk's scanning capabilities and effectiveness in detecting vulnerabilities in Red Hat components across multiple layers. With this achievement, customers can rely on Snyk for comprehensive and accurate security scanning of their Red Hat products, enabling them to stay ahead of potential security threats with fewer false positives. This certification enhances the partnership between Snyk and Red Hat, providing customers with access to real-time Red Hat published data from various integration points.

The Snyk Partner Solutions Directory is a new resource that accelerates application engineering projects by promoting secure and efficient software production. It provides a centralized directory of technology-driven solutions created by Snyk and its Technology Alliance Partners (TAPP) members, offering various integrations to customize and automate Snyk security as part of partners' workflows. This directory helps end customers address specific security challenges or requirements, with categories including application security testing, secure code analysis, software supply chain security, continuous monitoring, and more. Several TAPP member companies have integrated their solutions with Snyk's platform to provide enhanced security features, such as appNovi's integration for risk identification and incident response, ArmorCode's correlation with other security tools, and Cortex's integration for full visibility into microservice architecture. The directory aims to help enterprises accelerate application development and delivery life cycles while increasing developer productivity without compromising security.

At Snyk, they view developers as citizens of a community that secures their code and apps like a neighborhood. They emphasize the importance of keys in security, acknowledging that even with proper key management, keys can be stolen or compromised. Key rotation is a security practice where cryptographic keys are periodically changed to reduce the likelihood of exploitation by attackers. Snyk's Perpetual Key Rotation Machine is an automated system that continuously rotates encryption keys at intervals of attoseconds, ensuring that no single key is in use for too long. This machine uses proprietary AI to generate new keys and ensures that data remains secure by constantly changing the encryption keys.