May 2023 Summaries

Snyk has announced a new Slack integration that provides notifications within channels, addressing security issues in code, open source dependencies, containers, and cloud infrastructure, allowing developers to act immediately. The new app reduces context switching by providing Snyk data in Slack channels, enables collaboration across multiple teams, sets alerting thresholds, and automates common actions. This integration complements Slack's focus on productivity, collaboration, and automation, empowering organizations to shift left in securing code as early as possible. With the new app, developers receive real-time alerts in channels, offering immediate visibility into identified issues across all software components, including code, open source dependencies, containers, and IaC. The integration provides a Slack-native experience, making it easier for teams to view and use Snyk data, discuss, prioritize, and apply suggested fixes to vulnerabilities in a single place.

Snykers share wellness tips for mental health awareness month to observe mental health awareness this month, they shared journaling, intentional movement, mindfulness through meditation and healthy eating habits as their personal wellness strategies. Journaling helps them express themselves freely and put gratitude into words, while intentional movement allows them to clear their heads and boost their mood. Mindfulness through meditation provides a moment of pause and reduces stress levels, and healthy eating habits aid digestion and provide the body with essential nutrients. The company has also offered interactive activities such as an ongoing Headspace mindfulness challenge and AAPI & Mental Health Month campaigns to support its employees' mental health and well-being.

Amplifying AAPI Voices to Honor Asian American Pacific Islander Heritage Month is a celebration of the rich heritage, culture, and contributions of Asian Americans and Pacific Islanders in the US. The Asian diaspora is vast, with diverse experiences and perspectives to learn from. Snyk's resource group co-leads aim to blend celebration with education on important issues in the AAPI community by amplifying the voices of their members. The month highlights the importance of understanding AAPI history and struggles, including the "bamboo ceiling" faced by many in the community. Celebrating heritage and culture is crucial for bridging gaps between communities and inspiring greater collaboration and impact. By educating others and ourselves, we can work towards an inclusive and equitable world.

Penetration testing is a crucial practice for ensuring an organization's security posture, and various tools can aid in this process. Developers use these tools to simulate attacks on systems, applications, or networks to discover vulnerabilities before hackers do. Automated tools like Metasploit, Nmap, sqlmap, Burp Suite, OWASP ZAP, Nikto, w3af, and Snyk Open Source are popular options for penetration testing, each with its unique features and use cases. Developers can select the right tool based on their project's specific needs, combining multiple tools to find all potential attack vectors. By using these tools, organizations can protect themselves from future exploitation by detecting and correcting vulnerabilities as soon as possible.

The importance of data loss prevention cannot be overstated, as a single breach can have severe consequences for a company's reputation and finances. Data breaches are categorized into three types: confidentiality breaches, integrity breaches, and availability breaches. To prevent data loss, it is essential to choose the right architecture, identify sensitive data, encrypt and hash data, utilize secret management tools, implement access limitations, and employ two-factor authentication. Companies can also mitigate the severity of a data leak by reducing the amount of data stored and implementing privacy by design. Several companies use data loss prevention software to block actions that may lead to data leaks, such as prohibiting users from performing actions via USB storage devices or an accidental malware download. By taking proactive measures, developers and companies can reduce the risk of data leaks and protect sensitive information.

Snyk has been recognized as a Leader in the 2023 Gartner Magic Quadrant for Application Security Testing, marking its first time being named in this report. This recognition comes after Snyk was previously named a Visionary in 2021 and is seen as a testament to the company's growth and commitment to developer security. The market evaluation focuses on buyers' needs, including rapid and accurate testing of various application types and integration into software delivery workflows with automation. Snyk has been at the forefront of the "shift left" and DevSecOps movements, aiming to enable developers to create apps that are secure by design. With its developer security platform, Snyk delivers on the promise of Application Security Posture Management (ASPM), empowering users to link issues discovered in the cloud back to their source code and providing AI-powered fixes directly in their IDE. The company's unique hybrid approach ensures that developers get fast and reliable fixes while leaving humans in control. This recognition is a result of Snyk's incredible community, partners, and internal team, and the company looks forward to continuing its journey with exciting updates and announcements this summer.

Generating an SBOM (Software Bill of Materials) for JavaScript and Node.js applications is crucial to assess and mitigate security risks associated with open source libraries and dependencies. An SBOM provides a comprehensive inventory of all software components used in a project, including direct dependencies, transitive dependencies, and their relationships. Snyk, a free developer-security platform, offers an SBOM generator that can be accessed through its API or CLI. By generating an SBOM, developers can identify outdated and vulnerable dependencies, update them quickly, and ensure compliance with government cybersecurity requirements. The generated SBOM report includes metadata, component details, license information, vulnerability data, cryptographic data, and build information, making it a valuable tool for project health and security risk management.

The Snyk company has introduced EPSS (Exploit Prediction Scoring System) to its security intelligence, which estimates the likelihood of a vulnerability being exploited in the next 30 days, assigning it a probability score between 0% and 100%. This system is designed to address limitations of existing industry standards like CVSS, providing a more comprehensive risk assessment model by considering additional contextual factors. EPSS scores are updated daily, and Snyk plans to incorporate this system into its new risk assessment model that will also consider CVSS and other contextual risk factors, aiming for a more holistic approach to prioritization and issue management.

This GitHub Actions workflow creates three jobs to test, build and scan a Docker image for security vulnerabilities, which are then uploaded to GitHub's registry. The test job runs on Ubuntu 18.x, installs Node.js environment, installs dependencies and runs tests. The build job builds the Docker image using the `docker/build-push-action` and pushes it to GitHub's Docker registry. The scan job scans the Docker image for security vulnerabilities using Snyk and uploads the vulnerability report to GitHub. The workflow uses environment variables to specify the Docker image's tag, repository and registry, allowing it to be easily customized for different projects.

The Snyk Security Research team analyzed proprietary code to identify the top 10 most common code vulnerabilities across seven popular programming languages, including JavaScript, Java, Python, Go, PHP, Ruby, and C#. The report provides an inside look into the most critical vulnerabilities found in first-party code and offers a cheat sheet for each language ranking the top 10 vulnerability types by occurrence. The report aims to educate developers on how to mitigate these vulnerabilities and secure their code as it's written, with Snyk Code being a developer-focused tool that allows real-time security analysis and reduction of overall vulnerability counts and security backlogs.

The Bay Area, particularly Silicon Valley, is a hub for companies working on application security, with thousands of companies striving to mitigate risks. Application security experts and developers shared their experiences and insights on building an effective application security program, highlighting the importance of communication between development and security teams. The integration of tools like Snyk has simplified the process, allowing developers to prioritize vulnerabilities and automate tasks, which in turn improves efficiency and reduces issue volume. A key trend is the breaking down of silo-ed development and security teams, with a focus on empowering developers and trusting their expertise to ensure production security. Ultimately, an approach centered around communication, empathy, and trust is crucial for success in application security.

Snyk has introduced "Recharge days" as part of its initiative to encourage employees to prioritize their mental and physical health by taking time off simultaneously. The company recognizes the importance of unplugging from work and believes that disconnecting as a team once a quarter helps reduce stress and provides an opportunity for employees to rest, recharge, and spend quality time with loved ones. Snykers have shared various ways they spent their Recharge days, including visiting friends, spending time with family, planning weddings, and exploring nature. The next Recharge week is scheduled for July, allowing employees more extended periods to relax and rejuvenate.

Snyk and ServiceNow are collaborating on a new Software Bill of Materials (SBOM) solution to help secure applications and their associated software supply chains. This integration, expected in late summer, will provide greater visibility into application security risks and enable prioritization of workflows, creating efficiency for developers and securing applications for organizations. The SBOM is an essential component of modern app development, as most apps rely on open source components that can pose vulnerabilities. Snyk's comprehensive and accurate database of open source vulnerabilities will be used to surface risks in the software supply chain, empowering developers with actionable fixes and timely intelligence. This partnership builds on Snyk's strategic investment in ServiceNow announced earlier this year, further enhancing their developer security platform and driving industry-leading innovation.

The new app from Snyk, developed in collaboration with Dynatrace, aims to bridge the gap between security and observability by providing a unified view of security and performance across the entire DevSecOps lifecycle. This integration enables teams to monitor scanning coverage for container images, eliminate security blind spots, and make informed decisions on which vulnerabilities to address. The app automates vulnerability management, helps mitigate risk, and provides complete visibility into application security posture from development through production, ultimately improving overall security.

XPath injection attacks are a type of code injection attack that can compromise website security and data. These attacks occur when malicious actors exploit vulnerabilities in websites' use of XML databases to access sensitive data. To prevent XPath injection attacks, it's essential to sanitize user-supplied input, use parameterized XPath queries, and especially precompiled XPath queries, which are constructed from static data only. Regularly reviewing and testing code for potential vulnerabilities is also crucial. By implementing these preventative measures, developers can protect their applications against XPath injection attacks and prevent severe consequences such as data exfiltration, privilege escalation, and damage to reputation.

Secure JavaScript URL validation is crucial to prevent malicious script injection and server-side request forgery (SSRF) attacks in JavaScript applications. Implementing URL validation checks whether URLs follow proper syntax, strengthening security against exploits and eliminating bugs. Developers should use the `new URL()` constructor function to validate URLs, which supports Node.js runtime and most browsers. Regex literals and constructors can also be used for URL validation, but are error-prone and time-consuming. Snyk detects vulnerable open-source packages and provides a top 10 JavaScript vulnerabilities cheat sheet. To mitigate SSRF attacks, developers should restrict protocols, set up applications to not pass URLs without oversight, and use allow and deny lists to filter and control mechanisms.

Snyk has introduced an AI-powered fix functionality in its Code feature, which provides secure fixes for identified security issues directly within the Integrated Development Environment (IDE). This capability is now available in open beta and aims to alleviate the challenges of finding and fixing security issues. The Snyk AI engine is trained on explicitly permissively licensed open source projects and ensures that generated fixes do not introduce new problems or compromise sensitive information. Users can enable the feature through the Snyk Preview tab, with initial support for JavaScript in Visual Studio Code and Eclipse IDE plugins.

Snyk has been named to the CNBC 2023 Disruptor 50 List, recognizing its industry recognition as a testament to the hard work of its global team. The company's focus on equipping developers to build securely has been acknowledged, following milestones such as Series G funding and strategic investments from ServiceNow. Snyk is also integrating with other major players in the industry, including Atlassian Jira and Dynatrace, to deepen application security integration. The company's emphasis on innovation, agility, and speed will be crucial in addressing emerging concerns in supply chain security and generative AI.

Snyk's engineering culture is defined by its core values of One Team, Care Deeply, Ship It, Think Bigger, and Learn Always. The culture emphasizes collaboration, continuous innovation, and a passion for delivering results for customers. Key practices include over-communication, regular feedback, a blame-free culture, appreciation for others' work, and consideration of quality and ethical implications. Engineers have the freedom to choose their own process and follow "Definitions of Done" to track when work is complete. The company also values automation, refining processes, thinking beyond team borders, designing for the future, and learning from experience through retros, incident reviews, and Snyk School. By sharing its engineering culture in a written document, Snyk aims to help its engineers stay on the same page and be successful.

The conversation between Alex Bovee and Guy Podjany, CEO of Snyk, highlights the importance of building an effective security program in today's fast-paced technological landscape. The concept of "shift left" in security controls has gained popularity due to its efficiency, allowing for vulnerabilities to be identified during development phases rather than downstream audits. Security teams need to think creatively and find ways to codify their knowledge and expertise in the development pipeline while empowering users to create business value. Measuring the success of a security program can be achieved through KPIs, outputs of security controls, and efficacy, which is the toughest but best indicator of protection against attackers. The conversation also touches on focusing on productivity and efficiency, with the "paved road" concept being a key strategy for modern solutions that prioritize frictionless user experience. With current macroeconomic conditions favoring decentralization, it's essential to demonstrate value from a risk reduction standpoint and show how a solution improves productivity.

AI is advancing rapidly, with new tools and use cases being discovered weekly, from writing poems to securing networks. Researchers are still unsure about the capabilities of AI models like GPT-4, which has led some experts to call for a halt on training more powerful models to focus on developing safety protocols and regulations. OpenAI has implemented various safety measures in their GPT-4 development process, but the model can still be vulnerable to adversarial attacks and exploits. Concerns around using AI tools like ChatGPT for coding include privacy issues, cybersecurity risks, and potential impact on application security posture. However, AI tools are also providing more tools to security teams to help them deal with emerging threats. To mitigate risks, developers should establish clear internal policies regarding the use of AI tools, including data selection and usage, data privacy and security, compliance requirements, and regular updates. Security teams should be aware of developments in AI that give more tools to both security teams and bad actors, and conduct regular application security assessments to identify potential threats and develop strategies to defend against them.

Snyk has released a new video showcasing its partnership with ServiceNow to provide a complete view of application security posture. The integration combines Snyk's developer-first security platform with ServiceNow workflows to help track and manage vulnerabilities efficiently. This allows security teams to have visibility into the application vulnerabilities developers are dealing with, making it easier for them to make data-driven security decisions. With this partnership, companies can benefit from improved collaboration between development and security teams, ultimately upleveling their application security while reducing risk.