June 2023 Summaries

CI/CD pipelines have become a crucial practice for DevOps teams to enhance development speeds, but they can also be used as a security-conscious pipeline that subjects code to security-oriented testing, performs source code vulnerability scanning, and runs other essential checks before deployment. A security-conscious CI/CD pipeline shifts security practices left in the DevOps cycle by integrating security awareness and consciousness early in the process. This approach is known as DevSecOps, which emphasizes integrating security validation mechanisms early in development and at every stage of DevOps. Key aspects of integrating security controls within each cycle of DevOps include automated threat modeling, software bill of materials, artifact signing, unit tests for security validation, analyze infrastructure as code, and automated vulnerability scanning. These strategies can help DevOps teams take security practices a step further and transform development and operations into development, security, and operations.

The importance of verifying webhook signatures cannot be overstated, as webhooks are a callback integration technique that can transmit sensitive information in close to real-time. Without verification, webhooks can be exploited by malicious actors, compromising the security of the entire software supply chain. To mitigate this risk, it's essential to implement webhook signatures using strong hashing algorithms, such as SHA-256, and validate the signature of incoming requests. This ensures that data communication between webhooks only occurs between trusted partners, preventing supply chain attacks. By following best practices, developers can create secure webhooks that prevent unauthorized access and protect their systems from security threats.

As malicious npm packages and their dangers have been a frequent topic of discussion, recent security incidents highlight the importance of minimizing the risks of arbitrary command execution with package managers like npm. The postinstall lifecycle hook in Node Package Manager (npm) provides significant value to developers by enabling them to perform various tasks or configurations as part of the package installation process. However, this can also be exploited by malicious actors if not handled properly. Security professionals identify data-at-rest security as protecting sensitive information stored or at rest, and various measures are available to ensure it, such as on-demand decryption and access control logic. The attack surface of a developer includes environment variables, configuration files, SSH keys, and macOS keyboard shortcuts, which can be vulnerable if not handled securely. A recent incident showed that malicious actors can exfiltrate keyboard text replacements using the defaults command, which stores these settings under the System Preferences application. To mitigate security risks, developers should ignore scripts on npm package installations, use safe npm defaults, secure storage, and follow best practices to prevent arbitrary command execution.

Snyk has announced the general availability of Project Collections, a feature that enables users to create collections of projects based on their focus and perform actions on them in bulk. This feature aims to improve efficiency and focus when working with multiple projects, and it provides an API for seamless integration with other Snyk features. The ability to create and configure collections is restricted to org admins to ensure data integrity and security. Project Collections can help users work more effectively at scale by providing a way to organize their projects in a flexible and customizable manner, and it includes features such as bulk actions, reporting, and search capabilities.

AWS permissions boundaries offer an additional layer of security and flexibility for managing access controls to AWS resources, allowing organizations to establish a consistent and well-defined authorization framework that prevents the accidental or intentional escalation of privileges. Permissions boundaries are particularly useful in organizations with a distributed or complex IAM environment, such as centralized cloud IAM teams, multi-tenant environments, segregation of duties, and third-party access. To maintain a robust security posture, organizations must carefully design and monitor resource policies to align with their intended security boundaries, and tools like Snyk can help automate security governance and provide visibility into potential gaps in the security posture.

Secrets Management: Tools & Best Practice` Secrets management is a critical process for safeguarding sensitive information, providing security measures such as encryption, access controls, auditing, and ensuring that sensitive data remains confidential and is only accessible to authorized individuals or applications. The importance of secrets management lies in its ability to provide security, ensure compliance with regulations, facilitate scalability, and enable collaboration while minimizing the risk of unauthorized access and usage of sensitive data. Various tools can be used for secrets management, including Hashicorp Vault, AWS Secrets Manager, Google Secret Manager, Azure Key Vault, and Snyk, which offer features such as secure storage, access controls, automation, auditing, and remediation to ensure the security of sensitive information. Effective implementation of secrets management best practices, such as centralizing secrets management, rotating keys and credentials regularly, enforcing access control, leveraging automation, auditing, and defining policies, can help organizations safeguard their secrets and maintain a secure environment.

The recent research project conducted by Snyk and Redhunt Labs scanned the top 1000 GitHub organizations for insecure dependencies in their source repositories, finding a total of 11,900 repositories with potential security vulnerabilities. The most prevalent vulnerability types were deserialization of untrusted data, prototype pollution, high or critical vulnerabilities in Python, and critical or high category vulnerabilities in Ruby repositories. The study highlights the importance of maintaining up-to-date dependency versions to prevent security breaches, and provides insights into the security posture of popular GitHub repositories.

Implementing DevSecOps in modern cloud environments requires a culture shift, strategic processes, developer-friendly technologies, and effective governance. This approach empowers development and operations teams to perform security tasks while writing and shipping code, avoiding tacking security later in the process and promoting mutual understanding between teams. By recognizing this mindset change, getting security teams involved in design, practicing continuous integration, and employing DevSecOps tools/testing, organizations can successfully bridge gaps between security, development, and operations teams, ultimately accelerating secure development.

SnakeYaml 2.0 has been released to address an unsafe deserialization vulnerability that could lead to arbitrary code execution, a problem caused by default SnakeYaml parsing of incoming yaml to the generic object type, which creates opportunities for deserialization of other classes available on the class path. The new version mitigates this issue by only parsing standard Java classes like primitives and basic classes like string and map, requiring users to rewrite their YAML parsing logic to accommodate the changes. To fix the issue, developers must upgrade to SnakeYaml 2.x, which breaks API compatibility with earlier versions, and remove object references or use a specific tag inspector in LoaderOptions to permit only permitted yaml files that fit the object. Staying up-to-date with library versions is critical for open-source security, and using tools like Snyk Open Source can help find and fix issues or point to alternative versions.

Patches of Pride: Love, inclusivity, & cute pets in celebration of Pride month` We're celebrating LGBTQIA+ pride this month at Snyk, recognizing the queer community's diversity and talent. Our "Patches of Pride" campaign featured photos of pets in Pride attire, while also acknowledging that Pride goes beyond celebrations to fostering an inclusive workplace where everyone can feel safe and accepted. This involves listening to others' stories, normalizing correct pronouns, removing assumptions, and encouraging acceptance of truth. We must also think about how our words and actions impact marginalized communities, including LGBTQIA+ people, by examining implicit bias in language and challenging the status quo. At Snyk, we strive to create a safe environment where everyone can share their unique perspectives and stories all year long.

Kubernetes Pod Security Standards provide a set of policies and guidelines to maintain container security and integrity in Kubernetes clusters, ensuring that containerized applications meet industry-standard security requirements. The standards define three different profiles with varying restrictions: Privileged, Baseline, and Restricted, each offering a balance between security measures and compatibility. To enforce these standards, the Pod Security admission controller is used, which can be configured to reject Pods with policy violations, allow them with warnings or audits, depending on the level selected. The use of Pod Security Standards helps organizations ensure compliance with industry-standard security requirements while protecting against potential privilege escalations and other malicious activities, ultimately simplifying the development process while protecting workloads running within Kubernetes clusters.

Celebrating Juneteenth at Snyk is a personal reflection on the significance of Juneteenth, a federal holiday commemorating the emancipation of enslaved African Americans in the United States. The author shares their personal connection to red velvet cake and its cultural significance, highlighting the struggles and resilience of enslaved people who fought for freedom. The text also explores the meaning of Juneteenth, which represents not only freedom but also the ongoing struggle against institutional racism and systemic inequality. The author reflects on their own concept of freedom, acknowledging the challenges it faces in modern times, and emphasizes the importance of honoring ancestors, doing cultural work, and maintaining hope and determination to preserve freedom.

The Java SecurityManager is being removed due to its inefficiency, complexity, and lack of relevance in modern security frameworks, including zero trust. Its removal aims to improve the overall security posture of the Java platform by providing more effective mechanisms for securing client-side and server-side code. Developers are advised to transition away from using deprecated APIs and instead use alternatives such as the Foreign Function and Memory API (FFM) or tools like Snyk to monitor and fix vulnerabilities in their projects. Writing secure code from the get-go is also essential to minimizing vulnerabilities, and developers should acquaint themselves with Oracle's Secure Coding Guidelines for Java SE. The removal of the SecurityManager is a positive step towards making the Java platform more secure and less superfluous.

The Secure Developer podcast features interviews with experts in DevSecOps, discussing topics such as tools, best practices, current events, and trends in secure development. Recently, the conversation turned to building a security culture, identifying and defining security champions, and the future of security teams and champions. Experts emphasize the importance of building a shared set of values and practices that prioritize security as an integral part of software development and deployment. They also highlight the need for open, positive relationships between security and engineering teams, and the role of security champions in promoting a strong security culture across the organization. The future of security teams and champions is expected to involve up-skilling developers, reducing the need for dedicated security engineers, and incorporating security practices into the development process.

Snyk has been named a Leader in The Forrester Wave: Software Composition Analysis (SCA), Q2 2023 report, ranking highest in the Strategy category, and was recognized for its developer-centric approach to application security solutions. According to the report, Snyk's focus on developers allows organizations to move fast without breaking things, and it has been named a Leader in the Gartner Magic Quadrant for Application Security Testing, as well as a Customers' Choice in the 2022 Gartner Peer Insights "Voice of the Customer": Application Security Testing. This recognition highlights Snyk's momentum and its commitment to empowering users by putting control over application security squarely in their hands.

Snyk has integrated its application security platform with AWS Security Hub, allowing security teams to monitor and manage a variety of application security events in a more streamlined way. This integration enables real-time detection of security deviations from best practices, continuous aggregation of security findings, automated response and remediation actions, and streamlines data queries for AWS customers. With this integration, Snyk can send security events into AWS Security Hub based on vulnerabilities found across the SDLC within first-party code, dependencies, containers, and IaC configurations, both before and after applications have been deployed to AWS. This allows security teams to help engineers increase operational efficiencies in development while simultaneously reducing security risks across the cloud environment and running application workloads.

Snyk has integrated with Amazon EventBridge to enable secure application development at scale by providing real-time vulnerability notifications, audit trail monitoring, and automated remediation workflows. This integration allows developers to extend the Snyk platform and build custom integrations without significant engineering work, making it easier for organizations to respond to security issues in their applications. With this integration, Snyk provides a comprehensive developer-friendly security platform that helps teams find and fix vulnerabilities in proprietary code, open source dependencies, containers, and infrastructure as code across the software development lifecycle, integrating into popular services such as AWS CodePipeline and Amazon EKS. The benefits of using Snyk and Amazon EventBridge include streamlined data queries, custom workflows, and automated remediation tasks, making it easier for security teams to manage audit logs and security issues from Snyk with more agility.

Snyk and Dynatrace have partnered to bring complementary capabilities to different parts of the DevSecOps lifecycle through their integration. The Snyk DevSecOps Lifecycle Coverage App combines container scans in pre-production with production runtime, enabling true DevSecOps from development to runtime. This integration increases productivity and speed to market for developers, improves governance for security teams, and provides improved visibility into potential threats for operations teams. The outcome is data-driven security governance across the SDLC, aligning development, application security, and operations teams.

Snyk has launched new features as part of its Software Supply Chain Security solution, including developer-first tools to help teams understand their app's supply chain, identify potential risks, and take necessary steps to mitigate them. The company is also introducing a new feature to test SBOMs for known vulnerabilities and license issues in its leading vulnerability database, with the goal of providing actionable insights to downstream consumers. Additionally, Snyk is working on Parlay, an open-source project that aims to enrich SBOMs with additional metadata like vulnerabilities and source provenance, making it easier for AppSec teams to automate actions or inform decision-making.

Snyk has announced its intent to acquire Enso, a pioneer in application security posture management (ASPM), to enhance its platform with risk-based prioritization capabilities. The acquisition aims to empower security teams to scale their AppSec program to every app and developer across the software development lifecycle (SDLC). By combining Enso's ASPM capabilities with Snyk's Insights and developer-loved tools, security teams can gain visibility into their application security posture, prioritize risks, and automate policies and guardrails. This move enables developers and security teams to collaborate more effectively on secure development policies and guardrails, focusing on the issues that matter most and ensuring that development is safe from the start.

The Parlay tool enriches Software Bill of Materials (SBOMs) by adding relevant information such as license details, external links, maintainer information, and more. It supports enrichment with data from ecosyste.ms and Snyk vulnerability data for Snyk customers. The tool is designed to be flexible and allows users to pipe SBOMs from other tools into parlay and between separate enrich commands. With richer SBOMs, developers can build more interesting tools on top, and the Parlay project aims to address this need by providing a new open source tool for enriching SBOMs.

Snyk is releasing new features to help developers and security professionals manage application security in a more efficient way. The company's proprietary AI engine, DeepCode AI, delivers security fixes right to developers' IDEs, saving time and mental energy. A new feature called Insights provides a visual graph of an app's lifecycle, enabling teams to prioritize issues based on risk factors beyond individual silos of vulnerability reports. Additionally, Snyk is expanding its developer-first SBOM management capabilities with new APIs and an open-source tool for enriching SBOMs. The company also announced a free security learning platform called Snyk Learn, which partners with NYU Tandon School of Engineering to provide comprehensive cybersecurity education for developers. With these new features, Snyk aims to empower teams to better manage their application security posture and reduce noise in the development lifecycle.

Snyk Learn, a developer-first cybersecurity education platform, has aligned its content with the National Institute of Standards and Technology's (NIST) National Initiative for Cybersecurity Education (NICE) Framework. This alignment provides a comprehensive and standardized approach to cybersecurity education, equipping learners with knowledge, skills, and abilities required for a successful career in the industry. The NIST NICE Framework is a common language to categorize and describe cybersecurity work, consisting of seven categories that capture unique aspects of cybersecurity work. Snyk Learn's interactive vulnerability lessons map toward secure design and building secure applications throughout the development process, promoting maintenance and teaching developers how to build effective security throughout their applications. By aligning with the NICE Framework, Snyk Learn provides standardized learning, comprehensive coverage, skill validation, targeted learning paths, and an adaptable curriculum, reinforcing its commitment to providing top-quality cybersecurity education.

Parlay is an open-source tool that can enrich Software Bill of Materials (SBOM) data by adding additional information. This can be used to write more powerful policies for decision-making based on SBOM data, such as license policies and vulnerability policies. With parlay, the size of the enriched SBOM can increase by over 400%, providing a wealth of new data for analysis and policy creation. By using tools like Open Policy Agent and Rego programming language, users can create complex logic to automate decision-making processes based on SBOM data. The tool also provides flexibility in terms of compatibility with other policy tools and languages.

Insights is a new capability announced by Snyk that provides organizations with code-to-cloud application intelligence to manage their application security posture more effectively. It helps development and security teams identify, prioritize, and fix top risks for the business by aggregating and correlating data from across the Snyk platform to construct a 360° view of the application. This view enables users to better assess the risk posed by security issues and make prioritization decisions based on context. Insights provides an interactive evidence graph that describes the different assets making up the application and how they relate to the issue in question, as well as links to source code for easy understanding and action. The goal of Insights is to provide a holistic understanding of the modern application and help organizations overcome challenges in managing their application security posture through automated, continuous, and secure practices.

AWS security breaches are often caused by misconfigurations, which can leave gaps in security that attackers can exploit. The shared responsibility model between cloud providers and customers means that customers must deploy their applications securely, including all environments beyond just production. High-profile breaches have affected companies like Capital One, Pegasus Airlines, Twilio, Uber, and Imperva, with various reasons for the breaches, including misconfigured firewalls, unprotected S3 buckets, weak authentication, and exposed API keys. To prevent such breaches, it's essential to know your environment, empower developers to catch and fix mistakes, and focus on secure design and prevention. Companies can use tools like Snyk's AWS vulnerability scanning to identify vulnerabilities before attackers can. By taking these steps, companies can reduce the risk of AWS security breaches and protect their customers' sensitive data.

Snyk has integrated its scanning capabilities within Jira Software, allowing developers to manage security issues alongside their development work. The integration is available in open beta on the Atlassian Marketplace and aims to simplify the process of identifying and addressing vulnerabilities without slowing down developers. It also enables collaboration between security teams and developers through a unified dashboard. Snyk Security in Jira Cloud supports third-party dependencies, first-party code issues, container vulnerabilities, and IaC misconfigurations. The integration is expected to improve DevSecOps workflows for users.

Ethical hacking is a crucial aspect of cybersecurity that involves finding potential security issues in computer systems and networks before malicious users can exploit them. Ethical hackers use various techniques, including penetration testing, social engineering, network scanning, vulnerability assessment, password cracking, SQL injection, cross-site scripting (XSS), denial-of-service attacks, and others to identify vulnerabilities. The stages of ethical hacking include authorization, scoping, reconnaissance, vulnerability analysis, exploitation, reporting, remediation, and legal and ethical considerations. Emerging trends and technologies in ethical hacking include artificial intelligence (AI) and machine learning (ML), Internet of Things (IoT) security testing, blockchain security testing, cloud security testing, social engineering testing, red teaming, bug bounty programs, and the increasing importance of cybersecurity in our digital world. Ethical hacking plays a vital role in ensuring the security and integrity of computer systems and networks, raising awareness of cybersecurity risks, improving security measures, and creating career opportunities for skilled security professionals.

A day in the life of an ethical hacker involves planning and preparation, reconnaissance, scanning and enumeration, exploitation, post-exploitation, analysis and reporting, communication and collaboration, and continuing education and professional development. Ethical hackers use various tools and techniques to identify vulnerabilities and weaknesses in systems and networks, and work to exploit these vulnerabilities in a controlled and ethical manner. Throughout the process, they must maintain clear communication with clients and team members, and stay up-to-date with the latest trends and tools in the field. The goal of ethical hacking is to help organizations protect themselves from cyber threats by identifying potential security weaknesses before they can be exploited by malicious actors.

To prevent a dangerous security breach known as an LDAP injection attack, developers must validate and sanitize user inputs before constructing LDAP queries. This allows attackers to manipulate the query's meaning by modifying control characters and altering its intended behavior. An attacker can bypass authentication measures and gain access to administrator accounts, leading to data exposure and system compromise. To secure applications against LDAP injection attacks, developers should enforce the principle of least privilege and zero-trust authorization for directory access, escape any variables or LDAP syntax, and prevent unvalidated user input from tricking the LDAP query interpreter into running arbitrary queries. By implementing these best practices, developers can keep their applications secure and reduce the severity of potential LDAP injection attacks.

Ethical hacking is a legitimate practice that involves using hacking techniques and tools to test the security of computer systems and networks, identify vulnerabilities, and improve cybersecurity defenses. Ethical hackers need to have a good understanding of various hacking tools and techniques. The article discusses the top 10 ethical hacking tools, including Snyk, OWASP Dependency-Check, Nmap, Metasploit, Burp Suite, Brakeman, Kali Linux, Bandit, John the Ripper, and Dependency-Track. These tools can be categorized into different types, such as vulnerability scanners, web application testing tools, network mapping and reconnaissance tools, password cracking tools, and exploitation frameworks. The article also tells a story of a security analyst named Sam who uses these tools to identify vulnerabilities in an online banking platform and prevent a potential data breach. The article emphasizes the importance of using ethical hacking tools responsibly and ethically to improve application security and protect organizations from cyber threats.