August 2023 Summaries

The Director of Product Security at Snowflake, Jacob Salassi, shared his team's approach to establishing a successful application security program by starting with empathy towards developers, establishing a feedback loop, focusing on engineering excellence, driving accountability, creating focused training, and curating the entire security experience. The Snowflake team partnered with Snyk to leverage developer-first tooling, first- and third-party code remediation, seamless integration, detection for vulnerabilities in base image dependencies & Dockerfile commands, among other tools, to support their application security initiatives.

The use of artificial intelligence (AI) in software development is becoming increasingly prevalent, offering developers a range of tools to enhance their productivity and efficiency. AI-assisted development involves using generative AI to help write, review, and document code, while also providing suggestions for improvement. This approach can significantly speed up the development process, but it's essential to ensure that generated code is secure and free from vulnerabilities. Tools like GitHub Copilot, Amazon CodeWhisperer, and Tabnine offer similar functionality, providing developers with real-time code suggestions as they write their code. Additionally, AI-powered tools like Snyk can analyze code for security issues, helping teams identify potential vulnerabilities and fix them before deployment. By leveraging these tools, developers can improve the quality and security of their code, ultimately leading to faster development times and reduced risk of errors or security breaches.

Implementing SSL/TLS pinning in Node.js applications adds an extra layer of security against MITM attacks and other certificate-related vulnerabilities. It verifies the server's public key or certificate with a locally stored copy, ensuring the authenticity and integrity of the connection. The process involves comparing the public key during the TLS handshake and terminating the connection if there's a mismatch. Proper error handling is crucial to avoid getting locked out in edge cases where a certificate or public key expires or an issuer revokes it. Testing SSL/TLS pinning by simulating attacks, comparing key hashes, and updating certificates or keys is essential to ensure its effectiveness. Storing public keys securely is also vital for maintaining the trust and security of communication channels. By leveraging SSL/TLS pinning, Node.js applications can enhance their overall security, ensuring a reliable and safe user experience.

What kind of (security) dog are you?` is a quiz created by Snyk to determine an organization's approach to security, with questions about handling Software Bill of Materials (SBOMs), interacting with the development team, and views on AI and third-party base images. The quiz results categorize organizations into three types: Basset Hounds (loyal but set in their ways), Dobermans (striking a balance between developer-friendly and security-focused), or Golden Doodles (innovative but sometimes prioritizing speed over security). Snyk, the company behind the quiz, offers a dev-first tooling platform that provides integrated and automated security for developing and deploying secure applications.

Okta has partnered with Snyk to simplify the process of finding and fixing security issues in Auth0's container architecture. To achieve this, Okta uses Snyk's developer-first tooling to scan images for vulnerabilities, compile results into a centralized asset management system, and enrich each scan result with meta-data. This process makes it easy for developers to view all images, their vulnerabilities, affected environments, and owners, without adding extra tasks to their plates. The goal is to shift container security left by implementing guardrails such as custom base image recommendations and more automation, including automated patch remediation across iterations of the same image and PR fix automation. This partnership aims to reduce development complexity for Auth0 developers while maintaining a robust platform that secures Auth0's identity and access management initiatives.

JLink is a Java tool that enables developers to create smaller Docker images for their Spring Boot Java applications by assembling and optimizing modules and their dependencies into a custom runtime image. This reduces the size of the Docker image, leading to faster deployment, reduced storage costs, and improved security. By using JLink, developers can minimize the attack surface of their application, making it more secure. Additionally, Snyk is a developer security tool that can scan container images for vulnerabilities and provide suggestions on how to fix them. With JLink and Snyk, developers can create smaller, more secure Docker images for their Java applications.

VS Code is a popular open source code editor compatible with Windows, macOS, and Linux operating systems. It offers a wealth of extensions that can enhance its capabilities and improve security. The top five VS Code extensions for security include 1Password to keep secrets and passwords safe, Decompiler to decompile binary executables, Cloak to hide sensitive values from being displayed on the screen, ESLint extension to enforce code standards and detect bugs, and Snyk to scan code and third-party packages for vulnerabilities. These extensions can help developers write more secure code, maintain security best practices, and prioritize security without disrupting their workflow.

Mergify is a powerful tool designed to automate GitHub workflows, allowing developers to focus more on crafting excellent software and less on tedious administration tasks. It creates custom workflows based on specific conditions defined by the user, automating processes such as merging pull requests, closing comments, reviewing, labeling, forwarding, back-porting, rebasing, and more. Mergify helps maintain repository hygiene, ensures the master branch remains green, and minimizes time wasted on manual processes that can be automated. Snyk is a developer-friendly security platform that empowers developers to own the security of their applications, offering seamless experience in managing dependency updates via its automated pull requests. Snyk automatically checks project dependencies for available updates, creates pull requests with necessary changes, and provides information about the upgrade. Mergify can be used to automate merging of Snyk upgrade pull requests, streamlining dependency updates and reducing noise from unnecessary updates. By implementing policies such as limiting simultaneous upgrade PRs, ignoring packages, or upgrading minor and patch versions only, developers can maintain a smooth CI workflow free from distractions. When used together, Mergify and Snyk can take workflows to the next level by automating dependency updates and freeing up developer time for more critical tasks.

Best practices for building a production-ready Dockerfile for PHP applications are essential to ensure the security, reliability, and performance of your application when deployed to production. To build a reliable Docker image, select a specific base image that matches your requirements, use environment variables for configuration, consider PHP FPM vs. Nginx/Apache, disable unnecessary debug logs/error reporting in production, run your PHP container as a non-root user, set up PHP container health checks, restrict the number of ports you use, regularly update dependencies, restrict container capabilities to the minimum needed, and use multistage builds for build/runtime separation. Additionally, using Snyk can help identify and resolve vulnerabilities in your Docker image, making it easier to maintain a secure and reliable application. By following these best practices and leveraging tools like Snyk, you can ensure your PHP application is properly secured and deployed to production with confidence.

The use of GitOps enhances application security by implementing four core principles: declarative description, version control, automated change approvals, and continuous reconciliation. These principles position GitOps to have a significant impact on application security, enabling features such as rapid replication and setup, incident response capability, strong cryptography for tracking changes, software agents that raise alerts for discrepancies, automated change approvals, swift responses to security breaches, and management of security measures as code. By implementing security as code, developers can shift left with their security measures, position security as a priority, identify modifications to required states, and create security policies before they're enforced in the Git version control system. Additionally, GitOps enables compliance as code by codifying compliance policies declaratively for policy management and enforcement, simplifying the use of CI/CD tools to automate policy testing. Overall, GitOps offers major advantages in security automation in configuration and CI/CD processes.

Snyk's new Risk Score is a risk-based prioritization tool designed to provide an accurate and holistic understanding of the risk posed by security issues. Replacing the existing Priority Score, it leverages multiple objective and contextual risk factors to measure both likelihood and impact of vulnerabilities. The score accounts for more risk factors than before, including reachability, exploit maturity, EPSS, social trends, CVSS, transitive depth, business criticality, and more. It will be displayed on Snyk issue cards, reports, and via the API, and can be enabled via Snyk Preview across all plans, including Free. The new Risk Score aims to address the challenge of prioritization in security and development teams by providing a true probabilistic risk model that takes into consideration complexities while allowing humans to understand and verify its findings. It will enable users to customize the score and feed it with their knowledge of their environment, leveraging the predictive model to prioritize rather than eliminate issues.

The rise of GenerativeAI, Large Language Models (LLMs), and their capabilities to create human-like text, including writing code, presents both transformative benefits and unprecedented security challenges in software development. AI models can generate information or data not explicitly present in their training data, known as "hallucinations," which pose significant security concerns. These models lack the ability to recognize security implications, leading to potential vulnerabilities such as path traversal attacks, input validation issues, and TOCTOU (time-of-check time-of-use) security issues. To mitigate these risks, developers must remain aware of the potential for AI-generated code to propagate vulnerabilities and adopt secure coding practices, including implementing stringent code reviews, integrating tools for static application security testing, and fostering an environment of continuous learning and adaptation within development teams. Ultimately, human oversight is still vital to ensure robust, secure codebases, and AI code generation tools should be seen as supportive instruments that need human guidance for generating truly secure, production-quality code.

URL encoding is a method that ensures your URL only contains valid characters so that the receiving server can correctly interpret it. According to the RFC 3986 standard, URIs (which are a superset of URLs) only contain a limited set of characters consisting of digits, letters, and a few graphic symbols, all within the ASCII character set. If a URL contains characters outside this limited set, the characters must be percent-encoded. Percent-encoding means a character is converted into a two-digit hexadecimal representation of eight bits with the % escape character ahead of them. The purpose of URL encoding is not to hide parts of a URL from an outside observer but rather to ensure that the URL is easily and unequivocally interpretable by the receiving server; and to prevent manipulation of the URL by the user of the client that is constructing and sending the URL. Failure to encode a URL can result in various issues, including your application being unable to compose the URL to send it to the server, or the server receiving the URL may be unable to parse it correctly, leading to an error response. Not encoding URL parameters can expose your application to potential security threats. Each programming language provides one or more APIs for encoding and decoding URLs. In Java, URL encoding and decoding are important for processing free-form data that a visitor enters in an HTML form, constructing calls to an external API from code by adding query parameters to a base URL, and constructing calls to an API gateway used for further request routing to internal services. The process of encoding URLs in Java typically involves using the java.net.URLEncoder class and its encode() method, which ensures all alphanumeric characters are intact and converts other characters into percent-encoded hexadecimal representations. There are three overloads of the encode() method, including one that allows explicitly setting the encoding scheme as a string and another that uses the StandardCharsets.UTF_8 constant to eliminate typos and checked exceptions. URL decoding in Java can be done using the java.net.URLDecoder.decode() method, which converts percent-encoded characters back to their original form. Best practices for URL handling in Java include not skipping URL encoding, explicitly encoding parameter values when constructing new URLs, and using standard libraries like URLEncoder and URLDecoder for reliable encoding and decoding. Additionally, validating user data, including user data coming via URLs on the server-side, concerning both syntax and semantics is crucial to ensure the security of your application. The Snyk Security extension for IntelliJ IDEA can help identify issues with unsanitized input from URL parameters, potentially leading to cross-site scripting (XSS), command injection, server-side request forgery (SSRF), or open redirect vulnerabilities.

Snyk is partnering with GitGuardian to enhance security for development teams, with a focus on removing silos between developers and security teams. The companies shared insights on software signing, open source security, and secrets management at the CodeSecDays conference. Panelists emphasized the importance of making security accessible and fun for developers, using gamification and training programs to drive awareness and fixes. Sonya Moisset highlighted the need to secure pipelines at each stage of the software development lifecycle, including application code, open source libraries, containers, and infrastructure as code. The companies also discussed leveraging GitHub Marketplace tools to secure pipelines and manage secrets.

Snyk Security in Jira Cloud is a security app that helps detect vulnerabilities in third-party dependencies, code issues, container vulnerabilities, and IaC misconfigurations, allowing teams to triage and prioritize vulnerabilities, create security issues in Jira, and collaborate with development and security teams. The app integrates with Snyk Open Source, Code, Container, and IaC tools to provide a unified security context, making it easy to catch and correct issues without extensive security knowledge, while keeping track of project-specific vulnerabilities. This native integration is available for free in the Atlassian Marketplace for all Snyk and Jira plan users, providing a streamlined DevSecOps experience.

The .NET community was alerted on August 8, 2023, that the Moq testing library exfiltrates developer emails from their development machines and sends them to third-party remote servers as part of an experiment to fund the maintainer's work. The library, which has been downloaded over 475 million times, uses a new build-time behavior to extract email addresses from git user profiles and send them to an Azure blob storage service, which interacts with a third-party SponsorLink service. This incident raises concerns about supply chain security and the responsibility imbalance in open source software development maintainers pursuing sponsorship and recognition for their work. To mitigate this issue, developers are advised to remove the 4.20.0 dependency, block it in package management tools, consider re-routing DNS records associated with SponsorLinks, and add Snyk to their CI or build workflows to detect security vulnerabilities.

Snyk Security in Jira Cloud is a native integration that allows developers to manage security issues within the software development lifecycle, detecting vulnerabilities in third-party dependencies and first-party code issues, container vulnerabilities, and IaC misconfigurations. This integration enables teams to triage vulnerabilities, prioritize them by severity level, and create security issues in Jira to resolve them, promoting collaboration between development and security teams. The tool is now available in the Atlassian Marketplace for free, with a 45-day trial for new users, providing an easy way to unify development and security processes and catch and correct issues without extensive security knowledge.

Snyk has been named to the prestigious Forbes Cloud 100 list for the fourth consecutive year, coming in at #19. This recognition follows significant company milestones and demonstrates the ubiquity of Developer Security, a category Snyk invented in 2015. The company acknowledges its team's achievements and thanks its customers, partners, and employees for their contributions. Snyk has secured additional funding to fuel strategic acquisitions, strengthened its leadership team with deep enterprise expertise, and innovated in response to emerging AI technologies. With this recognition, Snyk is confident it will continue to help enterprises reap the benefits of DevSecOps.

The text discusses the importance of integrating security throughout the software development lifecycle to protect sensitive data and prevent security breaches. It highlights the need for proactive risk mitigation, cost and time savings, compliance with regulatory requirements, enhanced trust and customer confidence, shift-left approach, improved software quality, rapid response to emerging threats, code security challenges such as vulnerable dependencies, insecure coding practices, and lack of code review. The text also covers cloud security challenges including data breaches, misconfigurations, insider threats, and insecure APIs. It emphasizes the importance of addressing these challenges through a combination of technical measures and organizational practices. Additionally, it discusses the role of tools like Snyk and GitGuardian in enhancing DevSecOps practices, providing automated scanning and analysis capabilities to detect vulnerabilities and secrets, and offering real-time notifications, detailed reports, and remediation guidance to help developers address security issues effectively.

Mitigating DOM clobbering attacks in JavaScript` is a crucial topic for modern web developers as it highlights the risks of DOM clobbering and provides strategies to build more secure and robust web applications. The concept of DOM clobbering occurs when HTML elements conflict with global JavaScript variables or functions, leading to unexpected behavior and security loopholes. To address this issue, developers must employ diligent programming practices, substantive knowledge of JavaScript, and a firm grasp of web application security. Key strategies include properly scoping variables and functions, using unique identifiers, avoiding global namespace pollution, and utilizing modern JavaScript features such as `let` and `const`. Additionally, monitoring and detecting DOM clobbering vulnerabilities through static code analysis tools like Snyk Code can help identify potential issues before they become a problem. By implementing these techniques, developers can remain proactive in securing their coding practices and protect against the dangers of DOM clobbering.

AI encompasses a wide range of technologies, including logical and statistical approaches, generative AI, and LLMs, which can be used in various stages of software development and delivery, such as code generation, debugging, documentation, testing, and monitoring. While LLMs provide an interface for generating human-like text, they are not the only tool available, and combining different types of AI methodologies can expand coverage, intelligence, and opportunities for application security. Narrow AI is used in specific tasks, logical AI uses logic to represent problems and manipulate solutions, and generative AI produces new content similar to training data, while LLMs generate human-like text based on given prompts.

Chaos engineering is a systematic way of testing systems to their limits in a controlled manner to ensure they can withstand extreme conditions. It involves running targeted experiments to identify patterns in seemingly random and unexpected events, with the goal of proactively strengthening systems against unexpected events and building confidence that the system will work as intended no matter what. By injecting chaos into systems, teams can find system issues before they break publicly and improve their resilience. Chaos engineering is necessary for security because it proves that controls can withstand the unpredictable and ensures that real-life security programs do not exist in a vacuum. It's essential to focus on targeted experiments that uncover manual engineering errors, avoid trying to "boil the ocean" with too many issues at once, and expect failure as a critical tool in chaos engineering. As businesses continue to transform to the cloud, chaos engineering will become more critical than ever to prepare organizations for cloud transformation and maintain their new capabilities moving forward.

The SEC has adopted new rules on cybersecurity risk management, strategy, governance, and incident disclosure for public companies. These rules require the disclosure of material cybersecurity incidents within four business days to the SEC via Form 8-K, with specific requirements for describing the nature, scope, and timing of the incident, as well as its material impact or reasonably likely material impact on the registrant. The new rules also require publicly traded companies to describe their security practices, including processes for assessing, identifying, and managing material risks from cybersecurity threats, and the board of directors' oversight of these risks. The SEC Chair emphasizes that these rules aim to protect investors by providing consistent, comparable, and decision-useful cybersecurity disclosure. However, critics argue that this approach may not be practical or effective for all companies, particularly small ones with limited resources or expertise, and raises concerns about the potential consequences of delayed disclosure and the impact on national security and public safety. The new rules also have implications for privately owned businesses, government agencies, and startups, which are not subject to the same requirements. Ultimately, experts emphasize the importance of designing and developing secure systems from the start, knowing one's assets, shifting left in terms of security practices, building muscle memory around incident response and communications, using accurate tools to fix vulnerabilities quickly, and partnering with engineering friends to achieve these goals.

This PHP application is securely containerized using Docker, leveraging a multi-stage build process to improve efficiency and speed. The application's dependencies are installed using Composer, and the PHP runtime is configured for secure operation. A MySQL database is also containerized alongside the application, providing a secure environment for data storage. Additionally, a PHPMyAdmin container is used for local testing purposes. To ensure the security of the Dockerized application, Snyk is utilized to identify and fix vulnerabilities in the container image. Regular security scans are performed using the Snyk CLI to detect potential security issues and provide recommendations for remediation. By following these steps, developers can create a secure and efficient PHP application that is easy to maintain and update.

Software supply chain security solutions and tools are critical in safeguarding the integrity and security of software throughout its development and distribution lifecycle. These tools help organizations enhance their defense against supply chain attacks and ensure the trustworthiness of their software by providing comprehensive vulnerability scanning, dependency management, secure code analysis, and robust authentication mechanisms. When selecting a tool, it's essential to consider ease of use, seamless integrations with existing tech stacks, compatibility with developer tools, alignment with compliance requirements, continuous monitoring and remediation capabilities, and the ability to keep up with the latest security intelligence updates. There are three types of DevOps solutions that help maintain software supply chain integrity: Software Composition Analysis (SCA), Static Application Security Testing (SAST), and Container Security. SCA tools provide a comprehensive view of the software supply chain by generating a software bill of materials (SBOM). SAST tools monitor code to reduce the risk of security issues, while container security solutions offer robust information security for container-based systems. Organizations must carefully evaluate their specific needs and requirements to select the most suitable software supply chain security tools for their environment and how their security and engineering teams work.

Snyk is helping organizations implement the Software Bill of Materials (SBOM) for software management and security, as recommended by Japan's Ministry of Economy, Trade and Industry (METI). The METI has developed a guide to implementing SBOMs to secure software and services, following incidents where attacks on the software supply chain caused significant damage. Snyk provides tools to create and scan SBOMs for vulnerabilities, supporting the three phases of SBOM implementation: environment and system development, creation and sharing, and operation and management. By automating SBOM output through CI/CD pipelines or SCMs like GitHub, Snyk helps ensure that organizations always have the latest information. The company also offers support services in Japanese to help organizations comply with METI's requirements.