June 2024 Summaries

Securing a REST API is crucial to prevent cyber threats and protect sensitive data. This involves implementing robust authentication and authorization mechanisms, securing data in transit and at rest, validating and sanitizing input data, using secure dependencies, and continuously monitoring and updating the API. By following best practices and using tools like Snyk, developers can significantly improve the security of their REST APIs.

The polyfill.io website was taken over by a foreign company, Funnull, which embedded malicious code in JavaScript assets fetched from their CDN source at cdn.polyfill.io. This attack impacted more than 100,000 websites, including publicly traded companies such as Intuit, due to the widespread use of the polyfill library. The malicious code injected into these sites could perform various nefarious activities, such as redirecting users to phishing sites or stealing sensitive information. To protect against such attacks, it is recommended to use trusted CDNs, monitor dependencies, implement Content Security Policy (CSP), and keep all libraries and dependencies up-to-date. Additionally, evaluating whether polyfills are still necessary for a project can help reduce the risk of such vulnerabilities. The recent attack highlights the critical importance of supporting resources across the web ecosystem and emphasizes the need for robust security measures to safeguard against supply chain attacks.

Snyk is a tool that helps spot project vulnerabilities, including hardcoded secrets, by analyzing dependencies and comparing them against its vulnerability database, generating comprehensive reports. To use Snyk, one needs to create a free account, allow access to email address linked to the account, and configure access settings to enable regular scans and generate Fix Pull Requests. The Snyk goof project is used as a reference Node.js boilerplate application with hardcoded secrets that can be fixed using Doppler, an open-source secret management tool. By adding secrets to Doppler, one can centralize their secrets, manage different environments, and prevent accidental exposure on GitHub. The Doppler CLI provides access to secrets in every environment, making it easy to inject them into applications. Snyk and Doppler work better together, streamlining the development process with more security and efficiency.

Snyk has updated its Code feature to protect against security risks associated with using Large Language Models (LLMs) in software development. The update extends vulnerability-scanning capabilities to detect issues with LLM libraries, including those from OpenAI, HuggingFace, Anthropic, and Google. Snyk Code now performs a taint analysis, detecting untrusted data and generating alerts for potential security issues. This move demonstrates Snyk's commitment to making AI safe and trustworthy, as it secures both AI-generated and human-created code, as well as third-party LLM code issues at the source-code level. The update aims to enable developers to confidently build AI capabilities into their applications without compromising security.

"` The attack exploits a vulnerability in caching and bypassing Istio RBAC using HTTP response header injection. The attacker forces NGINX to cache responses, allowing them to target other users with vulnerabilities that are typically only self-exploitable. The second attack bypasses path-based RBAC rules in Kubernetes Istio, enabling full interaction with protected applications without interference from Istio. The vulnerability is exploited by injecting HTTP response headers into the response, causing NGINX to cache the response and provide it to another user. This can be achieved by tricking Envoy, a reverse proxy underpinning Istio, into believing that a connection has been successfully upgraded to a WebSocket connection, allowing data to be forwarded to the upstream application server without additional processing or RBAC validation. The best mitigation is to fully evaluate the applications themselves to ensure they do not contain HTTP response header injection vulnerabilities.

Snyk has partnered with Google Cloud to provide a seamless integration of security controls across development and production environments, enabling businesses to develop fast while staying secure. The partnership combines Snyk's developer-first application security tooling with Google's continuous innovation for developers, allowing teams to align their security initiatives with the speed of cloud-native development. This collaboration addresses challenges such as scaling security, facilitating shared responsibility between development and security teams, and securing AI-generated code. By leveraging Snyk's real-time scanning and actionable remediation advice, development teams can work quickly and confidently, knowing that their code is secure, while also gaining full security visibility across their Google Cloud ecosystem.

Snyk and Accenture's Application Security Posture Management (ASPM) approach is proposed as a solution to the growing challenges faced by security teams in today's fast-paced software development environment. The main reasons for the struggles include lack of security context, visibility, and proper organization-level controls and safeguards. ASPM provides a centralized dashboard offering visibility into application assets and their relationships, prioritizing risk based on context derived from a broad understanding of the application, deep insights into the business environment, and runtime intelligence from deployed in-production applications. The solution addresses the needs of various teams across the enterprise, including application security leaders, development teams, and business leaders, by providing consolidated reports, prioritized alerts, and guidance on remediating vulnerabilities in context. Snyk AppRisk is a key offering that secures all developers' code throughout the software development lifecycle (SDLC), provides fast, accurate, and actionable findings, and integrates directly into application developers' native workflows. Accenture extends this security approach with cyber strategy offerings to enable teams to operationalize and build runbooks that accelerate the onboarding of new applications and workflows onto an ASPM solution.

The Snyk Language Server (LS) is now integrated with IntelliJ IDEs to reduce code duplication, streamline development, and improve security. The LS protocol allows for automatic scanning, providing developers with a quick feedback loop after start-up and file saves. Additionally, the integration simplifies developer education by linking vulnerable issues to relevant lessons in Snyk Learn. The DeepCode AI Fix feature is also available, offering automatic vulnerability fixes with clickable actions. This update enhances the overall development experience, producing better, more secure code through automated processes.

Developers are increasingly relying on AI coding tools to generate code, detect bugs, and offer suggestions, but this reliance comes with several risks including security vulnerabilities, intellectual property infringement, lack of explainability and transparency, and inconsistent policies around AI-generated code. To mitigate these risks, developers must review, debug, and improve AI-generated code, conduct audits and peer reviews, use tools like Snyk Code to analyze for security vulnerabilities, train teams in potential pitfalls, create clear policies around AI usage, document AI-generated code, and educate stakeholders about these policies.

The growing complexity of software development environments and expanding cyber threats are creating significant challenges for AppSec teams, who must grapple with blind spots in their programs to collaborate effectively on reducing application risk. A vulnerability management-based approach for AppSec has its benefits, but it falls short due to a lack of application context, which means that the unified view of security issues often lacks context about the application's importance, architecture, assets, and runtime behavior. This limits the AppSec team's ability to make informed decisions and guide developers toward targeted fixes. Additionally, this approach can lead to poor developer experience if developers are not actively using their security tools or if the solutions create obstacles and add friction to the development workflow. A better approach is needed to ensure effective collaboration between AppSec and development teams, which is where Snyk AppRisk comes in, providing application discovery and visibility, coverage management, and risk-based prioritization, while considering the broader perspective of managing application risk as a whole.

Snyk has announced native Amazon EKS support through an AWS Marketplace add-on, allowing customers to deploy and manage Snyk on Amazon Elastic Kubernetes Service (Amazon EKS) clusters seamlessly from the AWS Management Console or using the AWS Command Line Interface (CLI). This integration streamlines deployment and management of Snyk on EKS, making it easy for customers to automatically deploy the Snyk Runtime Sensor into their existing and newly created EKS clusters. To leverage this feature, customers must have a Snyk license and can subscribe to the add-on through the AWS Marketplace.

This summary provides an overview of essential Node.js backend examples for developers in 2024. It discusses the use of advanced JavaScript features such as WHATWG Streams Standard, Web Streams API, async iterables, and template literals to create efficient and secure backends. The article highlights the importance of security measures like validating webhook signatures using the crypto module and working with buffers to handle binary data. Additionally, it explores the use of symbols for encapsulation and demonstrates how tagged templates can be used to generate HTML and SQL queries safely. The summary provides a concise overview of the key points covered in the article, including the benefits of using Node.js for backend development and the importance of security considerations when building backends.

GIGO is a real concern in software development and AI, as it can lead to inaccurate or undesirable results if the input data is of poor quality. An expert system, which relies on a knowledge base and inference engine, can be particularly susceptible to GIGO if the data used to train it is incorrect or biased. This can result in flawed decision-making or recommendations, with real-world consequences. The use of AI systems without proper validation and testing can lead to these issues, highlighting the need for developers to prioritize accurate and reliable input data.

The vulnerability in GitHub Actions lies in its handling of forked repositories, which allows attackers to exploit the `pull_request_target` event to gain access to the base repository's context and secrets. This can lead to a "Pwn Request" scenario where an attacker can compromise the GITHUB_TOKEN and leak secrets. Additionally, workflows triggered by `workflow_run` events can also be vulnerable if they checkout code from forked repositories or use insecure artifacts. To secure GitHub Actions workflows, developers should avoid running privileged workflows on untrusted code, validate the triggering repository and user, run the workflow only after manual validation, check that the triggering repository matches the base repository, treat actions as 3rd-party dependencies, handle untrusted artifacts securely, restrict the code that runs on self-hosted runners, and adhere to the least privilege principle. A community tool, GitHub Actions Scanner, has been created to help identify potential issues in workflows and actions.

The Snyk CLI team has introduced Semantic Versioning and release channels, aiming to design the CLI that not only helps developers do their jobs well but also brings them joy. The team conducted research through interviews with 24 fellow Snykers, identifying recurring signals such as the need for a better way to choose suitable versions of the CLI. They established a baseline of pain points and an impact feedback loop, now seeking input from users on how to improve the local developer experience within Snyk CLI, reducing friction and delivering a consistent product experience. The team invites developers and DevSecOps professionals to participate in their discovery opportunity by sharing their experiences and pain points via email at [email protected].

Next-gen software development involves complex architecture with multiple external libraries and SaaS platforms, rapidly emerging AI tooling for code generation, and distribution across multiple cloud environments and geographic locations. Balancing people, processes, and tools is crucial to address these challenges, including shared responsibility between development and security teams through a DevSecOps approach. A proactive approach to security can foster better relationships between teams, involve threat modeling, remediation methodologies, and shifting left cultures that emphasize security by design. Measuring AppSec success involves tracking key metrics such as security training implementation, security testing coverage, critical/high vulnerability testing, time to patch/time to remediate, and number of security automation. These measurements can also tie back to business KPIs, highlighting the importance of continuous security and developer-friendly practices in next-gen software development.

The survey of 459 IT professionals found that organizations have adopted generative AI coding tools but failed to undertake basic steps for secure adoption, such as running proof of concept exercises. Despite this, C-Suite respondents were more confident in their organization's readiness for AI coding tools than others. Application security teams are more worried about the security of AI-generated code and security policies, highlighting a gap between those developing and enforcing security policies and those overseeing broader technology adoption. The biggest barrier to AI adoption remains concerns about security, which underscores the need for robust policies and measures to manage these risks.

Snyk has partnered with Snowflake to revolutionize data and application security by combining the advanced capabilities of Snyk's security data with the robust infrastructure of Snowflake's data platform, empowering customers with customizable views of their security posture. This partnership enables customers to measure their security posture, prioritize risk remediation, and inform strategic decisions to secure their applications, providing a competitive edge in driving innovation and resilience. Snyk is sponsoring the Data Cloud Summit as a Snow Row Sponsor, presenting a Theater Session on June 5th, "Snyk's Best Practices for Data-Driven Security Analytics," and co-sponsoring the Cybersecurity Social. The partnership was driven by their shared commitment to advancing application security and has been recognized as an Emerging Segment Leader in Application Security in Snowflake's Next Generation of Cybersecurity Applications report. Snyk invites customers to explore its Reporting and Analytics Powered by Snowflake solution, which provides powerful insights into security posture and actionable data protection, helping build a safer future for all.