August 2024 Summaries

The persistent threat of Log4Shell and Spring4Shell vulnerabilities remains significant, with over 60,000 projects still at risk despite being disclosed and fixed two years ago. Many companies continue to use outdated versions of these libraries in their projects, often due to the pressure of delivering new features and maintaining existing codebase, leading to a developer's dilemma between security and functionality. The attack complexity of these vulnerabilities is considered low, making them particularly high-risk. As developers, it's essential to recognize the importance of ensuring application safety and take responsibility for patching up vulnerabilities, rather than relying on others to fix the problems. Snyk provides tooling to help detect and address security vulnerabilities in applications, but ultimately, it's up to individual developers to shore up their defenses and keep their code secure.

Agents in Large Language Models (LLMs) are computer programs that can make autonomous decisions or perform actions on behalf of a user or another system. They offer a flexible and convenient way to connect multiple application components, such as data stores, functions, and external APIs, to an underlying LLM. However, agents also pose additional risks, including the vulnerability to prompt injection attacks, which can be exploited by attackers using old and new techniques. Prompt injection is a variant of injection attack where user-provided input is reflected directly into a format that the processing system cannot distinguish between what was provided by the developer and the user. Successful prompt injections in agent-based systems can have an array of potential impacts, but this is typically constrained to the LLM itself. Classic vulnerabilities in AI agents are also present, including software vulnerabilities that have been around for decades and will continue to be around in the future. To address these risks, prompt defenses are required to identify and prevent prompt injection attacks and other AI-specific vulnerabilities in any LLM input or output.

Snyk Code was chosen by developers as the only code security tool they've been regularly using or are looking forward to using in Stack Overflow's 2024 AI Search and Developer Tools survey, highlighting its dominance as a favorite AI security tool among both developers and security teams. Snyk Code balances the needs of both security and engineering teams by making it easy for developers to write safe code while strengthening industry-leading security standards. The tool is designed with developer experience at the forefront, empowering developers to secure their code as they go along, leading to consistent usage and better security. Snyk Code boasts a 4.5-year history of using AI to power faster, more accurate, and more thorough vulnerability detection and remediation, resulting in streamlined issue findings and user-friendly targeted automated reporting. The tool also features new capabilities such as DeepCode AI Fix, which empowers developers to proactively fix code vulnerabilities within the IDE in real time with over 80% accuracy, and CodeReduce, a proprietary technology that enhances the performance of AI models like GPT-4 by an astonishing 20%. With its focus on innovation and developer experience, Snyk Code continues to advance the field of AI-generated code security.

Australian and New Zealand financial service institutions are under pressure to innovate quickly while maintaining robust security and regulatory compliance, with many exploring Generative AI to accelerate software development. However, this increased velocity comes with a catch, as the use of AI coding assistants has intensified vulnerability management challenges, leading to significantly less secure code and an increased risk of security vulnerabilities. To adopt AI-powered coding safely, FSIs must enhance LLMs with proprietary data, rigorously test AI-generated code, keep human experts involved in overseeing AI operations, implement automated tools to review code, and adopt governance frameworks and guidelines. Developers also need practical tools and training to understand the risks of vulnerable code, and security champions or mini-CISOs within development teams must be appointed to drive security implementation. Ultimately, prioritizing speed and security is crucial, with developer-first platforms like Snyk providing 2.4x faster scans and automated one-click remediation to take the manual work out of fixing vulnerabilities.

As developers continue to rely on AI code generation, securing their applications against common vulnerabilities has become increasingly critical. To address this challenge, Snyk emphasizes the importance of having a reliable "guard dog" or AI security companion that can protect development teams from threats. Just like how dogs provide comfort and loyalty, an effective AI security solution can boost developers' confidence in their code. Moreover, a well-trained AI security companion should be compatible with development workflows, able to keep pace with the volume of generated code, and provide quick fix recommendations for security issues. By prioritizing training on high-quality data, Snyk's DeepCode AI Engine has become a trusted solution for securing AI-generated code.

The software development landscape is evolving rapidly, with developers increasingly incorporating third-party resources into their projects at a faster pace, thanks to AI coding assistants. Regulatory bodies and enterprises are pushing for stricter third-party software regulations, such as creating testable Software Bills of Materials (SBOMs), shifting code security further left to account for AI-generated code, providing actionable tools to select secure components, and leveraging business context to prioritize supply chain risk properly. As a result, companies must focus on proactive security practices to protect themselves from growing threats in the supply chain, including regulations around SBOMs, the rise of AI coding assistants, and an evolving threat landscape that includes AI-related attacks. To stay ahead, teams must identify ways to choose safe third-party resources, prioritize vulnerabilities by business criticality, and implement automated guardrails to prevent insecure components or licensing issues from entering repositories in the first place.

The article draws parallels between the dedication, hard work, and perseverance required by Olympic athletes to succeed in their respective sports and the consistent effort needed for effective application security (AppSec). It highlights three key areas where teams can focus their efforts to improve AppSec: developer collaboration, asset-first perspective on risk, and gathering accurate and up-to-date intelligence on vulnerabilities. The article emphasizes that just as Olympians train consistently for years, consistent hard work, focus, and perseverance are necessary to excel in application security.

The InCyber Forum in Europe brought together experts from Manulife, GitGuardian, and Snyk to discuss tips for implementing DevSecOps practices. Key takeaways include choosing security tools that fit the organization's culture and workflows, communicating effectively with development teams about the importance of application security, tracking relevant KPIs, and staying informed about emerging trends in AppSec. Manulife uses Snyk's developer-first security solutions to enhance their DevSecOps practices by integrating seamlessly into existing environments and offering actionable fix advice for vulnerabilities.

The research explores C/C++ vulnerabilities in NodeJS npm packages, specifically focusing on common security vulnerabilities and vulnerable patterns when writing C/C++ add-ons. The study aims to provide an overview of these issues and offer remediation examples for open source maintainers. The researchers used Snyk Code to model scenarios and perform a taint analysis to track potential security issues in a large set of npm packages, including those using NodeJS add-on APIs. The findings include multiple vulnerabilities in packages, primarily related to memory leaks, unchecked data types, and reachable assertions. The study highlights the importance of proper handling of C/C++ add-ons in NodeJS and provides guidance for maintainers to secure their code.

Snyk Code is a machine learning-powered Static Application Security Testing (SAST) tool that analyzes Java and Kotlin source code for potential security vulnerabilities. It identifies various issues, such as injection flaws to insecure deserialization, and provides detailed remediation advice to help fix these issues. Snyk Code supports various programming languages, including Java and Kotlin, making it an ideal choice for JVM projects. The tool can be integrated into development workflows using the command line interface (CLI), IDE integrations, or by connecting a Git repository. By adopting a proactive approach to security and incorporating Snyk Code into your regular development process, you can save time and money and potentially avoid damaging security breaches.

Gartner's report emphasizes the importance of security specialization in an AI security tool, particularly when it comes to customizing models for specific use cases or advanced teams. The report notes that generative cybersecurity AI on real-time content may take more time to arrive and requires specialized models trained on such data. This aligns with Snyk's approach, which has a proprietary AI model customized for security and is independent of other AI coding assistant brands. Snyk's experience shows that specialism is key to creating a tool that successfully straddles both security teams and developer teams, addressing the need for intelligent accuracy as well as raw speed. The report also highlights the importance of driving accuracy in a complex area like AI security, which requires methods used when developing an AI model to contribute to how robust a security tool is. Additionally, Snyk's technology and process came out of its collective knowledge, resulting in accurate and streamlined results. The company's focus on making developers happy with fix prioritization and security teams happy with full application visibility and protection is also emphasized. Furthermore, the report notes that generative AI will likely accelerate zero-day attacks, making rapid reactive response necessary, which is where Snyk's proactive approach to capturing and neutralizing risks in the IDE comes into play. Finally, the company's vision is to help teams embrace AI safely without the mental load of worrying about security adequacy, propelling innovation while securing applications with the right security solution and partner.

Snyk's goal is to empower developers to build fast but safely, and they've been a pioneer in the "shifting left" approach to security. With the increasing adoption of generative AI APIs or models by 2026, Snyk aims to help developers increase productivity with AI while maintaining trust in their code security. However, this shift also raises concerns about speed, transparency, and trust in AI-generated vulnerabilities and fixes. To address these concerns, Snyk focuses on outcomes and partnering with customers, achieving success as a Leader in both The Forrester Wave: Software Composition Analysis (SCA), Q2 2023, and the 2023 Gartner Magic Quadrant for Application Security Testing. Gartner's "4 Ways Generative AI Will Impact CISOs and Their Teams" report highlights common areas of concern, such as copyright violations, biased or incomplete responses, policy violations, and lack of transparency. Snyk recommends creating a governance framework, conducting regular employee training, and exploring modern security solutions to accompany AI coding assistants. The company's hybrid AI model combines symbolic AI, generative AI, and machine learning methods with extensive security-focused fine-tuning, reducing errors and increasing accuracy. This approach allows for fast and complete scans in the IDE, detecting issues and suggesting fixes, while introducing cognitive discretion and boosting precision in AI-powered tools.

Application vulnerability management is a comprehensive approach to identifying, classifying, remediating, and mitigating application vulnerabilities. To adapt to the evolving development landscape, security teams must strike a balance between old and new techniques. Vulnerability management plays a crucial role in application security but falls short due to its limitations, including traditional approaches seeing each vulnerability as existing in a vacuum, lacking full application context, relying solely on standard scores such as CVSS, requiring developers to leave their native environment for scanning, and aiming to consolidate all vulnerabilities into one view. To overcome these limitations, teams can leverage automation, empowering developers to play a part in vulnerability management, and adopting a contextual, risk-based, and developer-first approach like Snyk's security testing and application security posture management.

The new Snyk Analytics for Snowflake integration allows customers to seamlessly access and analyze Snyk's data from their Snowflake account, combining powerful AppSec analytics with Snowflake's cutting-edge data platform. This partnership equips users with the ability to extend their data analytics, complete missing pieces, accelerate time to value, and unleash tailored AppSec analytics. The solution provides a seamless experience, easy access to fresh data, and the ability to serve internal customers where enterprise data lives, while optimizing engineering resources and cutting operational costs.

Snyk has introduced new integrations with leading Internal Developer Portals (IDPs) and service catalogs such as ServiceNow CMDB, Atlassian Compass, OpsLevel, Harness, and Datadog Service Catalog to enhance application risk management with development context. These integrations provide a deeper understanding of application assets, services, and dependencies, enabling security teams to see the full context of each asset, including business importance, ownership, and deployment details. This allows for comprehensive and aligned security measures that are prioritized according to the business's needs. The new integrations bring significant value to managing an application security program by providing visibility into all application assets involved in building the app, knowing their ownership, and understanding their importance to the development process and broader business.

The adoption of AI in businesses is growing at a rapid pace, with AI growth happening two times faster than early internet adoption. However, security teams face the challenge of driving innovation while also managing risks associated with AI tools such as insecure code suggestions and library hallucinations. To safely adopt these powerful technologies, companies should classify AI usage by business impact criticality, use AI guardrails instead of relying on LLMs alone to determine code security, pay attention to the training model and protect it from attacks, and know where AI exists within their current tech stack.