November 2024 Summaries

The article discusses why a solid DevOps foundation is crucial for effective DevSecOps implementation. It explains that as DevOps adoption has increased, developers often view security as an obstacle or afterthought due to the fast pace of development. This necessitates a new approach from security teams to keep up with the speed of DevOps. The article introduces DevSecOps as a natural extension of DevOps, emphasizing that it's more than just shifting tools left and needs to support software delivery goals while reducing security fatigue. It highlights the role of DevOps in DevSecOps, explaining how shared responsibility for application security among developers, operations, DevOps/platform teams, and security professionals is vital. The article also discusses integrating security into existing infrastructure management workflows as part of a new DevSecOps framework. Furthermore, it emphasizes the importance of empowering developers to take on many security tasks independently within the software development lifecycle (SDLC) to enable a secure software development lifecycle (SSDLC). The article concludes by discussing how automating security can start with shifting left and integrating DevSecOps into delivery pipelines, as well as the importance of DevSecOps in production. It also introduces Snyk, a developer-first security platform that helps integrate DevSecOps practices into every stage of the SDLC.

In a series focusing on women leading in cybersecurity, mentorship emerged as a key factor for career development and overcoming barriers in the industry. Women from various backgrounds shared their experiences of how mentors helped them realize their potential, build confidence, and improve both technical and soft skills. Mentors also played a crucial role in teaching women to advocate for themselves and champion their work within organizations. By sharing these personal stories and insights, the series aims to inspire professionals at all levels to support diversity and help break down barriers for women entering the security field.

In the software development industry, proactively securing the software development life cycle (SDLC) is crucial. Key performance indicators (KPIs) for AppSec programs include risk reduction metrics, team coverage and engagement, application security posture trends, and vulnerability management efficiency. By measuring these KPIs, organizations can demonstrate the value of their AppSec program to executives and stakeholders, showing how it helps achieve business objectives, improve operational efficiency, and ensure compliance with relevant regulations. Effective storytelling techniques should be applied when presenting the successes of an AppSec program, focusing on outcomes and using visual aids to emphasize favorable trends.

Last week, Snyk hosted its first Capture The Flag (CTF) 101 Workshop for Students in partnership with the Office of the National Cyber Director at The White House. This event brought together students from over 100 schools worldwide to engage in hands-on learning and develop critical cybersecurity skills. CTFs are immersive, gamified experiences that challenge participants to solve real-world security problems. Snyk Learn offers free cybersecurity education and training for everyone, including upcoming opportunities for students to dive into hands-on learning experiences.

The cybersecurity industry is witnessing a transformation as women are emerging as bold leaders, committed to inclusivity. Despite being underrepresented compared to other sectors, the gender gap in security roles is expected to gradually narrow due to increasing emphasis on diversity and creation of pathways for women's advancement. Snyk has launched its Women Leading Security series, featuring influential female cybersecurity leaders sharing their journeys and lessons learned. The initiative aims to promote greater visibility for women leaders, inspire a new generation of women in the field, and support organizations like Girls Who Code to create more pathways for women in security and foster a diverse, inclusive future in tech.

Vulnerability counting is an ineffective method for evaluating cybersecurity risk as it doesn't account for factors like exploitability, business impact, and data sensitivity. Risk-based prioritization is a superior approach that assesses the actual risk posed by each vulnerability. This method reduces alert fatigue, drives greater collaboration between teams, and helps direct limited resources to counter the threats that would cause the most harm. To implement risk-based prioritization, organizations should gain comprehensive visibility of their application environment, incorporate business context, analyze security testing results, evaluate runtime risk signals, develop a risk-scoring model, establish prioritization criteria, and continuously refine the approach.

Command injection is a security vulnerability that occurs when an application passes unsafe user-supplied data to a system shell, allowing attackers to execute arbitrary commands on the host operating system under the same application user. In Go, command injection often involves using the os/exec package to spawn system commands. To mitigate this risk, developers should validate and sanitize all user inputs, use parameterized commands, and leverage safe APIs or libraries instead of system commands. Additionally, tools like Snyk Code can help identify and fix vulnerabilities in Go code.

Snyk, a developer security platform, has been recognized as a Leader in The Forrester Wave™: Software Composition Analysis (SCA) Software, Q4 2024 report. It was named a Customer Favorite and received the highest possible scores in several criteria within both Strategy and Current Offering categories. Snyk's commitment to developer security, innovation, and customer focus has contributed to its success as a pioneer in shift-left security and developer-first approach.

Snyk has acquired Probely, a provider of API Security Testing and Dynamic Application Security Testing (DAST), expanding its range of development and application security solutions. The acquisition aims to help customers detect threats related to large language models (LLMs) and protect their APIs and data. Probely's technology aligns with Snyk's commitment to Developer Security, offering a Dev-first approach that minimizes disruption to developers' workflows. The integration of Probely's capabilities into the Snyk Platform will enable holistic application risk management and provide immediate value for customers' AppSec programs.

The article discusses the challenges faced by AppSec teams in managing application risk due to lack of visibility across the entire software supply chain. It highlights issues such as conflicting priorities between developers aiming for speed and AppSec teams focusing on reducing risk, proliferation of security tools, and lack of insight into the components of every software asset from development to runtime. The article introduces a new breed of security tooling called application security posture management (ASPM) that can help manage and scale application security programs by continuously managing application risk through collection, analysis, and prioritization of security issues across the SDLC. It also presents Snyk AppRisk as a developer-first ASPM solution for AppSec teams wanting to shift left. The article concludes with the benefits of ASPM in improving visibility, collaboration between developers and security teams, and overall risk assessment and management.

Terraform is a popular Infrastructure-as-Code platform used by organizations for managing their cloud or on-premises infrastructure. However, automation platforms designed to manage the Terraform lifecycle can be exploited to compromise entire cloud environments. Several SaaS and open-source platforms follow a pull request based approach where a repository contains HCL files describing the target infrastructure. Executing terraform plan can create an execution plan that lets users preview changes before deployment, but this process also has potential attack points. Custom providers and data sources in HCL can be used to execute malicious commands during a Terraform plan. Automation platforms like Hashicorp Cloud, Atlantis, Digger, Env0, and Terrateam are susceptible to these attacks under default configurations. Mitigations include integrating CI jobs with allowlists for providers and data sources or adopting secure defaults in automation platforms.

The Web Almanac is a collaborative report that provides valuable insights into how people build and use the web. It's created by a community of experts who analyze data from millions of websites, sourced from HTTP Archive's periodic web crawls. The last edition included 43.88 TB of data from 8.36 million websites. Security teams can benefit from this report by discovering new features and conducting gap analysis to identify common areas where websites fall short in security best practices. Participation in the Web Almanac project is open on GitHub, allowing developers, operations, and security practitioners to contribute their expertise.