February 2025 Summaries

Snyk Code, a static application security testing tool, uses a Symbolic AI system to analyze code paths and detect security vulnerabilities. This approach provides better accuracy and faster execution compared to traditional pattern-matching methods. Snyk's SAST engine is tested on various codebases, including one imported from Florin Walter, a security practitioner. The tool detects multiple security challenges, including an open redirect vulnerability in a Python Flask application, Server-Side Request Forgery (SSRF) using Axios, and Cross-site Scripting Vulnerability in Express HTTP Response. Snyk's machine learning engine analyzes security defects and their fixes from the open source community to deduce and suggest security fixes for vulnerabilities like SSRF and XSS. The tool is free to get started, with a VS Code extension available for developers to integrate into their IDEs.

The integration of generative AI in DevSecOps enables teams to balance speed and security by automating and analyzing security tasks, reducing the risk created by AI-generated code. This approach promotes a culture of security, eases developers' burdens, and speeds up secure software delivery. Key benefits include faster vulnerability detection and remediation, increased developer productivity, and more efficient security operations. However, implementing AI in DevSecOps also presents challenges, such as planning effective rollouts, fine-tuning models with high-quality data, and ensuring humans remain involved to monitor recommendations. To overcome these challenges, leading teams follow best practices, including assessing workflows, establishing guidelines, selecting responsible providers, and reducing tool sprawl. Ultimately, AI-powered DevSecOps solutions can help minimize risk while accelerating secure software development.

Snyk is celebrating Black History Month with a focus on diversity and inclusion. The company believes that a diverse workplace is essential for innovation and success, and they're committed to fostering a culture where everyone feels valued and respected. Snyk has several initiatives in place to support the Black community, including their Resource Groups (SRGs) which amplify the voices of historically underrepresented communities. Two employees, Ashley Ladd and Alysa Turner, are being highlighted for their contributions to building strong communities at Snyk. The company is also demonstrating its support for local Black-owned businesses in Boston through partnerships and collaborations. Additionally, Snyk's Impact program allows all employees an opportunity to get involved in social responsibility efforts, including donating to organizations that advance racial equity and protecting civil rights. The company is growing and looking for people to join their team, with a focus on building a workplace where everyone feels valued, respected, and empowered to reach their full potential.

The newly released Claude 3.7 Sonnet model was commissioned to generate a classic CRUD application, and the output was examined for security vulnerabilities using Snyk's IDE extension. While no known vulnerabilities were detected in the generated code, cybersecurity professionals identified a few issues, including an email validation vulnerability that could be exploited by attackers due to its use of greedy quantifiers, which can cause Denial of Service issues. Despite this, the model performs better than earlier versions of Anthropic's Sonnet series and outperforms some competitors, such as GitHub Copilot and ChatGPT 4o, in terms of security vulnerabilities. The experiment highlights the importance of using tools like Snyk to help developers write secure code from the start.

Snyk Code can help identify weak and outdated cryptographic algorithms, such as MD5, that may be used in legacy applications or generated by AI code assistants. These algorithms pose serious security risks and should be avoided; instead, modern and secure cryptographic practices like Bcrypt, PBKDF2, or Argon2 should be used for tasks like password hashing. Snyk provides a fix analysis and best practices for employing strong algorithms, as well as resources on security best practices for cryptography, to help developers ensure the security of their codebases.

Incorporating security by design is crucial in today's fast-moving software development process, where threat actors exploit complexity. By embedding security at every stage of application lifecycle, teams can proactively mitigate risks and ensure more secure, resilient software applications. Adopting a secure-by-design approach can reduce risk, prevent bottlenecks, and save up to 100 times more on fixing defects early on compared to later stages. Organizations should adopt tools that automatically scan code and open source dependencies for vulnerabilities while providing fast and actionable feedback to shift left and make security the default choice. Integrating security into requirements and design phases is key, with clear responsibilities, threat models, relevant standards, suitable security tools, and implementation of automated security controls being essential best practices. A secure-by-design approach can be achieved through developer-first security platforms like Snyk, which provides automated scanning, scoring, and remediation capabilities to address security threats early on without slowing development. Bridging the gap between security and development is critical for DevSecOps success.

Snyk has partnered with John Hammond to host 'Fetch the Flag,' a 12-hour Capture the Flag (CTF) event for thousands of security professionals, practitioners, and members of the DevOps community since 2023. The annual CTF competition takes place on February 27 at 9 a.m. EST. Unlike some CTF events that are perceived as not being "real-world" or practical, Snyk's Fetch the Flag is inspired by real-world vulnerabilities, hacks, and exploits seen in the industry. This year's event will feature multiple challenges tied to real-world incidents, including an insecure access control challenge where players had to uncover hidden data on a camping checklist site made vulnerable by insecure access controls, and two remote code execution (RCE) vulnerability challenges: one related to Apache Spark Shell RCE (CVE-2022-33891) and the other to GitPython RCE (CVE-2022-24439). The competition is open to teams of up to 5 players, with prizes awarded to the top 3 teams and individual players.

The BoltDB Go Module was found to be backdoored with malicious code that allowed hackers to remotely control infected computers through a command and control server. The malicious package, which was released in November 2021, was cached by the Go Module Mirror service and remained unnoticed for several years. Researchers discovered the issue on January 30, 2025, and it had affected thousands of organizations over three years. The incident highlights a significant flaw in the software supply chain ecosystem, with malicious packages still being searchable on Go Module Proxy. To mitigate such risks, it is essential to follow best practices and use tools like Snyk to secure the software supply chain.

The integration between Snyk and Google Security Command Center enables modern security practices that unify cloud and application security efforts, simplifying risk management for CISOs. This collaboration provides a cohesive strategy to protect cloud-native environments and applications, allowing security teams to monitor and manage application security vulnerabilities and misconfigurations alongside cloud security issues in a single pane of glass. By combining Snyk's developer security capabilities with Security Command Center, organizations can achieve better visibility into their end-to-end security and prioritize the remediation of security findings based on risk severity, enabling swift action against new vulnerabilities or misconfigurations as they emerge at any point of the SDLC. The integration is quick to set up and offers several advantages, including centralized insights, near real-time detection and response, and actionable results.