July 2022 Summaries

StackHawk has launched a new integration with GitHub CodeQL, allowing developers to view correlated results from StackHawk scans and GitHub CodeQL findings in a single interface to expedite the resolution of high-priority issues. This integration directs developers to the specific line of code containing the issue, reducing uncertainty in prioritizing fixes. StackHawk's Head of Product, Lauren Nagel, and Solutions Architect, Zachary Conger, are hosting a session to demonstrate the integration's capabilities in addressing critical issues swiftly. The company is also engaging with the developer community through various events, including webinars on application security and discussions on API security, while actively encouraging users to share their experiences and provide feedback.

Forrester Research's 2022 State of Application Security Report highlights significant shifts in how engineering and security leaders are approaching application and API security, emphasizing the role of development teams in security tooling decisions and budget holding. The report underscores the importance of integrating dynamic and static application security testing (DAST and SAST) to enhance remediation speed, with organizations increasingly implementing DAST in pre-release cycles and fostering collaboration between security and engineering teams. This approach, known as "shifting left," integrates security into the development lifecycle to maintain deployment speed without compromising security. The emphasis on unified tooling is crucial, as it allows developers to address security issues seamlessly without disrupting their workflow, boosting both productivity and security efficacy. Recent integrations, like the correlation of StackHawk DAST findings with GitHub CodeQL SAST findings, enable developers to prioritize and fix exploitable security issues efficiently, transforming security teams into strategic leaders focused on risk management. These developments not only streamline the process for developers, saving significant time, but also ensure that security is an integral part of the software delivery process.

StackHawk has introduced support for arm64 architecture by releasing packaged executables and Docker images for its scanning engine, enhancing its software build process to accommodate future computer architectures. This development involved adapting the StackHawk CLI and Docker images to function on arm64, using tools like Kotlin, Clikt, and Gradle, which enabled multi-architecture compatibility through Java's cross-platform capabilities. The process required leveraging Docker's BuildKit toolkit, using the –platform flag, and employing the binfmt_misc with QEMU emulator for cross-platform builds, especially in Linux and CI environments. The distinction between registries, repositories, images, and manifests was crucial, as these elements facilitated the storage, identification, and retrieval of architecture-specific software versions. By using Gradle tasks within the CI/CD pipeline, StackHawk automated the creation of multi-architecture images, enabling development on various platforms, including Apple's M1 silicon, and providing a foundation for future architectural expansions. The initiative underscores the importance of understanding Docker's handling of multi-architecture builds and aims to guide others in developing software compatible with multiple platforms.