SlideShare a Scribd company logo
1 of 67
Download to read offline
The State of Open Source Security
Languages, Containers &
Open Source Maintainers
Liran Tal, Developer Advocate, Snyk
Node.js Security WG
Liran Tal
OWASP NodeGoat
author of
- Essential Node.js Security
- O’Reilly’s Serverless Security
Developer Advocate
@liran_tal
@liran_tal
source: https://snyk.io/opensourcesecurity-2019
@liran_tal
source: https://snyk.io/opensourcesecurity-2019
@liran_tal
source: https://snyk.io/opensourcesecurity-2019
@liran_tal
source: https://snyk.io/opensourcesecurity-2019
@liran_tal
How much do we really know about our
open-source dependencies ?
@liran_tal
source: https://snyk.io/blog/how-much-do-we-really-know-about-how-packages-behave-on-the-npm-registry
*abandoned packages
61%
@liran_tal
source: https://snyk.io/blog/a-post-mortem-of-the-malicious-event-stream-backdoor
@liran_tal
source: https://snyk.io/blog/how-much-do-we-really-know-about-how-packages-behave-on-the-npm-registry
@liran_tal
Your App
@liran_tal
Your App
Your Code
@liran_tal
source: https://snyk.io/opensourcesecurity-2019
@liran_tal
Jan 2015
rimrafall
Jan 2017
crossenv
May 2018
getcookies
Jul 2018
eslint-scope
Nov 2018
event-stream
@liran_tal
May 2018
getcookies
Parse HTTP headers for cookie data
@liran_tal
May 2018
getcookies
Parse HTTP headers for cookie data
or does it...?
@liran_tal
@liran_tal
@liran_tal
getcookies
express-cookies
http-fetch-cookies
@liran_tal
getcookies
express-cookies
http-fetch-cookies
mailparser 440,000 downloads/month
@liran_tal
source: https://www.npmjs.com/advisories
@liran_tal
source: https://github.com/lirantal/npq/
@liran_tal
marked
ReDoS security vulnerability
2,224,691 weekly downloads
Fixed in 0.7.0 (July 2019)
4,325 dependent packages
source: https://snyk.io/vuln/npm:marked
@liran_tal
source: https://snyk.io/opensourcesecurity-2019
@liran_tal
open-source maintainers
security posture
@liran_tal
GitHub most popular integration:
Security
https://github.blog/2019-07-24-lessons-from-snyk-make-smarter-decisions-about-your-applications-security
@liran_tal
source: https://snyk.io/opensourcesecurity-2019
@liran_tal
source: https://snyk.io/opensourcesecurity-2019
@liran_tal
are open source maintainers
security conscious ?
@liran_tal
State of 2FA in the npm registry
@liran_tal
6.89%
of all maintainers
State of 2FA in the npm registry
@liran_tal
0.6%
of all packages
State of 2FA in the npm registry
@liran_tal
State of 2FA in ecosystem
@liran_tal
0%
of all maintainers
State of 2FA in ecosystem
*as to Oct 1st 2019
@liran_tal
State of 2FA in ecosystem
@liran_tal
State of 2FA in ecosystem
@liran_tal
State of 2FA in ecosystem
@liran_tal
State of 2FA in ecosystem
@liran_tal
State of 2FA in ecosystem
@liran_tal
State of 2FA in ecosystem
@liran_tal
The security blindspot of
lockfile attack vectors
@liran_tal
source: https://www.npmjs.com/package/lockfile-lint
@liran_tal
source: https://www.npmjs.com/package/lockfile-lint
@liran_tal
source: https://www.npmjs.com/package/lockfile-lint
@liran_tal
source: https://snyk.io/opensourcesecurity-2019
@liran_tal
Understanding the impact of
security fixes
@liran_tal
@liran_tal
@liran_tal
Best Practices
for Open Source Maintainers
@liran_tal
https://snyk.io/blog/ten-npm-security-best-practices
@liran_tal
Open-source dependencies impact
container security too
@liran_tal
1 billion weekly d/l
of container images
@liran_tal
source: https://snyk.io/opensourcesecurity-2019
@liran_tal
source: https://snyk.io/opensourcesecurity-2019
@liran_tal
44%
of docker image vulnerabilities can
be fixed with newer base images
@liran_tal
source: https://snyk.io/opensourcesecurity-2019
@liran_tal
@liran_tal
20%
of docker image vulnerabilities can
be fixed just by rebuilding them
@liran_tal
source: https://snyk.io/opensourcesecurity-2019
@liran_tal
source: https://snyk.io/opensourcesecurity-2019
@liran_tal
source: https://snyk.io/opensourcesecurity-2019
@liran_tal
Best Practices
for Docker Image Security
@liran_tal
https://snyk.io/blog/10-docker-image-security-best-practices
@liran_tal
Attackers are targeting open source
one vulnerability = many victims
@liran_tal
What if security was developer-friendly
easier
actionable
@liran_tal
Please Enjoy Responsibly
Open Source is Awesome
@liran_tal

More Related Content

Similar to The State of Open Source Security - Liran Tal - 2019 NodeJS+Interactive Montreal

Similar to The State of Open Source Security - Liran Tal - 2019 NodeJS+Interactive Montreal (20)

apidays LIVE Singapore 2021 - Securing the Open Source supply chain by Liran ...
apidays LIVE Singapore 2021 - Securing the Open Source supply chain by Liran ...apidays LIVE Singapore 2021 - Securing the Open Source supply chain by Liran ...
apidays LIVE Singapore 2021 - Securing the Open Source supply chain by Liran ...
 
Liran tal Stranger Danger Security vulnerabilities - Negev Web Developers mee...
Liran tal Stranger Danger Security vulnerabilities - Negev Web Developers mee...Liran tal Stranger Danger Security vulnerabilities - Negev Web Developers mee...
Liran tal Stranger Danger Security vulnerabilities - Negev Web Developers mee...
 
Stranger Danger - Finding vulnerabilities before they find you - Liran Tal 2021
Stranger Danger - Finding vulnerabilities before they find you - Liran Tal 2021Stranger Danger - Finding vulnerabilities before they find you - Liran Tal 2021
Stranger Danger - Finding vulnerabilities before they find you - Liran Tal 2021
 
Liran Tal - StrangerDanger - Finding Security Vulnerabilities Before They Fin...
Liran Tal - StrangerDanger - Finding Security Vulnerabilities Before They Fin...Liran Tal - StrangerDanger - Finding Security Vulnerabilities Before They Fin...
Liran Tal - StrangerDanger - Finding Security Vulnerabilities Before They Fin...
 
Demystify Information Security & Threats for Data-Driven Platforms With Cheta...
Demystify Information Security & Threats for Data-Driven Platforms With Cheta...Demystify Information Security & Threats for Data-Driven Platforms With Cheta...
Demystify Information Security & Threats for Data-Driven Platforms With Cheta...
 
Stranger Danger: Securing Third Party Components (Tech2020)
Stranger Danger: Securing Third Party Components (Tech2020)Stranger Danger: Securing Third Party Components (Tech2020)
Stranger Danger: Securing Third Party Components (Tech2020)
 
Origins of Serverless
Origins of ServerlessOrigins of Serverless
Origins of Serverless
 
Black Clouds and Silver Linings in Node.js Security - Liran Tal Snyk OWASP Gl...
Black Clouds and Silver Linings in Node.js Security - Liran Tal Snyk OWASP Gl...Black Clouds and Silver Linings in Node.js Security - Liran Tal Snyk OWASP Gl...
Black Clouds and Silver Linings in Node.js Security - Liran Tal Snyk OWASP Gl...
 
stackconf 2021 | Continuous Security – integrating security into your pipelines
stackconf 2021 | Continuous Security – integrating security into your pipelinesstackconf 2021 | Continuous Security – integrating security into your pipelines
stackconf 2021 | Continuous Security – integrating security into your pipelines
 
Building Serverless applications with Python
Building Serverless applications with PythonBuilding Serverless applications with Python
Building Serverless applications with Python
 
Threat Hunting with Splunk
Threat Hunting with SplunkThreat Hunting with Splunk
Threat Hunting with Splunk
 
PROGRAMMING AND CYBER SECURITY
PROGRAMMING AND CYBER SECURITYPROGRAMMING AND CYBER SECURITY
PROGRAMMING AND CYBER SECURITY
 
ThreatResponse
ThreatResponseThreatResponse
ThreatResponse
 
So You Want a Threat Intelligence Function (But Were Afraid to Ask)
So You Want a Threat Intelligence Function (But Were Afraid to Ask)So You Want a Threat Intelligence Function (But Were Afraid to Ask)
So You Want a Threat Intelligence Function (But Were Afraid to Ask)
 
DMA - Stupid Cyber Criminal Tricks
DMA - Stupid Cyber Criminal TricksDMA - Stupid Cyber Criminal Tricks
DMA - Stupid Cyber Criminal Tricks
 
All You need to Know about Secure Coding with Open Source Software
All You need to Know about Secure Coding with Open Source SoftwareAll You need to Know about Secure Coding with Open Source Software
All You need to Know about Secure Coding with Open Source Software
 
SplunkLive! Frankfurt 2018 - Customer Presentation: Bosch Cyber Defense Center
SplunkLive! Frankfurt 2018 - Customer Presentation: Bosch Cyber Defense CenterSplunkLive! Frankfurt 2018 - Customer Presentation: Bosch Cyber Defense Center
SplunkLive! Frankfurt 2018 - Customer Presentation: Bosch Cyber Defense Center
 
Guy Podjarmy - Secure Node Code
Guy Podjarmy - Secure Node CodeGuy Podjarmy - Secure Node Code
Guy Podjarmy - Secure Node Code
 
Construye tu stack de ciberseguridad con open source
Construye tu stack de ciberseguridad con open sourceConstruye tu stack de ciberseguridad con open source
Construye tu stack de ciberseguridad con open source
 
Serverless Security: A How-to Guide @ SnowFROC 2019
Serverless Security: A How-to Guide @ SnowFROC 2019Serverless Security: A How-to Guide @ SnowFROC 2019
Serverless Security: A How-to Guide @ SnowFROC 2019
 

Recently uploaded

在线制作约克大学毕业证(yu毕业证)在读证明认证可查
在线制作约克大学毕业证(yu毕业证)在读证明认证可查在线制作约克大学毕业证(yu毕业证)在读证明认证可查
在线制作约克大学毕业证(yu毕业证)在读证明认证可查
ydyuyu
 
Top profile Call Girls In Dindigul [ 7014168258 ] Call Me For Genuine Models ...
Top profile Call Girls In Dindigul [ 7014168258 ] Call Me For Genuine Models ...Top profile Call Girls In Dindigul [ 7014168258 ] Call Me For Genuine Models ...
Top profile Call Girls In Dindigul [ 7014168258 ] Call Me For Genuine Models ...
gajnagarg
 
Indian Escort in Abu DHabi 0508644382 Abu Dhabi Escorts
Indian Escort in Abu DHabi 0508644382 Abu Dhabi EscortsIndian Escort in Abu DHabi 0508644382 Abu Dhabi Escorts
Indian Escort in Abu DHabi 0508644382 Abu Dhabi Escorts
Monica Sydney
 
一比一原版(Offer)康考迪亚大学毕业证学位证靠谱定制
一比一原版(Offer)康考迪亚大学毕业证学位证靠谱定制一比一原版(Offer)康考迪亚大学毕业证学位证靠谱定制
一比一原版(Offer)康考迪亚大学毕业证学位证靠谱定制
pxcywzqs
 
Russian Call girls in Abu Dhabi 0508644382 Abu Dhabi Call girls
Russian Call girls in Abu Dhabi 0508644382 Abu Dhabi Call girlsRussian Call girls in Abu Dhabi 0508644382 Abu Dhabi Call girls
Russian Call girls in Abu Dhabi 0508644382 Abu Dhabi Call girls
Monica Sydney
 
一比一原版(Flinders毕业证书)弗林德斯大学毕业证原件一模一样
一比一原版(Flinders毕业证书)弗林德斯大学毕业证原件一模一样一比一原版(Flinders毕业证书)弗林德斯大学毕业证原件一模一样
一比一原版(Flinders毕业证书)弗林德斯大学毕业证原件一模一样
ayvbos
 
原版制作美国爱荷华大学毕业证(iowa毕业证书)学位证网上存档可查
原版制作美国爱荷华大学毕业证(iowa毕业证书)学位证网上存档可查原版制作美国爱荷华大学毕业证(iowa毕业证书)学位证网上存档可查
原版制作美国爱荷华大学毕业证(iowa毕业证书)学位证网上存档可查
ydyuyu
 

Recently uploaded (20)

在线制作约克大学毕业证(yu毕业证)在读证明认证可查
在线制作约克大学毕业证(yu毕业证)在读证明认证可查在线制作约克大学毕业证(yu毕业证)在读证明认证可查
在线制作约克大学毕业证(yu毕业证)在读证明认证可查
 
Trump Diapers Over Dems t shirts Sweatshirt
Trump Diapers Over Dems t shirts SweatshirtTrump Diapers Over Dems t shirts Sweatshirt
Trump Diapers Over Dems t shirts Sweatshirt
 
2nd Solid Symposium: Solid Pods vs Personal Knowledge Graphs
2nd Solid Symposium: Solid Pods vs Personal Knowledge Graphs2nd Solid Symposium: Solid Pods vs Personal Knowledge Graphs
2nd Solid Symposium: Solid Pods vs Personal Knowledge Graphs
 
Top profile Call Girls In Dindigul [ 7014168258 ] Call Me For Genuine Models ...
Top profile Call Girls In Dindigul [ 7014168258 ] Call Me For Genuine Models ...Top profile Call Girls In Dindigul [ 7014168258 ] Call Me For Genuine Models ...
Top profile Call Girls In Dindigul [ 7014168258 ] Call Me For Genuine Models ...
 
Mira Road Housewife Call Girls 07506202331, Nalasopara Call Girls
Mira Road Housewife Call Girls 07506202331, Nalasopara Call GirlsMira Road Housewife Call Girls 07506202331, Nalasopara Call Girls
Mira Road Housewife Call Girls 07506202331, Nalasopara Call Girls
 
Indian Escort in Abu DHabi 0508644382 Abu Dhabi Escorts
Indian Escort in Abu DHabi 0508644382 Abu Dhabi EscortsIndian Escort in Abu DHabi 0508644382 Abu Dhabi Escorts
Indian Escort in Abu DHabi 0508644382 Abu Dhabi Escorts
 
APNIC Policy Roundup, presented by Sunny Chendi at the 5th ICANN APAC-TWNIC E...
APNIC Policy Roundup, presented by Sunny Chendi at the 5th ICANN APAC-TWNIC E...APNIC Policy Roundup, presented by Sunny Chendi at the 5th ICANN APAC-TWNIC E...
APNIC Policy Roundup, presented by Sunny Chendi at the 5th ICANN APAC-TWNIC E...
 
Call girls Service in Ajman 0505086370 Ajman call girls
Call girls Service in Ajman 0505086370 Ajman call girlsCall girls Service in Ajman 0505086370 Ajman call girls
Call girls Service in Ajman 0505086370 Ajman call girls
 
Local Call Girls in Seoni 9332606886 HOT & SEXY Models beautiful and charmin...
Local Call Girls in Seoni  9332606886 HOT & SEXY Models beautiful and charmin...Local Call Girls in Seoni  9332606886 HOT & SEXY Models beautiful and charmin...
Local Call Girls in Seoni 9332606886 HOT & SEXY Models beautiful and charmin...
 
Tadepalligudem Escorts Service Girl ^ 9332606886, WhatsApp Anytime Tadepallig...
Tadepalligudem Escorts Service Girl ^ 9332606886, WhatsApp Anytime Tadepallig...Tadepalligudem Escorts Service Girl ^ 9332606886, WhatsApp Anytime Tadepallig...
Tadepalligudem Escorts Service Girl ^ 9332606886, WhatsApp Anytime Tadepallig...
 
Vip Firozabad Phone 8250092165 Escorts Service At 6k To 30k Along With Ac Room
Vip Firozabad Phone 8250092165 Escorts Service At 6k To 30k Along With Ac RoomVip Firozabad Phone 8250092165 Escorts Service At 6k To 30k Along With Ac Room
Vip Firozabad Phone 8250092165 Escorts Service At 6k To 30k Along With Ac Room
 
一比一原版(Offer)康考迪亚大学毕业证学位证靠谱定制
一比一原版(Offer)康考迪亚大学毕业证学位证靠谱定制一比一原版(Offer)康考迪亚大学毕业证学位证靠谱定制
一比一原版(Offer)康考迪亚大学毕业证学位证靠谱定制
 
Meaning of On page SEO & its process in detail.
Meaning of On page SEO & its process in detail.Meaning of On page SEO & its process in detail.
Meaning of On page SEO & its process in detail.
 
"Boost Your Digital Presence: Partner with a Leading SEO Agency"
"Boost Your Digital Presence: Partner with a Leading SEO Agency""Boost Your Digital Presence: Partner with a Leading SEO Agency"
"Boost Your Digital Presence: Partner with a Leading SEO Agency"
 
Nagercoil Escorts Service Girl ^ 9332606886, WhatsApp Anytime Nagercoil
Nagercoil Escorts Service Girl ^ 9332606886, WhatsApp Anytime NagercoilNagercoil Escorts Service Girl ^ 9332606886, WhatsApp Anytime Nagercoil
Nagercoil Escorts Service Girl ^ 9332606886, WhatsApp Anytime Nagercoil
 
Russian Call girls in Abu Dhabi 0508644382 Abu Dhabi Call girls
Russian Call girls in Abu Dhabi 0508644382 Abu Dhabi Call girlsRussian Call girls in Abu Dhabi 0508644382 Abu Dhabi Call girls
Russian Call girls in Abu Dhabi 0508644382 Abu Dhabi Call girls
 
一比一原版(Flinders毕业证书)弗林德斯大学毕业证原件一模一样
一比一原版(Flinders毕业证书)弗林德斯大学毕业证原件一模一样一比一原版(Flinders毕业证书)弗林德斯大学毕业证原件一模一样
一比一原版(Flinders毕业证书)弗林德斯大学毕业证原件一模一样
 
原版制作美国爱荷华大学毕业证(iowa毕业证书)学位证网上存档可查
原版制作美国爱荷华大学毕业证(iowa毕业证书)学位证网上存档可查原版制作美国爱荷华大学毕业证(iowa毕业证书)学位证网上存档可查
原版制作美国爱荷华大学毕业证(iowa毕业证书)学位证网上存档可查
 
20240507 QFM013 Machine Intelligence Reading List April 2024.pdf
20240507 QFM013 Machine Intelligence Reading List April 2024.pdf20240507 QFM013 Machine Intelligence Reading List April 2024.pdf
20240507 QFM013 Machine Intelligence Reading List April 2024.pdf
 
Best SEO Services Company in Dallas | Best SEO Agency Dallas
Best SEO Services Company in Dallas | Best SEO Agency DallasBest SEO Services Company in Dallas | Best SEO Agency Dallas
Best SEO Services Company in Dallas | Best SEO Agency Dallas
 

The State of Open Source Security - Liran Tal - 2019 NodeJS+Interactive Montreal