Snyk Intro - Developer Security Essentials 2022

Snyk’s
Developer Security Essentials
Liran Tal
Snyk

Liran Tal
@liran_tal
Developer Advocate @Snyk
Node.js Foundation
ecosystem security working group
Reach out on Twitter and say hi 👋
OWASP Project Lead
GitHub Star

@liran_tal
Introduction to Open Source Security
Meet Snyk:
Practical Developer-ﬁrst Security Tooling
Key
Learning
Objectives Play the Hacker 🎩

@liran_tal
Developer-ﬁrst Security
because that’s the only sustainable path to
application security

@liran_tal
Application’s Security Risks
Open Source
Libraries
Containers
App Code
IaC
Relying on open source software.
What’s your security and compliance strategy?
100s of Linux packages, and their
vulnerabilities, inherited with base images
#1 cloud vulnerability is misconﬁguration [NSA]
Deployed daily - waterfall approach doesn’t
scale. Scans can’t take hours.
10-20% of
codebase
80-90% of
codebase

Snyk Code Snyk Open Source Snyk Container Snyk IaC
Empowerment Extensibility Governance
Application intelligence Security intelligence
Developer Experience
Developer Security Platform

@liran_tal
App Code
exports.admin = function (req, res, next) {
User.find(
{
username: req.body.username,
password: req.body.password
},
function (err, users) {}
);

@liran_tal
App Code
exports.admin = function (req, res, next) {
User.find(
{
username: req.body.username,
password: req.body.password
},
function (err, users) {}
);
Security issues in this code?

@liran_tal
Open Source Code
source: https://snyk.io/open-source-security

@liran_tal
Open Source Code
80-90% of code-base is open-source
80% of vulnerabilities found in transitive
dependencies

@liran_tal
Open Source Code
dust.escapeHtml = function(s) {
if (typeof s === "string" {
if (!HCHARS.test(s)) {
return s;
}
return s.replace(QUOT,'"').replace(SQUOT, ''');
}
return s;
};

@liran_tal
Your App
Your Code
const marked = require('marked');
app.locals.marked = marked;
Open Source Code

@liran_tal
Open-Source Supply Chain Security
event-stream
💀 flatmap-stream
//2018
Open Source Code

@liran_tal
Snyk app
Open Source Code

@liran_tal
FROM node
RUN apt-get update
RUN apt-get install -y imagemagick
COPY . /usr/src/goof
WORKDIR /usr/src/goof
RUN npm install
CMD ["npm", "start"]
Big image, many
(vulnerable) libraries?
Containers

@liran_tal
source: https://snyk.io/open-source-security

@liran_tal
FROM node
RUN apt-get update
COPY . /usr/src/goof
WORKDIR /usr/src/goof
RUN npm install
CMD ["npm", "start"]
Common software
vulnerable?
Containers

@liran_tal
Your Node.js App Attack Surface
Just Got Bigger

@liran_tal
https://app.snyk.io
Open Source Code

@liran_tal
https://app.snyk.io
App repository
continuously scanned
Open Source Code

@liran_tal
https://app.snyk.io
???
Open Source Code

@liran_tal
https://app.snyk.io
???
Containers

@liran_tal
https://app.snyk.io
Containers

@liran_tal
Containers, FaaS
& Static Sites

@liran_tal
💀 electron-native-notify
2019
Open Source Code

@liran_tal
Open Source Code
source: https://snyk.io/advisor/npm-package/marked

@liran_tal
Breakout 1:
Let’s hack a Node.js application!

@liran_tal
An Open Source Library
const marked = require('marked');
app.locals.marked = marked;
<div class="item">
<a href="/edit/<%= todo._id %>">
<%- marked(new String(todo.content)) %>
</a>
</div>
we will exploit:

@liran_tal
Container Common
Software
RUN apt-get update
we will exploit:

@liran_tal
Container Node.js runtime
FROM node
we will exploit:
Container Common
Software

@liran_tal
Woohoo
That was fun!
What can I do about it… ?

@liran_tal
From DevOps To DevSecOps

CI/CD
Git repository
Traditional/PaaS
Serverless
Production
DevSecOps:
Continuous Security, Integrated
throughout DevOps
Registry
deploy
Security
gate
Code
Test & fix
Test, fix,
monitor
Kubernetes
Monitor & more...
build
submit
Test, fix,
monitor

@liran_tal
Snyk
Open Source ejs-locals@1.1.0

@liran_tal
Scanning projects
Filtering vulnerabilities
Snyk
Open Source
How to prioritize the noise?
Grouped ﬁxes
Visualizing a Dependency Tree
Self exploration: GitHub Settings & Dep Upgrades

@liran_tal
Filters the noise, “take home” with --json
Agnostic
Snyk CLI Use it as a linter
Tip: can run code and container scans too
Tip: can scan many ecosystem manifests
Tip: ad-hoc scan an npm package@version

@liran_tal
SAST Real-time code security
Find hard-coded secrets
Snyk Code
Recommended ﬁxes knowledge-base

@liran_tal
Security Resources ctd’
How do you assess a dependency?

@liran_tal source: https://snyk.io/advisor/npm-package/moment

@liran_tal source: https://deps.dev

What is a CTF?
Capture the Flag (CTF) is a competition where
teams and individuals compete to solve
security challenges.
● You win by solving the most challenges the
fastest.
CTFs gamify security education, making it fun
and hands-on.
● Participants often exploit vulnerabilities in
webpages or servers to uncover flags.

Nov 2:
CTF 101 Workshop
—
Nov 9:
Fetch the Flag CTF

Let’s Hack!
Develop fast.
Stay secure.
Fix vulns, score points, get
the high score

Supported Languages:
● C#
● Go
● Java
● JavaScript
● PHP
● Python
● Ruby
● TypeScript
Ground Rules:
● Must be GitHub
● Must be Public
● Let’s make a REAL difference
The Developer Challenge
https://nodeconf.snykchallenge.io/

@liran_tal
Takeaways
Your infrastructure is just as vulnerable,
take measures to monitor and ﬁx it

@liran_tal
Code Securely!
Security cheatsheets and more resources:
https://snyk.io/blog
Thank you
Snyk
liran_tal

Snyk Intro - Developer Security Essentials 2022

In this document

More Related Content

What's hot

Similar to Snyk Intro - Developer Security Essentials 2022

Recently uploaded

Snyk Intro - Developer Security Essentials 2022