devopsy.kinsta.cloud

Tag: Snyk

  • Snyk Extends Tools Portfolio to Drive DevSecOps Adoption

    Snyk Extends Tools Portfolio to Drive DevSecOps Adoption

    During its online SnykCon 2021 conference this week, Snyk extended Snyk Code, a static application security testing (SAST) tool that already supports the Java, JavaScript and Python programming languages to include support for C#, Ruby, PHP and Go.

    At the same time, Snyk Open Source, a platform for remediating open source vulnerabilities, has been extended to provide native integration with Atlassian BitBucket and AWS CodePipeline platforms for driving DevOps workflows. Snyk has also tightened integrations with platforms from DigitalOcean and HashiCorp.

    Snyk also added support for the Elixir programming language and package managers Yarn 2 and Poetry alongside integration with a C++ scanning tool from FossilID, a provider of a software composition analysis (SCA) tool for open source code that Snyk acquired earlier this year.

    The Snyk Container platform is now integrated with the open source Trivy container scanning tools and with Snyk’s vulnerability database in addition to adding support for container registries such as Quay, GitHub Container Registry, GitLab, Google Artifact Registry and Harbor.

    The Snyk infrastructure-as-code platform now also makes it possible to detect configuration issues in Kubernetes manifests in Terraform code in a way that is compatible with cloud platforms from Amazon Web Services (AWS), Microsoft Azure and Google Cloud Platform (GCP).

    Snyk also is adding support for version 3 of OpenAPI, which the company reports is three times faster than the previous version. That API is also the foundation for Snyk Apps that the company will continue to roll out.

    Finally, Snyk launched both a new free developer security education program, dubbed Snyk Learn, through which developers can attain and measure their level of DevSecOps expertise and Snyk Impact, an effort to foster collaboration among developers involving a wide range of socio-economic issues.

    Company president Guy Podjamy said as DevsecOps continues to evolve, the primary focus remains on developers and DevOps teams. However, as an issue, DevSecOps is also becoming more important at both the C-level within organizations as well as individual security operations teams. As such, and in the wake of recent high-profile security breaches, the sense of urgency surrounding DevSecOps is now a lot higher. The fundamental challenge organizations are trying to address is finding a way to improve overall application security without slowing down the pace at which applications are built, noted Podjamy.

    Snyk itself revealed it has secured an additional $530 million round of funding to address those issues. The company has now raised a total of $775 million to date with a valuation of $8.5 billion. Snyk also revealed it has increased annual recurring revenue (ARR) by 154% year-over-year from a customer base that now spans more than 1,200 organizations, including Asurion, Google, Intuit, MongoDB, New Relic, Revolut and Salesforce. Snyk customers and users collectively have run more than 300 million tests in the last 12 months to fix more than 30 million vulnerabilities in a 90-day period of time, the company claims.

    It may be a while before most organizations have embedded security tools within every DevOps workflow. However, given the resources being poured into DevSecOps, it may be more a question when DevSecOps will be finally achieved rather than if.

  • Report: The State of Cloud-Native Application Security

    Report: The State of Cloud-Native Application Security

    The cloud brings tremendous capabilities in terms of increased deployment fluidity and automation. Along with cloud adoption has come the use of cloud-native tools built specifically for developing applications for this domain. However, cloud-native tools carry some nuanced security concerns, such as misconfigurations, known vulnerabilities and leaked secrets. As such, 83% of organizations recognize security as very important to their cloud-native strategy, according to a recent report from Snyk.

    Snyk’s State of Cloud Native Application Security report surveyed hundreds of IT professionals on their cloud-native security concerns. Below, we’ll pick out the top takeaways from the report, identify the most common trouble areas for cloud-native application security and see if there’s a correlation between deployment automation and higher degrees of application security.

    The Move to Cloud-Native

    Teams are moving to cloud-native tech, empowering DevOps with software-driven architecture and infrastructure-as-code (IaC). In this new cloud-native paradigm, 58% of production workloads are deployed as containers, 21% now are serverless and 50% use some form of IaC within the deployment process.

    Organizations are moving to cloud-native technology for a variety of reasons. For one, containerized software affords increased speed — 68% of organizations moved to containers for increased deployment velocity, the study found. This is followed by ease of management (at 67%) and reduced cost (43%). There is also the security imperative for adopting cloud-native tools; 36% of respondents cited security as a primary reason for moving production applications to containers.

    Top Cloud-Native Security Concerns

    While cloud-native technologies such as containers, Kubernetes, serverless and IaC enable more rapid development, they also bring unique security issues. The report found that misconfigurations and known unpatched vulnerabilities are by far the most common type of incidents among cloud-native environments. In fact, 45% of organizations have experienced an incident arising from a misconfiguration, followed by 38% due to known unpatched vulnerabilities.

    Other common cloud-native security incidents include secrets leaks, failed audits and malware. Interestingly, the study also found that data leaks by insiders are more common within organizations with higher degrees of cloud-native adoption. According to the report, 38% of organizations with high cloud adoption have suffered data leaks by an insider, whereas the figure is cut in half, at 17%, within organizations with low cloud adoption. Secrets like API keys must be managed carefully, especially as cloud-native tools force more dependencies. “The need for effective management of these kinds of artifacts is a key differentiator from the more centralized pre-cloud era,” the report noted.

    Automating Security Testing

    End-to-end deployment automation shows promise, yet is still at an early stage of maturity for most development teams. Though 95% of organizations use some kind of deployment automation, only about one in three organizations have an entirely automated deployment pipeline.

    Organizations with increased deployment automation tend to embrace a higher degree of security testing, as well. Highly automated pipelines are twice as likely to use security testing throughout their development lifecycle, found the report. Since incidents most commonly arise from misconfigurations and known vulnerabilities, automated scanning could help identify many cloud-native issues, comparing production code against databases of known exploits.

    So, when does this security testing occur? More often than not, it happens within the CI/CD pipeline. Over 60% of organizations perform security testing within the CI system. This is opposed to testing source code repositories or local IDEs and CLI tools early on in the development process. In terms of testing frequency, there is a wide range of executions. For those groups with high deployment automation, 70% test security daily or more frequently. Automated security testing seems to be functioning well, as 72% of fully automated teams find and fix critical vulnerabilities in under one week.

    The report also exposed an interesting disconnect with regard to security testing ownership. Only a small percentage of security engineers (less than 10%) feel developers are responsible for the security of the cloud-native environment and applications, whereas 36% of developers stated they are responsible for security. These figures may demonstrate the security onus shifting left toward the development side. Or it could underline changing attitudes as full-cycle development becomes more realistic. Regardless, teams will have to find clarity on roles to avoid some difficult conversations!

    Cloud-Native Security

    With the shift toward cloud-native strategies, security standards are rising to respond to new issues like misconfigurations. To address mounting application threats, increased automation could help shift security left—this and other reports clearly demonstrate a correlation between fully automated deployment pipelines and an increased security testing regimen.

    As a result of cloud-native adoption, 58% of organizations have increased their security concerns since adopting cloud-native tools. Part of this involves moving to a zero-trust approach across all infrastructure, whether internal or external facing. The report revealed that 58% of organizations are increasingly concerned with misconfiguration, 52% are increasingly concerned with insecure APIs and 43% are increasingly concerned about known unpatched vulnerabilities, while 41% are concerned about secrets leaks. Hopefully, these benchmarks will help you see how your organization stacks up in comparison to others.

    Snyk’s State of Cloud Native Application Security report questioned 600 experts in development, security and operations on cloud-native adoption and security practices. For more insights, view the study in its entirety here.

  • Snyk Builds Security into AWS CodePipeline to Mitigate Open Source Risk for Developer and Security Teams

    Latest integration inside the AWS CodePipeline console builds upon continued collaboration to deliver Snyk products within the AWS DevOps segment, AWS Marketplace, and AWS GovCloud 

    Boston, MA, June 8, 2021 — Snyk today announced it has built an integration inside the AWS CodePipeline console. This new integration allows AWS CodePipeline users to build automated security controls into their deployment pipeline without having to leave the Amazon Web Services (AWS) console, bringing the Snyk experience directly to AWS users, and empowering them to more efficiently find and fix vulnerabilities in open source code when building cloud native applications on AWS.

    As security becomes an increasingly crucial priority for development teams, Snyk has worked closely with AWS to automate security tooling onto AWS’s continuous delivery services, accelerating triaging and empowering agility in development when making application and infrastructure updates.

    Snyk’s integration inside the AWS CodePipeline console is the latest in a number of key integrations with AWS services, helping customers build security into applications at each level of the technology stack using an intuitive, developer-friendly security platform. Snyk allows DevOps and engineering teams to accelerate security testing by first detecting vulnerabilities in the developer IDE. Using Snyk’s feature-rich CLI, developers can also secure various elements of their workflow such as AWS CodeBuild and AWS CodeCommit. AWS users can then leverage Snyk’s integrations with Amazon Elastic Container Registry (Amazon ECR) and Amazon Elastic Kubernetes Service (Amazon EKS) to scan container images and Kubernetes clusters for vulnerabilities and misconfigurations, even mapping new vulnerabilities to any container images already deployed in a Kubernetes cluster. For serverless workloads, Snyk scans AWS Lambda functions for vulnerabilities and can gate deployments through the CI/CD stage to ensure that only secure workloads are permitted to run in production.

    This latest integration inside the AWS CodePipeline console expands upon Snyk’s ongoing collaboration with AWS to ensure that both development and security teams are able to leverage automated tooling to mitigate their open source risk as part of the development process, positively affecting the way they work and interact with one another.

    • Development teams: can easily find, prioritize and fix vulnerabilities in their open source dependencies, delivering secure code faster than their competition without having to adopt gated security audits that disrupt application deployment.
    • Security teams: can enable improvements to the development process that ensure that all applications are continuously scanned for vulnerabilities without requiring the security team to manually meet the break-neck speed of modern application development.

    “Snyk and AWS share a common goal: to facilitate a digital transformation for our customers through cloud native services that empower automation and developer engagement,” said Carey Stanton, VP of Business Development, Snyk. “Automation in deployment pipelines is key to adopting a comprehensive approach to security throughout the application development lifecycle. Snyk’s tight interoperability with AWS CodePipeline now makes it even simpler for developers to focus on building applications securely, taking advantage of developer-friendly outputs without having to manage a new set of tools.”

    “AWS wants to empower our customers to focus their time and resources on innovating their business, which is why we collaborate with security leaders like Snyk to help automate manual security tasks in development,” said Ken Exner, Director, Developer Tools, AWS. “We’re delighted to be working with Snyk to allow our customers to be more agile when delivering secure applications to market.”

    “As a hyper growth business, we need a security partner that can dynamically adapt to our needs and allow us to scale our security posture fast,” said Chaim Mazal, VP of Global Information Security, ActiveCampaign. “With Snyk’s developer first ethos and comprehensive Cloud Native Application Security platform, we’re continuously increasing visibility, mitigating risk, all while positioning our organization to achieve ambitious goals for developer productivity and innovation through our secure software development lifecycle.”

    As an AWS Partner within the AWS Partner Network (APN), Snyk has been technically validated to work seamlessly with several AWS services, and has achieved AWS DevOps Competency as well as the AWS Lambda Ready and Amazon Linux 2 Ready designations.

    Snyk has also recently announced the availability of Snyk Cloud Native Appliance (Snyk CNA), a self-hosted, dedicated instance of Snyk that can be deployed directly onto a customer’s private AWS environment, or even onto an AWS GovCloud environment, operating workloads up to Impact Level (IL) 5.

    About Snyk 

    Snyk, a cloud native application security leader, today enables 2.2 million developers to build securely, with a vision to empower every modern developer in the world to develop fast and stay secure. Only Snyk provides a platform to secure all of the critical components of today’s cloud native application development including the code, open source libraries, container infrastructure, and infrastructure as code. Snyk’s developer-first approach enables technology-driven companies to scale security in today’s fast-paced digitally transforming world. Snyk’s security platform is powered by its industry-leading proprietary vulnerability database, maintained by the expert Snyk security research team, that also powers security solutions from strategic partners such as Atlassian, Datadog, Docker, IBM Cloud, Rapid7, Red Hat, and Trend Micro. The company works with global customers of all sizes to empower developers to automatically integrate security throughout their existing workflows.

    Named to the 2020 Forbes Cloud 100, the definitive ranking of the top 100 private cloud companies in the world, Snyk was also recently recognized by Comparably as the #3 small-to-medium businesses for Happiest Employees in 2020.

    For more information and to get started with Snyk for free today, visit https://snyk.io.

  • Trend Micro Allies With Snyk to Advance DevSecOps

    Trend Micro Allies With Snyk to Advance DevSecOps

    Trend Micro and Snyk unveiled today a software-as-a-service (SaaS) platform the two companies have jointly developed to identify vulnerabilities in open source code.

    The Trend Micro Cloud One – Open Source Security by Snyk platform enables DevOps teams to both identify vulnerabilities and licensing issues to better monitor, prioritize and share information about risk and exposure rates within application development projects.

    Trend Micro COO Kevin Simzer said the SaaS platform provides a unified approach that combines six services within a single subscription to enable organizations to better protect a software supply chain.

    Snyk CTO Geva Solomonovich said that while the relationship between the two companies is not exclusive an alliance with Trend Micro will enable organizations to employ Snyk tools and the open source vulnerability database to implement a set of best DevSecOps practices within their organization.

    Simzer said Trend Micro is also including automation tools that make it easier for cybersecurity teams, along with the rest of the IT organization, to discover what application development projects are underway with their organization. The goal is to provide cybersecurity teams and DevOps teams with a set of tools that provides them with a common language through which they can collaboratively address vulnerabilities.

    Trend Micro claims approximately eight hours can be saved per vulnerability through automation and early discovery of the versions of open source code being employed. Roughly 80% of all application code in use today is derived from open source software, noted Trend Micro. That translates to saving more than 650 hours of development time per application, according to the company.

    Snyk, meanwhile, claimed to have observed a 2.5x increase in the number of open source vulnerabilities it has discovered over the past three years. In the wake of some recent high-profile breaches the security of software supply chains has become a greater area of focus, with many organizations now implementing a more rigorous review of all the code they employ and any associated dependencies.

    It’s still early days as far as adoption of DevSecOps best practices are concerned within most organizations. Responsibility for application security is clearly shifting further left toward developers. As part of that effort, cybersecurity teams are trying to adjust their processes in a way that enables them to vet the efforts of developers without slowing down the rate at which applications are developed. That’s becoming more challenging as the rate at which applications are being developed continues to increase.

    The conundrum organizations are trying to navigate is that every minute a developer spends on security is, theoretically, one less minute they have to write applications or business logic. At the same time, however, if vulnerabilities are not addressed early in the development cycle, they may take longer and cost more to fix, especially if they are discovered after an application is deployed in a production environment.

    Of course, there may come a day a when application security is just another set of steps to be performed within a quality assurance process. In the meantime, however, a lot more attention is being paid to application security today, in part, to make up for the many sins of the past.

  • Simplify Snyk and AWS integration with our latest AWS Quick Start

    Simplify Snyk and AWS integration with our latest AWS Quick Start

    One of the great benefits of using AWS is the ability to automate almost everything you do, which is not limited to just AWS’ own services, but ecosystem partners like Snyk as well. We’re happy to announce our second AWS Quick Start, to help you get Snyk working with Amazon Elastic Container Registry (ECR) and AWS Lambda with just the click of a button.

    AWS QUICK START

    Skip the manual steps and get straight to the good stuff

    Integrating Snyk with ECR and Lambda requires setting up roles that work for both the AWS service and for the Snyk service. While it’s not terribly hard to do, clicking back and forth between both interfaces and copying values from one console to another is nobody’s idea of a good time. The Snyk: Developer-first Security on the AWS Cloud Quick Start gives you three options:

    1. Full Snyk integration with both ECR and Lambda
    2. Integration with ECR only
    3. Integration with Lambda only

    Once deployed you can quickly obtain the remaining values for your ARN and AWS Region from the CloudFormation console outputs as shown below:

    Snyk Container and AWS ECR integration

    For the ECR integration, we create an IAM role that enables Snyk Container to access container images stored in ECR to scan for vulnerabilities. We create a read-only role with all the permissions outlined in our documentation and set up the necessary service integration between the Snyk service and your AWS region. From there, you can start scanning container images stored in your ECR registries and Snyk will help you select secure base images and clean up vulnerabilities in the image and code dependencies.

    Snyk Container and AWS Lambda integration

    Integrating Snyk Open Source with Lambda is similar to how the Snyk Container and ECR integration is handled. We create an appropriate read-only IAM role, following our documented configuration, and then set up the Snyk Open Source and Lambda services to talk to each other. From there, you can scan and monitor your Lambda code for vulnerable dependencies, alerting you to problems and helping you fix them so that your functions stay secure.

    Send us feedback

    To post feedback, submit feature ideas, or report bugs, use the Issues section of the GitHub repository for this Quick Start. If you’d like to submit code, please review the Quick Start Contributor’s Guide.

    You can get Snyk by signing up for a free account. For our paid tiers, both Snyk Open Source and Snyk Container are available to buy on the AWS Marketplace, as well as through private offers and custom contracts.

    AWS MARKETPLACE

    Additional resources

    Snyk resources

    AWS resources

    AWS services

  • Securing Open Source Libraries – Session with O’Reilly Author Guy Podjarny

    Securing Open Source Libraries – Session with O’Reilly Author Guy Podjarny

    Listen in to hear Guy Podjarny, Snyk founder and author of O’Reilly’s latest book on open source security, share practical guidance on testing for, managing and fixing vulnerabilities in open source code packages. Insightful for both development and application security architects and practitioners, the webinar guides you through best practices and tools for:
    • Finding vulnerabilities across your open source packages  
    • Quickly remediate new vulnerabilities and make fixing easy
    • Understanding the benefits of testing at the source level and all the way through the application development process
    [su_button url=”https://info.snyk.io/webinar-securing-open-source-libraries?utm_medium=Partner&utm_source=AWS&utm_campaign=devopsy.kinsta.cloud-AWS-Community-Hub&utm_content=O%27Reilly” target=”blank” background=”#ef2d3f”]On-Demand Webinar[/su_button]
  • Serverless Security: Protect Functions Using the CLAD Security Model

    Serverless Security: Protect Functions Using the CLAD Security Model

    This book reviews how the serverless paradigm affects the security of an application, and dives into the benefits it brings. More important, it helps you, the owner of the serverless application, understand what you should do to keep your serverless apps secure, and gives some practical tips on how to do so, reviewing:

    • Security fundamentals for system dependencies & defense from DoS Attacks
    • Code and library vulnerabilities, access and permission, and data security guidelines
    • Sample application security exercise – step by step project review

    To download the free eBook, click the link below:

    https://info.snyk.io/oreilly-serverless-security

     

     

  • Securing Open Source Libraries: Managing Vulnerabilities in Open Source Code Packages

    Securing Open Source Libraries: Managing Vulnerabilities in Open Source Code Packages

    This book will help both development and application security architects and practitioners address the risk of vulnerable open source libraries and discuss why such vulnerable dependencies are the most likely to be exploited by attackers. It will also guide you through best practices and tools for:

    • Finding vulnerabilities across your open source packages
    • Quickly remediate new vulnerabilities and make fixing easy
    • Understanding the benefits of testing at the source level as well as the built applications.

    To sign up to download the free book, click on the link below:

    https://info.snyk.io/oreilly-lp

     

     

  • Building Container Security Into Development Processes

    Building Container Security Into Development Processes

    This interactive video gives you the best insights on how to best utilize Snyk Containers and how they stay secured.

     

     

  • Snyk Open Source Security Overview

    Snyk Open Source Security Overview

    Snyk Open Source helps developers to easily find and fix vulnerabilities and license issues in open source dependencies throughout the SDLC. Watch the video to learn how you can:

    • Detect vulnerabilities and license issues as early as possible
    • Analyze easily and make data-driven security decisions
    • Fix quickly to reduce exposure with automated remediation
    • Monitor continuously to maintain your code security level

    To learn more, click the video link below: