{"id":3492,"date":"2022-01-18T00:23:10","date_gmt":"2022-01-18T00:23:10","guid":{"rendered":"https:\/\/mailinvest.blog\/index.php\/2022\/01\/18\/how-snyks-approach-to-application-security-remedies-shift-left-shortcomings\/"},"modified":"2022-01-18T00:23:10","modified_gmt":"2022-01-18T00:23:10","slug":"how-snyks-approach-to-application-security-remedies-shift-left-shortcomings","status":"publish","type":"post","link":"https:\/\/mailinvest.blog\/index.php\/2022\/01\/18\/how-snyks-approach-to-application-security-remedies-shift-left-shortcomings\/","title":{"rendered":"How Snyk’s approach to application security remedies shift-left shortcomings"},"content":{"rendered":"

<\/a>\n
<\/p>\n

\n

Software developers rarely have it easy. From writing, editing and pushing code to fixing the bugs and security issues that show up through production, the expectations most organizations have of their dev teams are immense.<\/p>\n

The \u201cshift-left\u201d approach was conceived to root out security problems at the earliest stage of development, but in some ways, it\u2019s added to the degree of complexities facing developers.<\/p>\n

\u201cThe landscape is changing, both developer and security;<\/span>\u00a0it\u2019s just not what it was before,\u201d said\u00a0Liran Tal<\/a> (pictured), director of developer advocacy at Synk Ltd., a<\/span>\u00a0developer focused all-in-one\u00a0platform for securing code, dependencies, containers and infrastructure as code.\u00a0\u201cAnd what we\u2019re seeing is developers need to be empowered.<\/span>\u00a0They need some help,<\/span>\u00a0just working through all of those security issues,<\/span>\u00a0security incidents happening,<\/span>\u00a0using open-source, building cloud-native applications.\u201d<\/span><\/p>\n

The modern development arena is changing, and so a few mainstay practices don\u2019t quite apply as seamlessly as they used to. Proactivity is an element that\u2019s missing in the traditional shift-left process and is desperately needed in today\u2019s landscape, according to Tal.<\/p>\n

Tal spoke with Lisa Martin, host of theCUBE, SiliconANGLE Media\u2019s livestreaming studio, in advance of the upcoming\u00a0<\/span>AWS Startup Showcase: Open Cloud Innovations<\/span><\/a> event. They discussed the modern app security threat landscape and how devs can conveniently stay in front of any threats. <\/span>(* Disclosure below.)<\/span><\/i><\/p>\n

Easing developer frustration<\/h3>\n

Snyk\u2019s developer security platform funnels directly into\u00a0development tools, workflows and automation pipelines,\u00a0making it easy to spot vulnerabilities and security threats ahead of time, according to Tal, whose job is squarely focused on helping developers take full advantage of the platform\u2019s wealth of security and DevOps features.<\/p>\n

\u201cWhat we needed to do is basically<\/span>\u00a0put those developer security tools<\/span>,<\/span>\u00a0which is what Snyk is building, this whole security platform\u201d into the developers\u2019 hands at the scale and speed required, Tal added. \u201cSo, for example, i<\/span>nstead\u00a0of just finding security issues<\/span>\u00a0in open-source dependencies \u2026 you<\/span>\u00a0can\u00a0actually open a pull request<\/span>\u00a0to your source codes version and management systems,\u201d Tal explained.<\/span><\/p>\n

Another part of Snyk\u2019s rapid response approach to detecting code vulnerabilities is embedding extensions within integrated development environments. In doing so, security issues and probable points of failure are detected the moment work is saved. This represents a sharp contrast to other application security testing tools that run in the background and give summarized reports after a set time duration. Snyk\u2019s approach is especially more valuable given the fact that developers today work with faster timelines than ever before and need to deploy quickly and constantly.<\/p>\n

In the end, the platform makes it such that developers don\u2019t have to be security experts. By showing them the detected vulnerabilities and providing the tools and knowledge to fix those issues, Snyk is actively making devs more efficient, Tal pointed out.<\/p>\n

In other aspects of bridging the security knowledge gap for developers, there are also knowledge resources made available to safeguard setups like complex databases from known vulnerabilities.<\/p>\n

\u201cAs a\u00a0 highlight, there\u2019s a myriad of references<\/span>\u00a0that provide users with things like the pull requests,<\/span>\u00a0fix dates, or the issue with where the vulnerability was discussed.<\/span>\u00a0Having all this information at hand allows for better context as to\u00a0<\/span>what made the vulnerability happen,\u201d Tal stated.<\/span><\/p>\n

Bringing developers and security experts into a team<\/h3>\n

The software development and security functions of an organization aren\u2019t rendered completely separate from each other anymore. Consequently, organizations must work toward \u201ccreating a more cohesive environment for both these kinds of expertise to synergize towards mitigating security issues,\u201d\u00a0according to Tal.<\/p>\n

Snyk has partnered with Amazon Web Services Inc. for years now. Thus, there is a wide range of integrations within the platform, from the source code editor to code commits and container registries.<\/p>\n

\u201cSo at the end of the day, <\/span>Snyk is there to help users out<\/span>\u00a0and make sure that if we find any <\/span>potential issues,<\/span>\u00a0anything from licenses<\/span>\u00a0to container vulnerabilities or just <\/span>open-source code, it\u2019s mitigated at the source,\u201d Tal explained.<\/span><\/p>\n

The recent Log4Shell vulnerability was found in the Java library called Log4J<\/a>. Using its ecosystem of teams manually finding these recorded events and an autonomous intelligence platform, Snyk is made aware of such vulnerabilities through notifications on the Chatter\u00a0API.<\/p>\n

\u201cAnd at that point, before it goes to CVE requirement<\/span>\u00a0and things like that \u2026<\/span>\u00a0we find vulnerabilities really fast and can add them to the database.<\/span>\u00a0In summary, this was what we did<\/span>\u00a0with Log4Shell,\u201d Tal stated.<\/span><\/p>\n

As part of Snyk\u2019s recent commitment to further reach and improve the experiences of 28 million devs worldwide<\/a>, the company has leaned heavily into the power of community and shared experiences. One example is its developer website, which is a community of security and coding professionals trying to learn from each other. Another is the company\u2019s new slew of developer events, one of which is titled \u201cThe Big Fix\u201d and slated to launch February 25.<\/p>\n

Watch the complete video interview below, and be sure to check out more of SiliconANGLE\u2019s and theCUBE\u2019s coverage of the <\/span>AWS Startup Showcase: Open Cloud Innovations<\/span><\/a> event.<\/span> (* Disclosure: Snyk Ltd. sponsored this segment of theCUBE. Neither Snyk nor other sponsors have editorial control over content on theCUBE or SiliconANGLE.)<\/span><\/i><\/p>\n