(upbeat music)
>> Hello, everyone.
Welcome to theCUBE's coverage of the "AWS Startup Showcase",
season two, episode one.
I'm Lisa Martin, and I'm excited to be joined by Snyk,
next in this episode.
Liran Tal joins me, the director of developer advocacy.
Liran, welcome to the program.
>> Lisa, thank you for having me.
This is so cool.
>> Isn't it cool?
(Liran chuckles) All the things that we can do remotely.
So I had the opportunity to speak
with your CEO, Peter McKay, just about a month
or so ago at AWS re:Invent.
So much growth and momentum going on with Snyk,
it's incredible.
But I wanted to talk to you about specifically,
let's start with your role
from a developer advocate perspective,
'cause Snyk is saying modern development is changing,
so traditional AppSec gatekeeping doesn't apply anymore.
Talk to me about your role as a developer advocate.
>> It is definitely.
The landscape is changing, both developer and security,
it's just not what it was before,
and what we're seeing is developers need to be empowered.
They need some help,
just working through all of those security issues,
security incidents happening,
using open source, building cloud native applications.
So my role is basically about making them successful,
helping them any way we can.
And so getting that security awareness out,
or making sure people are having those best practices,
making sure we understand
what are the frustrations developers have,
what are the things that we can help them with,
to be successful day to day.
And how they can be a really good part
of the organization in terms of fixing security issues,
not just knowing about it,
but actually being proactively on it.
>> And one of the things also that I was reading is,
Shift Left is not a new concept.
We've been talking about it for a long time.
But Snyk's saying it was missing some things
and proactivity is one of those things that it was missing.
What else was it missing
and how does Snyk help to fix that gap?
>> So I think Shift Left is a good idea.
In general, the idea is we want to fix security issues
as soon as we can.
We want to find them.
Which I think that is a small nuance
that what's kind of missing in the industry.
And usually what we've seen with traditional security
before was, 'cause notice that,
the security department has like a silo that organizations
once they find some findings they push it over
to the development team,
the R&D leader or things like that,
but until it actually trickles down, it takes a lot of time.
And what we needed to do is basically
put those developer security tools,
which is what Snyk is building,
this whole security platform.
Is putting that at the hands and at the scale of,
and speed of modern development into developers.
So, for example, instead of just finding security issues
in your open source dependencies,
what we actually do at Snyk is not just tell you about them,
but you actually open a poll request
to your source codes version and management system.
And through that we are able to tell you,
now you can actually merge it,
you can actually review it,
you can actually have it as part
of your day-to-day workflows.
And we're doing that through so many other ways
that are really helpful
and actually remediating the problem.
So another example would be the IDE.
So we are actually embedding an extension within your IDEs.
So, once you actually type in your own codes,
that is when we actually find the vulnerabilities
that could exist within your own code,
if that's like insecure code,
and we can tell you about it as you hit Command + S
and you will save the file.
Which is totally different than what SaaS tools
starting up application security testing was before
because, when things started,
you usually had SaaS tools running in the background
and like CI jobs at the weekend and in deltas of code bases,
because they were so slow to run,
but developers really need to be at speed.
They're developing really fast.
They need to deploy.
One development is deployed to production
several times a day.
So we need to really enable developers
to find and fix those security issues as fast as we can.
>> Yeah, that speed that you mentioned is absolutely critical
to their workflow and what they're expecting.
And one of the unique things about Snyk,
you mentioned, the integration into how this works
within development workflow with IDE, CIDC,
they get environment enabling them to work at speed
and not have to be security experts.
I imagine are two important elements to the culture
of the developer environment, right?
>> Correct, yes.
It says, a large part is we don't expect developers
to be security experts.
We want to help them, we want to, again, give them the tools,
give them the knowledge.
So we do it in several ways.
For example, that IDE extension has a really cool thing
that's like kind of unique to it that I really like,
and that is, when we find, for example,
you're writing code
and maybe there's a batch traversal vulnerability
in the function that you just wrote,
what we'll actually do when we tell you about it,
it will actually tell you,
hey, look, these are some other commits
made by other open source projects
where we found the same vulnerability
and those commits actually fixed it.
So actually giving you example cases
of what potentially good code looks like.
So if you think about it,
like who knows what patch reversal is,
but prototype pollution like many types of vulnerabilities,
but at the same time,
we don't expect developers to actually know,
the deep aspects of security.
So they're left off with, having some findings,
but not really, they want to fix them,
but they don't really have the expertise to do it.
So what we're doing is we're bridging that gap
and we're being helpful.
So I think this is what really proactive security
is for developers,
that says helping them remediate it.
And I can give like more examples,
like the security database, it's like a wonderful place
where we also like provide examples and references of like,
where does their vulnerability come from
if there's like, what's fogging in open-source package?
And we highlight that with a lot of references
that provide you with things, the pull requests
that fixed date, or the issue with where this was discussed.
You have like an entire context of what is the...
What made this vulnerability happen.
So you have like a little bit more context
than just specifically, emerging some stuff and updating,
and there's a ton more.
I'm happy to like dive more into this.
>> Well, I can hear your enthusiasm for it,
a developer advocate it seems like you are.
But talking about the burdens of the gaps
that you guys are filling
it also seems like the developers and the security folks
that this is also a bridge for those teams
to work better together.
>> Correct.
I think that is not siloed anymore.
I think the idea of having security champions
or having threat modeling activities
are really, really good, or like insightful
both like developers and security,
but more than just being insightful,
useful practices that organizations should actually do
actually bringing a discussion together
to actually creating a more cohesive environment
for both of those kind of like expertise,
development and security to work together
towards some of these aspects
of like just mitigating security issues.
And one of the things that actually Snyk is doing in that,
in bringing their security into the developer mindset
is also providing them with the ability to prioritize
and understand what policies to put in place.
So a lot of the times security organizations
actually, the security org wants to do
is put just, guardrails to make sure that developers
have a good leeway to work around,
but they're not like doing things that like,
they definitely shouldn't do that,
like prior to bringing a big risk into today organizations.
And that's what I think we're doing also like great,
which is the fact that we're providing the security folks
to like put the policies in place
and then developers who actually like,
work really well within those
understand how to prioritize vulnerabilities
is an important part. And we kind of like quantify that,
we put like an urgency score that says,
hey, you should fix this vulnerability first.
Why?
Because it has, first of all,
well, you can upgrade really quickly.
It has a fix right there.
Secondly, there's like an exploit in the wild.
It means potentially an attacker can weaponize
this vulnerability and like attack your organizations,
in an automated fashion.
So you definitely want to put that put like a lead on that,
on that broken window, if so to say.
So we ended up other kind of metrics
that we can quantify and put this as like an urgency score,
which we called a priority score
that helps again, developers really know what to fix first,
because like they could get a scan
of like hundreds of vulnerabilities,
but like, what do I start first with?
So I find that like very useful for both the security
and the developers working together.
>> Right, and especially now, as we've seen such changes
in the last couple of years to the threat landscape,
the vulnerabilities, the security issues
that are impacting every industry.
The ability to empower developers to not only work
at the speed with which they are accustomed
and need to work,
but also to be able to find those vulnerabilities faster
prioritize which ones need to be fixed.
I mean, I think of Log4Shell, for example,
and when the challenge is going on with the supply chain,
that this is really a critical capability
from a developer empowerment perspective,
but also from a overall business
health and growth perspective.
>> Definitely.
I think, first of all, like if you want to step
just a step back in terms of like, what has changed.
Like what is the landscape?
So I think we're seeing several things happening.
First of all, there's this big, tremendous...
I would call it a trend, but now it's like the default.
Like of the growth of open source software.
So first of all as developers are using
more and more open source
and that's like a growing trend of have like drafts of this.
And it's like always increasing across, by the way,
every ecosystem go, rust, .net, Java, JavaScript,
whatever you're building,
that's probably like on a growing trend, more open source.
And that is, we will talk about it in a second
what are the risks there.
But that is one trend that we're saying.
The other one is cloud native applications,
which is also worth to like,
I think dive deep into it in terms of
the way that we're building applications today
has completely shifted.
And I think what AWS is doing in that sense
is also creating a tremendous shift
in the mindset of things.
For example, out of the cloud infrastructure
has basically democratized infrastructure.
I do not need to, own my servers and own my monitoring
and configure everything out.
I can actually write codes that when I deploy it,
when something parses this and runs this,
it actually creates servers and monitoring, logging,
different kinds of things for me.
So it democratize the whole sense of building applications
from what it was decades ago.
And this whole thing is important and really, really fast.
It makes things scalable.
It also introduces some rates.
For example, some of these configuration.
So there's a lot that has been changed.
And in that landscape of like what modern developer is
and I think in that sense, we kind of can need a lead
to a little bit more, be helpful to developers
and help them like avoid all those cases.
And I'm like happy to dive into like the open source
and the cloud native.
That was like follow-ups on this one.
>> I want to get into a little bit more
about your relationship with AWS.
When I spoke with Peter McKay for re:Invent,
he talked about the partnership being a couple of years old,
but there's some kind of really interesting things
that AWS is doing in terms of leveraging, Snyk.
Talk to me about that.
>> Indeed.
So Snyky integrates with almost,
I think probably a lot of services,
but probably almost all of those
that are unique and related to developers
building on top of the AWS platform.
And for example, that would be,
if you actually are building your code,
it connects like the source code editor.
If you are pushing that code over,
it integrates with code commits.
As you build and CIS are running,
maybe code build is something you're using
that's in code pipeline.
That is something that you have like native integrations.
At the end of the day,
like you have your container registry or Lambda.
If you're using like functions as a service
for your obligations,
what we're doing is integrating with all of that.
So at the end of the day, you really have all of that...
It depends where you're integrating,
but on all of those points of integration,
you have like Snyk there to help you out
and like make sure that if we find on any of those,
any potential issues,
anything from like licenses
to vulnerabilities in your containers or just your code
or your open source code in those,
they actually find it at that point and mitigate the issue.
So this kind of like if you're using Snyk,
when you're a development machine,
it kind of like accompanies you through this journey
all over what a CIC kind of like landscape looks like
as an architectural landscape for development,
kind of like all the way there.
And I think what you kind of might be
I think more interested,
I think to like put your on and an emphasis
would be this recent integration with the Amazon Inspector.
Which is as it's like very pivotal parts on the AWS platform
to provide a lot of, integrate a lot of services
and provide you with those insights on security.
And I think the idea that now that is able
to leverage vulnerability data
from the Snyk's security intelligence database
that says that's tremendous.
And we can talk about that.
We'd look for shell and recent issues.
>> Yeah. Let's dig into that.
We've have a few minutes left,
but that was obviously a huge issue in November of 2021,
when obviously we're in a very dynamic
global situation period,
but it's now not a matter of if an organization
is going to be hit by vulnerabilities and security threats.
It's a matter of when.
Talk to me about really how impactful Snyk was
in the Log4Shell vulnerability and how you help customers
evade probably some serious threats,
and that could have really impacted revenue growth,
customer satisfaction, brand reputation.
>> Definitely.
The Log4Shell is,
well, I mean was a vulnerability that was disclosed,
but it's probably still a major part
and going to be probably for the foreseeable future.
An issue for organizations
as they would need to deal with us.
And we'll dive in a second and figure out like why,
but in like a summary here,
Log4Shell was the vulnerability
that actually was found in Java library called Log4J.
A logging library that is so popular today and used.
And the thing is having the ability to react fast
to those new vulnerabilities being disclosed
is really a vital part of the organizations,
because when it is asking factful,
as we've seen Log4Shell being
that is when, it determines where the security tool
you're using is actually helping you,
or is like just an added thing on like a checkbox to do.
And that is what I think made Snyk's so unique in the sense.
We have a team of those folks that are really boats,
manually curating the ecosystem of CVEs
and like finding by ourselves,
but also there's like an entire,
kind of like an intelligence platform beyond us.
So we get a lot of notifications on chatter that happens.
And so when someone opens an issue
on an open source repository says,
Hey, I found an issue here.
Maybe that's an XSS or code injection
or something like that.
We find it really fast.
And we at that point, before it goes to CVE requirement
and stuff like that through like a miter and NVD,
we find it really fast and can add it to the database.
So this has been something that we've done
with Log4Shell, where we found that as it was disclosed,
not on the open source, but just on the open source system,
but it was generally disclosed to everyone at that point.
But not only that, because look for J as the library
had several iterations of fixes they needed.
So they fixed one version.
Then that was the recommendation to upgrade to
then that was actually found as vulnerable.
So they needed to fix the another time and then another time
and so on.
So being able to react fast,
which is, what I think helped a ton of customers
and users of Snyk is that aspect.
And what I really liked in the way
that this has been received very well
is we were very fast on creating those command line tools
that allow developers to actually find cases
of the Log4J library, embedded into (indistinct)
but not true a package manifest.
So sometimes you have those like legacy applications,
deployed somewhere, probably not even legacy,
just like the Log4J libraries,
like bundled into a net or Java source code base.
So you may not even know that you're using it in a sense.
And so what we've done is we've like exposed
with Snyk CLI tool and a command line argument
that allows you to search for all of those cases.
Like we can find them and help you,
try and mitigate those issues.
So that has been amazing.
>> So you've talked in great length, Liran about,
and detail about how Snyk is really enabling
and empowering developers.
One last question for you is when I spoke with Peter
last month at re:Invent,
he talked about the goal of reaching 28 million developers.
Your passion as a director
of developer advocacy is palpable.
I can feel it through the screen here.
Talk to me about where you guys are on that journey
of reaching those 28 million developers
and what personally excites you
about what you're doing here.
>> Oh, yeah.
So many things. (laughs)
Don't know where to start.
We are constantly talking to developers
on community days and things like that.
So it's a couple of examples.
We have like this dev site community,
which is a growing and kicking community of developers
and security people coming together
and trying to work and understand,
and like, just learn from each other.
We have those events coming up.
We actually have this, "The Big Fix".
It's a big security event that we're launching
on February 25th.
And the idea is, want to help the ecosystem
secure security obligations,
open source or even if it's closed source.
We like help you fix that
though that yeah, it's like helping them.
We've launched this Snyk ambassadors program,
which is developers and security people,
CSOs are even in there.
And the idea is how can we help them
also be helpful to the community?
Because they are like known,
they are passionate as we are, on application security
and like helping developers code securely, build securely.
So we launching all of those programs.
We have like social impact related programs
and the way that we like work with organizations,
like maybe non-profit
maybe they just need help, like getting,
the security part of things kind of like figured out,
students and things like that.
Like, there's like a ton of those initiatives
all over the boards, helping basically the world
be a little bit more secure.
>> Well, we could absolutely use Snyk's help
in making the world more secure.
Liran it's been great talking to you.
Like I said, your passion for what you do
and what Snyk is able to facilitate and enable is palpable.
And it was a great conversation.
I appreciate that.
And we look forward to hearing
what transpires during 2022 for Snyk
so you got to come back.
>> I will. Thank you.
Thank you, Lisa. This has been fun.
>> All right. Excellent.
Liran Tal, I'm Lisa Martin.
You're watching theCUBE's second season,
season two of the "AWS Startup Showcase".
This has been episode one.
Stay tuned for more great episodes,
full of fantastic content.
We'll see you soon.
(upbeat music)