A New View of Your Application Security Program with Snyk and ThreadFix

© 2019 Denim Group – All Rights Reserved
A New View of Your Application
Security Program with Snyk and
ThreadFix
November 12, 2019
Dan Cornell, CTO, Denim Group
Hayley Denbraver, Developer Advocate, Snyk

Agenda
2

Agenda
• Snyk Background and Demo
• ThreadFix Background
• Snyk and ThreadFix
3

Snyk
4

Production Code
5

Production Code
6
Original Code

Production Code
7

Production Code
8

Snyk: Use Open Source, Stay Secure
• Snyk helps you find and fix vulnerabilities
in your open source dependencies
• Snyk allows developers to address open
source security throughout the software
development lifecycle
• Snyk meets developers where they are—in
the languages and tools that they use
every day
9

Snyk
11

Snyk
12

Snyk
13

Snyk Demo
15

Vulnerable App
16

Snyk UI
17

Snyk UI
18

Snyk UI
19

Snyk UI
20

Snyk UI
21

Snyk UI
22

Snyk UI
23

GitHub
24

ThreadFix Background
25

ThreadFix Overview
• Create a consolidated view of your applications and
vulnerabilities
• Prioritize application risk decisions based on data
• Translate vulnerabilities to developers in the tools
they are already using
• Provide access to powerful analytics
26

ThreadFix Overview
27

Create a consolidated view of
your applications and
vulnerabilities 
28

Application Portfolio Tracking
29

Vulnerability Consolidation
30

Prioritize application risk
decisions based on data 
31

Vulnerability Prioritization
32

Reporting and Metrics
33

Translate vulnerabilities to
developers in the tools they
are already using 
34

Defect Tracker Integration
35

Secure DevOps with ThreadFix
• What does your
pipeline look like?
http://www.slideshare.net/mtesauro/mtesauro-keynote-appseceu
http://www.slideshare.net/denimgroup/rsa2015-blending-
theautomatedandthemanualmakingapplicationvulnerabilitymanagementyourally
https://blog.samsungsami.io/development/security/2015/06/16/getting-security-up-to-speed.html
36

AppSec Testing for DevOps
• Configuring Testing Policies
• AppSec Testing for DevOps in Action
37

Policy Configuration
• Testing
• Synchronous
• Asynchronous
• Decision
• Reporting
Blog Post: Effective Application
Security Testing in DevOps Pipelines
http://www.denimgroup.com/blog/2016/12/effective-application-security-testing-in-devops-pipelines/
https://www.denimgroup.com/resources/effective-application-security-for-devops/
38

Testing Configuration
39

Testing in Action
40

Testing in Action
41

Testing in Action
42

Snyk and ThreadFix Together
43

Snyk and ThreadFix Integration
• Documentation: https://pypi.org/project/snyk-threadfix/
44

@denimgroup
www.threadfix.it
www.denimgroup.com
@snyksec
www.snyk.io
45

A New View of Your Application Security Program with Snyk and ThreadFix

More Related Content

What's hot

Similar to A New View of Your Application Security Program with Snyk and ThreadFix

More from Denim Group

Recently uploaded

A New View of Your Application Security Program with Snyk and ThreadFix