SaaS CMS has officially launched! Learn more now.

Daniel Ovaska
Jun 27, 2024
  256
(1 votes)

Keeping the website secure by updating external packages

Did you see the latest warning from Optimizely to update this package with a critical security warning?

https://world.optimizely.com/documentation/Release-Notes/ReleaseNote/?releaseNoteId=CMS-33553

No? 

Security vulnerabilities in third party components like nuget packages or npm modules are one of the top 10 vulnerabilities for website according to OWASP

What makes it even more serious is that hackers can often scan the website for these vulnerabilities and often use them to compromise the website. 

Fortunately the tools to keep the website up to date already exist but often the process is lacking and must be agreed upon with stakeholders to secure funding for it. Stakeholders and product owners are often focused on new features and it's easy to fall behind on non-functional requirements like performance and security if these are not part of the development process. One way is to set a fixed value like 25% of development time to allocate to these areas and let developments team and tech lead suggest best bang-for-the-buck in these areas.

For an ordinary Optimizely website I recommend the more structured approach to securing third party packages and integrate it into your development process:

  1. Update all Optimizely code packages to latest minor version at least every 6 months.
  2. Use Visual Studio 2022 nuget package manager to locate any other vulnerable dotnet packages.
    There is even a nice little checkbox to show all vulnerable packages.
  3. Use npm audit to get a list of vulnerable frontend packages. 
  4. Update all moderate or higher at least

For a more security concerned websites I recommend the more ambitious process:

  1. Update all Optimizely code packages to latest minor version at the start of every sprint or every month.
  2. Use Visual Studio 2022 nuget package manager to locate any other vulnerable dotnet packages.
    There is even a nice little checkbox to show all vulnerable packages 
  3. Use npm audit to get a list of vulnerable frontend packages. 
  4. Update all vulnerable packages
  5. Use Azure Advanced Security or similar code scanner in build pipeline
    Set it up as a separate pipeline and run it manually before every deploy. 
    For really large solutions it might require build agents with more than normal disk space I've noticed.

For more security related tips for Optimizely see my security checklist

Happy coding and stay safe!

Jun 27, 2024

Comments

Mark Stott
Mark Stott Jul 9, 2024 08:58 AM

Hello Daniel,

First off, great article with some great tips.

If you are thinking about your website security and want to be able to manage your Content Security Policy, Cross Origin Resource Sharing policy and other response headers, you can always install my AddOn for Optimizely CMS 12 PAAS Core:

https://github.com/GeekInTheNorth/Stott.Security.Optimizely

Regards,
Mark

Please login to comment.
Latest blogs
Optimizely Graph – Faceting with Geta Categories

Overview As Optimizely Graph (and Content Cloud SaaS) makes its global debut, it is known that there are going to be some bugs and quirks. One of t...

Eric Markson | Jul 22, 2024 | Syndicated blog

Integration Bynder (DAM) with Optimizely

Bynder is a comprehensive digital asset management (DAM) platform that enables businesses to efficiently manage, store, organize, and share their...

Sanjay Kumar | Jul 22, 2024

Frontend Hosting for SaaS CMS Solutions

Introduction Now that CMS SaaS Core has gone into general availability, it is a good time to start discussing where to host the head. SaaS Core is...

Minesh Shah (Netcel) | Jul 20, 2024

Optimizely London Dev Meetup 11th July 2024

On 11th July 2024 in London Niteco and Netcel along with Optimizely ran the London Developer meetup. There was an great agenda of talks that we put...

Scott Reed | Jul 19, 2024