Snyk Code Security Metric Collection

Snyk Code Security Metrics

Snyk Code Security SAST Vulnerability Metrics Dashboard SLA CI/CD Dependencies Container IaC Developer Security

Metric Collection

# === Snyk API Metric Collection ===

# pip install requests prometheus_client

# import requests
# import json
# from datetime import datetime
#
# SNYK_TOKEN = "your-snyk-api-token"
# SNYK_ORG = "your-org-id"
# HEADERS = {"Authorization": f"token {SNYK_TOKEN}"}
#
# # Get all projects
# projects = requests.get(
#     f"https://api.snyk.io/rest/orgs/{SNYK_ORG}/projects?version=2024-06-21",
#     headers=HEADERS
# ).json()
#
# # Get issues for a project
# for project in projects["data"]:
#     issues = requests.get(
#         f"https://api.snyk.io/rest/orgs/{SNYK_ORG}/issues"
#         f"?project_id={project['id']}&version=2024-06-21",
#         headers=HEADERS
#     ).json()
#
# # CLI scan with JSON output
# # snyk test --json > results.json
# # snyk code test --json > code-results.json
# # snyk container test node:18 --json > container-results.json

from dataclasses import dataclass

@dataclass
class SecurityMetric:
    metric: str
    source: str
    calculation: str
    target: str
    frequency: str

metrics = [
    SecurityMetric("Total Vulnerability Count",
        "Snyk API /orgs/{org}/issues",
        "COUNT(*) GROUP BY severity",
        "Critical: 0, High: < 10",
        "ทุกวัน"),
    SecurityMetric("Mean Time to Fix (MTTF)",
        "Snyk API issue created_at → resolved_at",
        "AVG(resolved_at - created_at) per severity",
        "Critical: < 24hr, High: < 7d",
        "ทุกสัปดาห์"),
    SecurityMetric("Fix Rate",
        "Snyk API fixed / total issues",
        "COUNT(status=fixed) / COUNT(*) * 100",
        "> 80% overall",
        "ทุกเดือน"),
    SecurityMetric("New vs Fixed Trend",
        "Snyk API issues per week",
        "COUNT(new) vs COUNT(fixed) per week",
        "Fixed > New (decreasing trend)",
        "ทุกสัปดาห์"),
    SecurityMetric("SLA Compliance Rate",
        "Custom calculation from Snyk data",
        "COUNT(fixed_within_SLA) / COUNT(*) * 100",
        "> 90%",
        "ทุกเดือน"),
    SecurityMetric("Dependency Risk Score",
        "Snyk Open Source scan",
        "Weighted score: Critical×10 + High×5 + Medium×2 + Low×1",
        "< 50 per project",
        "ทุก PR + Weekly"),
]

print("=== Security Metrics ===")
for m in metrics:
    print(f"  [{m.metric}] Source: {m.source}")
    print(f"    Calc: {m.calculation}")
    print(f"    Target: {m.target}")
    print(f"    Frequency: {m.frequency}")

CI/CD Integration

# === Snyk CI/CD Pipeline ===

# GitHub Actions
# name: Security Scan
# on: [pull_request]
# jobs:
#   snyk:
#     runs-on: ubuntu-latest
#     steps:
#       - uses: actions/checkout@v4
#       - uses: snyk/actions/setup@master
#       - name: Snyk Code Test
#         run: snyk code test --severity-threshold=high --sarif-file-output=snyk-code.sarif
#         env:
#           SNYK_TOKEN: }
#       - name: Snyk Open Source
#         run: snyk test --severity-threshold=high --json-file-output=snyk-oss.json
#       - name: Upload SARIF
#         uses: github/codeql-action/upload-sarif@v2
#         with:
#           sarif_file: snyk-code.sarif

@dataclass
class CIPipeline:
    stage: str
    command: str
    gate: str
    output: str

pipeline = [
    CIPipeline("Code Scan (SAST)",
        "snyk code test --severity-threshold=high",
        "Block PR if Critical/High found",
        "SARIF → GitHub Security Tab"),
    CIPipeline("Dependency Scan (SCA)",
        "snyk test --severity-threshold=high",
        "Block PR if Critical CVE with fix available",
        "JSON → Metrics Dashboard"),
    CIPipeline("Container Scan",
        "snyk container test image:tag",
        "Block deploy if Critical in base image",
        "JSON → Container Registry"),
    CIPipeline("IaC Scan",
        "snyk iac test --severity-threshold=high",
        "Block deploy if High misconfig",
        "SARIF → GitHub Security Tab"),
    CIPipeline("Monitor (Post-deploy)",
        "snyk monitor",
        "Continuous monitoring for new CVEs",
        "Webhook → Slack + Jira"),
]

print("=== CI/CD Pipeline ===")
for p in pipeline:
    print(f"  [{p.stage}] {p.command}")
    print(f"    Gate: {p.gate}")
    print(f"    Output: {p.output}")

Dashboard & Alerting

# === Security Dashboard ===

@dataclass
class DashPanel:
    panel: str
    visualization: str
    data: str
    alert: str

panels = [
    DashPanel("Vulnerability Overview",
        "Stat Panels: Critical/High/Medium/Low counts",
        "Snyk API → Prometheus gauge",
        "Critical > 0 → Immediate Alert"),
    DashPanel("MTTF Trend",
        "Line Chart: MTTF per severity over time",
        "Snyk API → calculated per week",
        "MTTF Critical > 48hr → Warning"),
    DashPanel("New vs Fixed",
        "Stacked Bar: new (red) vs fixed (green) per week",
        "Snyk API → weekly aggregation",
        "New > Fixed for 3 weeks → Warning"),
    DashPanel("SLA Compliance",
        "Gauge: % within SLA per severity",
        "Custom calculation from Snyk data",
        "< 85% → Warning, < 70% → Critical"),
    DashPanel("Top 10 Vulnerabilities",
        "Table: vuln type, count, severity, affected projects",
        "Snyk API → aggregated by CWE",
        "N/A (informational)"),
    DashPanel("Project Risk Heatmap",
        "Heatmap: projects × severity → color = count",
        "Snyk API → per project aggregation",
        "Any project all-red → Priority review"),
]

print("=== Dashboard Panels ===")
for p in panels:
    print(f"  [{p.panel}] Viz: {p.visualization}")
    print(f"    Data: {p.data}")
    print(f"    Alert: {p.alert}")

เคล็ดลับ

• Shift-left: สแกนใน IDE + PR ก่อน Merge พบเร็ว แก้ถูก
• SLA: ตั้ง SLA ตาม Severity วัด Compliance ทุกเดือน
• Gate: Block PR เมื่อพบ Critical พร้อม Fix Available
• Trend: ดู New vs Fixed Trend ต้อง Fixed > New เสมอ
• SARIF: ใช้ SARIF Output สำหรับ GitHub Security Tab

Best Practices สำหรับนักพัฒนา

การเขียนโค้ดที่ดีไม่ใช่แค่ทำให้โปรแกรมทำงานได้ แต่ต้องเขียนให้อ่านง่าย ดูแลรักษาง่าย และ Scale ได้ หลัก SOLID Principles เป็นพื้นฐานสำคัญที่นักพัฒนาทุกู้คืนควรเข้าใจ ได้แก่ Single Responsibility ที่แต่ละ Class ทำหน้าที่เดียว Open-Closed ที่เปิดให้ขยายแต่ปิดการแก้ไข Liskov Substitution ที่ Subclass ต้องใช้แทน Parent ได้ Interface Segregation ที่แยก Interface ให้เล็ก และ Dependency Inversion ที่พึ่งพา Abstraction ไม่ใช่ Implementation

เรื่อง Testing ก็ขาดไม่ได้ ควรเขียน Unit Test ครอบคลุมอย่างน้อย 80% ของ Code Base ใช้ Integration Test ทดสอบการทำงานร่วมกันของ Module ต่างๆ และ E2E Test สำหรับ Critical User Flow เครื่องมือยอดนิยมเช่น Jest, Pytest, JUnit ช่วยให้การเขียน Test เป็นเรื่องง่าย

เรื่อง Version Control ด้วย Git ใช้ Branch Strategy ที่เหมาะกับทีม เช่น Git Flow สำหรับโปรเจคใหญ่ หรือ Trunk-Based Development สำหรับทีมที่ Deploy บ่อย ทำ Code Review ทุก Pull Request และใช้ CI/CD Pipeline ทำ Automated Testing และ Deployment

สรุป

Snyk Code Security Metric Collection SAST SCA Container IaC MTTF Fix Rate SLA CI/CD SARIF Dashboard Grafana Prometheus Production