Securing Software’s Future
Talkat AppSec California 2015 · on Wednesday, 2015-01-28· at 15:00· Annenberg Community Beach House: Track 3, 415 Pacific Coast Hwy·
summary
Claims that changing APIs reduces whole classes of bugs with little developer training, supported by examples: LDAP filter injection persists because ColdFusion ships no escape helper and its sample code is exploitable while PHP exposes ldap_escape but documents neither uses nor risks; managed platforms eliminated buffer overflows and ORMs plus auto-encode templates largely removed new SQL injection cases. Proposes adding parameterized/template APIs that make the secure choice the path of least resistance and measuring effectiveness with controlled developer trials.
AI-written summary · about
chapters (27)
- 0:00Introduction
- 0:24Is software security getting better
- 2:12We have a big pile of code
- 3:10We know we have a lot of bugs
- 3:30We try to educate them
- 4:09We really need to do better
- 5:43What else do we do
- 6:37Training
- 7:45Developers release vulnerabilities faster
- 8:41Importance of contesting
- 9:56Build better platforms
- 11:33Language lawyers
- 12:28Counterexamples
- 12:52LDAP Filter Injection
- 14:42Cold Fusion
- 14:54Encoding
- 15:28Adobe API
- 16:25ColdFusion
- 17:37Example Code
- 19:31Sequel Injection
- 22:27PHP Abstract API
- 23:27Apache Foundation
- 25:48API Security
- 29:56How do we convince vendors
- 32:16Standardization
- 35:49Conclusion
- 36:24Questions
related talks
51mPreventing Security Bugs through Software Design
55mCodified Security
47mAdvances in Secure Coding Frameworks
31mAchieving Secure Software through Redesign
23mSecure Code, Safe Future: Mastering Security in Critical Software Development
48mEnding Injection Vulnerabilities
43mAPI Security By Design
41mSecurity Vulnerabilities Decomposition: Another Way To Look At Vulnerabilities