Using the CGC’s fully automated vulnerability detection tools
summary
A survey and hands‑on evaluation of automated vulnerability tools classifies design vs code assurance tools and tests them on a simplified TLS and OpenSSL. CIDER verifies the protocol model and flags a plaintext nonce leak in the simplified TLS, AFL proves powerful but requires expert setup and doesn’t fit turnkey evaluation, MechanicalPigeon fails to install while Hashima detects numerous code clones in OpenSSL. Conclusion: many tools find real issues but integration, usability and measurable assurance remain gaps for high‑assurance certification.
AI-written summary · about
chapters (25)
- 0:00Introduction
- 2:23Presentation Outline
- 3:44Assurance
- 4:08Rise of Information Assurance
- 5:30Information Assurance Definition
- 7:22dependability
- 8:26system lifecycle
- 9:41security engineering definition
- 11:26Microsoft security development lifecycle
- 13:20CPS
- 17:14Control System Security Center
- 18:28High Assurance Fiber Military System
- 19:01Automated Tools for Security Evaluation
- 20:23Goal of Security Evaluation
- 23:43Usability
- 26:01Model checking
- 26:36Model creation
- 29:01Automated Tools
- 30:11Code Coverage
- 30:38Vendor Data Sheet
- 31:50AFL
- 32:50IOT Cube
- 33:25Security Evaluation
- 35:47Implementation
- 42:08Demonstration
related talks
12mUsable Cybersecurity Assessment Tools
47mHigh-Assurance Go Cryptography
43mSecurity Testing Tools: Can I Touch You There?
01h 03m“Secure Coding Best Practices: Your First Line Is The Last Line Of Defense (2 of 2)”
18mThe Current State of Open Source Security Compliance Tooling Is … Well, Sad.
37mSecuring Open Source Through Threat Modeling
44mAn intro to improving the security of your code with free analysis tools
38mFree security resources that your competitors use!