DevSecOps: Fuzzing Source Code
summary
Fuzzing has become essential for finding vulnerabilities; presenters explain preparing C/C++ products for continuous fuzzing like Google’s fuzzing infrastructure, including developer-side changes and DevOps pitfalls. They cover practical steps and integration challenges for turning one-off audits into ongoing fuzzing to reduce bugs during development.
AI-written summary · about
chapters (13)
- 0:00Introduction
- 3:25What is fuzzing and why it matters
- 8:26Fuzzer classification
- 13:37Code analyzers and fuzzing
- 17:32Continuous fuzzing tools
- 21:09Attack surface analysis
- 23:35Preparing for fuzzing and seed creation
- 26:41Writing a fuzzer example
- 29:15Integrating fuzzing into project
- 32:45Continuous fuzzing at Google and Microsoft
- 37:23Building a fuzzing farm
- 38:27When to build fuzzers
- 40:52Fuzzing future and conclusions
related talks
23mContinuous Fuzzing Best Practices
31m“Fuzz or lose..."
47mFuzzing Your Code
39mMaking Fuzzing Part of Your Software Development Lifecycle
29mSecuring C code that seems to work just fine
39mFuzzing Session: Finding Bugs and Vulnerabilities Automatically
51mSecDevOps: Current Research and Best Practices
01h 15mMake your programs more reliable with Fuzzing