There & Back Again
summary
Academic static analysis becomes a practical defense by tracking tainted input paths — for example flagging network input copied into a buffer that later feeds exec, exposing command injection. The NSA is capable of reading endpoints so network protocols alone are insufficient. Commercializing research into a security company proves viable and exits successfully. Practical prescriptions: static analysis, rigorous code review, educate developers, be stingy about accepting input to eliminate roughly half of bugs, and minimize decisions to reduce developer mistakes.
AI-written summary · about
chapters (11)
- 0:00Start
- 10:16A BRIEF HISTORY OF
- 16:10COMPUTER SECURITY
- 23:39THE PROGRAMMER
- 24:23DEFENSIVE PROGRAMMING IS NOT
- 25:59SOFTWARE QUALITY VS. SOFTWARE SECURITY
- 27:07THE EXPLOITABILITY TRAP
- 28:36CITI IPHONE INFO LEAK
- 30:08BERTRAND RUSSELL'S CHICKEN
- 33:55STATIC ANALYSIS GOOD
- 35:46MEASURING PROCESS Building Security in Maturity Model BSIMM
related talks
01h 03m“Secure Coding Best Practices: Your First Line Is The Last Line Of Defense (2 of 2)”
33mBattle Tested Application Security
45mFinding Vulnerabilities through Static Analysis and Scripting
45mEradicating Vulnerability Classes by Shelving SAST and Embracing Secure Defaults and Invariants
58mSecurity Static Analysis - Avoiding an Angry Mob of Engineers
39mPractical Static Analysis for Continuous Application Security
49mLessons from DevSecOps Trenches
23mSecure Code, Safe Future: Mastering Security in Critical Software Development