CommSec D2 - ProdSec: A Technical Approach
summary
Nvidia shifts product security from reactive bug triage to measurable engineering: build a centralized fuzzing lab that runs AFL and unit-test-derived fuzzers every build, enable sanitizers to surface dozens of memory flaws early, deploy IDE linting and GCC poison to block dangerous calls, and run binary diffing to verify builds match source. Add repo hooks, telemetry and subscriptions for repeated bad patterns, plus auto-isolation and API hardening to reduce blast radius.
AI-written summary · about
chapters (11)
- 0:00Introduction and speaker background
- 1:18Product security fundamentals explained
- 3:47Team structures and security roles
- 5:32Cultural approaches to security
- 7:57Internal vs external security research
- 10:30Security for startups and leadership
- 11:53Working with developer teams
- 15:45Automation and tooling in security
- 24:29Product DNA and dependencies
- 26:35Dynamic analysis techniques
- 29:01Closing remarks and Q&A
related talks
51mSecDevOps: Current Research and Best Practices
29mSecuring C code that seems to work just fine
57mBuilding a Modern Security Engineering Organization
52mBuilding Community-Driven Security Analysis for Your .NET Software Supply Chain
49mPanel: From Code to Defense: Why Developers Are the New Security Leaders
42mDevSecOps: Fuzzing Source Code
49mLessons from DevSecOps Trenches
31mTopics of Interest: Scaling AppSec through Education