Software Security Engineering (Learnings from the past to fix ...)
summary
Claims that known bug classes persist for ~20 years and that it is possible to eliminate them across an organisation and reach 99.99% security resilience. Concrete actions are: comb CVE and exploit databases, map each advisory to root causes, build an attack‑vector database of parser/file/protocol weaknesses, search applications for variants, and apply targeted mitigations plus behavioral ML checks (recaptcha as a limited example). Operating system mitigations show the approach works by breaking exploit technique chains and drastically reducing successful exploitation.
AI-written summary · about
chapters (29)
- 0:00Intro
- 0:59Who am I? How my experience is relevant to this talk?
- 1:49Overview
- 3:19Top OS and OS-Native Apps Vulnerat That has be around for over one to two decades
- 4:20History of Few Common Bug Classes
- 6:07The Big Question
- 6:43The Two Most Prominent Reasons
- 7:302 Typical Response For A Bug Report of the applications and software you support
- 8:02Disadvantage of Such Mitigation Str
- 10:402 The Way "The Industry" Respond To Any Publicly Reported Security Bug
- 12:42Understanding Bug Class and Bug Na
- 14:51Translating A Bug Class To It's Corresponding Root Cause and Bug Nature
- 15:56The Way "The Industry" Must Respd To Any Publicly Reported Bugs
- 17:16Decoding The Nature of a Bug MSO
- 21:24Decoding The Nature of a Bug More Examples
- 22:34Recommendations Based on learnings from the historical bug reports
- 25:23Typical Exploit and Defense In Depth
- 29:11Targeted Exploit Mitigation
- 29:52Web-based Application Mitigation
- 31:44Introducing Behavioral Based Check
- 33:37Integrating Machine Learning
- 34:09Recommendations Based on learnings from the OS and Browser mitigation
- 34:57The Paradigm Shift in Software Security Engineering
- 35:15The Paradigm Shift and The Rise In Misconception
- 36:12Applying Common-Sense Security In Each Engineering Lifecycle
- 37:23Migrating to DevOps / DevSecOps?
- 38:00The Herd Mentality (Going with the flow without rational thinking)
- 38:15Building Security into the SDL is always explicit, not implicit
- 38:40Final Words
related talks
33m40,000 CVEs and Counting: What 60 Years of AppSec Tells Us About 2026
22mGive up! Just stop patching vulnerabilities!
32mResilient Secure Software Development Through Insights Learned from Adversarial Attack Campaigns
34mHow To Find And Prevent Entire Classes Of Security Vulnerabilities
03mAn infinite set of security tools
23mSecure Code, Safe Future: Mastering Security in Critical Software Development
27mHow to implement Security as Code?
51mVulnerabilities Without CVEs: Governing the Dark Matter of Internal and Unknown Software