Securing Software by Construction
summary
Research builds a Jeeves prototype implementing policy-agnostic programming with faceted values and formal semantics that prevent direct and indirect leaks; initial Scala web app for a student conference runs out of memory under load, forcing work on DB integration and optimizations. A reworked framework associates policies with schema, proxies policies between app and SQL, and enforces viewer-specific views (field-level or row-level) at query time; the academic timeline spans 2008–2016 with papers from 2012 and a multi-year engineering path, plus an 8–10 week accelerator that funded teams with $20k notes.
AI-written summary · about
chapters (6)
- 0:00Introduction and motivation
- 13:24Academic research on security
- 26:33Barriers to industry adoption
- 31:05Cybersecurity accelerator insights
- 38:05Incentives for security investment
- 43:40Q&A session
related talks
35mSecuring software while maintaining usability
51mPreventing Security Bugs through Software Design
50mUsing language-theoretics and runtime visibility to align AppSec with DevOps
44mSecuring the JVM
55mHigh performance Privacy By Design using Matryoshka & Spark
38mBuilding Secure Systems in Haskell
53mSecuring LLM-Powered Applications: Overcoming Security and Privacy Challenges
49mPragmatic Approaches To Building Secure Software