Tools & training for more secure software
summary
A CERN codebase used since 2004 exposes a phonebook routine that lets users inject shell commands and take over a cluster serving 10,000 users; one past exploit yields interactive root shells. The group runs static analyzers (cppcheck, flawfinder, Coverity), provides Docker images and integrates scans into GitLab/Jenkins CI, offers web scans via APEG and SWAMP, trains 150 white-hats on capture-the-flag exercises, and points developers to the OWASP Top 10 and input-validation, secret protection, and CI gating as concrete fixes.
AI-written summary · about
chapters (8)
- 0:00Intro
- 0:30The problem
- 1:26The target
- 3:25Server takeover
- 7:07Tools
- 8:50Vulnerability scanners
- 9:56Training
- 12:43My plea
related talks
01h 03m“Secure Coding Best Practices: Your First Line Is The Last Line Of Defense (2 of 2)”
39mNight of the living vulnerabilities
52mDevSecOps
51mDefensive Coding Bootcamp
43mDefensive Coding Bootcamp
01h 06mHow hacking works
37mSecuring Containers by Breaking In
01h 24mCode Red: Navigating the Minefield of Security Programming Blunders