Writing safe and secure code

•

4 likes•879 views

The document discusses the importance of writing safe and secure code. It emphasizes getting code reviewed, thoroughly testing code, running static analyses and fuzzing tools to torment the code, and acting immediately to fix issues. It highlights the practices of the curl project, which builds and tests code on many platforms and spends 20-25 hours testing with each commit. The author argues that following these guidelines is important and prevents bad things from happening, even if it is time consuming.

Technology

Writing safe and secure codeWriting safe and secure code
FOSS-North 2019FOSS-North 2019

… in six billion installations
across the world
My code exists

…… inside devices all of youinside devices all of you
here today own and use!here today own and use!
My code exists

Safe code is not a coincidence
Doesn’t happen randomly, you need to work on it!
You need to care about it!
It is about time we all address this topic!
Everything I’ll tell you today, you already know!

Writing
Help users use your app or APIHelp users use your app or API
Defaults!Defaults!
Document. Everything and a lot.Document. Everything and a lot.
Get rid of warningsGet rid of warnings
UseUse commentscomments
assert()assert()
Release code asRelease code as open sourceopen source

Review
All codeAll code shallshall get reviewedget reviewed
CodeCode shallshall be easy to readbe easy to read and understandand understand
Use theUse the same code stylesame code style everywhereeverywhere
Commit message template ochCommit message template och qualityquality
Make sure style and templates are followed!Make sure style and templates are followed!

Test!
Unit tests
System tests
Integration tests
Test the documentation
Manual tests
Fixed a bug? Add a test. Or two.

Torment
Valgrind, address/UB/integer sanitizersValgrind, address/UB/integer sanitizers
Static code analyses (clang, Coverity, lints)Static code analyses (clang, Coverity, lints)
FuzzersFuzzers

All that, all the time
For every commit
For every PR
All. The. Time

The curl project
>50 builds + test “rounds” per commit
Tests code style, indenting etc
Thousands of tests per build
Builds and tests on tens of platforms
20-25 hours of CI per commit

The curl project’s choice of tools
Valgrind
Clang address,
undefined, signed-
integer-overflow
sanitizers
Clang tidy
“torture tests”
Scan-build
Lgtm
codacy
Coverity
OSS-Fuzz
Travis CI
Appveyor
Cirrus CI
Buildbots

The curl project’s policy
Fix all warnings (eye roll)Fix all warnings (eye roll)
No defects leftNo defects left
Use the strictest and most picky optionsUse the strictest and most picky options
As many tests as possibleAs many tests as possible
Fix security issues as soon as possibleFix security issues as soon as possible

But...
That takes a lot of time and is
expensive!

Bad things will happen
No one is immune, no matter how hard we try!
Act immediately
Own the problem
Fix it
Learn from it
Otherwise...

Clean code
Review
Test
Torment
Act on mistakes

https://daniel.haxx.se/
Thank you!
@bagder

““TheThe created economic valuecreated economic value
cannot be overstated”cannot be overstated”

License
This presentation and its contents are
licensed under the Creative Commons
Attribution 4.0 license:
http://creativecommons.org/licenses/by/4.0/

In this webinar, we explore the process of zero-day vulnerability management from initial threat analysis to automated detection and remediation. We will demonstrate how easy it is to detect attack vectors and to quickly assess the reliability and security of those interfaces using general purpose fuzzing solutions. We will also show you how you can complement these solutions with known vulnerability data and do patch verification easily and cost-effectively. Finally, we will discuss how you can tailor your defenses to block zero day attacks, which is a key aspect of vulnerability management.

DEF CON 27 - workshop ANTHONY ROSE - introduction to amsi bypasses and sandbo...

Felipe Prado

Cyber security webinar 6 - How to build systems that resist attacks?

F-Secure Corporation

Building secure software starts from the very beginning of the development process. Trying to fix security at the end of the development cycle is much harder. And even if it is impossible to build systems that would be totally secure from every breach attempt and that have no flaws, you can build systems that cyber attackers will find extremely hard to breach. Find out more how to build secure systems from the webinar recording in the following link and the presentation slides. https://business.f-secure.com/how-to-build-systems-that-resist-attacks/

Staying above a rising security waterline.

Evan J Johnson (Not a CISSP)

Developing Software with Security in Mindsblom

The enterprise use of APIs is growing exponentially. Companies face a difficult choice. They must shift towards a software-based, digital approach to service and product delivery – or get left behind. Agile development, business pressure and the complexity of API security have made security teams life very complicated. And to make matters more complicated, the adoption of microservices architectures has multiplied the number of API endpoints that you have to protect. Downside: The more APIs, the higher the security risk! API security flaws are injected at many different levels of the API lifecycle: in requirements, development, deployment and monitoring. It is proven that detecting and fixing vulnerabilities during production or post-release time is up to 30 times more difficult than earlier in the API lifecycle. Security should be easy to considered at requirements phase, applied during development by attaching pre-defined policies to APIs and ensuring that security tests are performed as part of the continuous delivery of the APIs. Upside: We’ll prep you with all the knowledge and tools you need to implement an automated, end-to-end API Security process that will get your dev, sec and ops teams speaking the same language. In this presentation you will learn: Security risks at each stage of the API lifecycle, and how to mitigate them. How to implement an end-to-end automated API security model that development, security and operations teams will love. How to think positive! Why a positive security model works.

Agile Chennai 2022 - Shyam Sundar | Everything there is to know about Cyber s...

AgileNetwork

SmartphoneHacking_Android_Exploitation

Malachi Jones

DEFCON 21: EDS: Exploitation Detection System WP

Amr Thabet

(Isc)² secure johannesburg

Tunde Ogunkoya

This talk focussed on the challenges facing the DevOps community from the “developers culture perspective” and the consequences of the perceived disinterest in inculcating a complete 360 degrees’ risk mitigation framework in DevOps practices. The talk touched on the legal +Security+Operational Risk of using Open Source in their SDLC, the need for internal customized Open Source policy and a two-step approach to resolve these risks

Código Seguro

Thiago Bertuzzi

The DevSecOps Builder’s Guide to the CI/CD Pipeline

James Wickett

All organizations want to go faster and decrease friction in their cloud software delivery pipeline. Infosec has an opportunity to change their classic approach from blocker to enabler. This talk will discuss hallmarks of CI/CD and some practical examples for adding security testing across different organizations. The talk will cover emergent patterns, practices and toolchains that bring security to the table. Presented at LASCON 2018, in Austin, TX.

Jason Kent - AppSec Without Additional Tools

centralohioissa

DevSecOps and the CI/CD Pipeline

James Wickett

How to find Zero day vulnerabilities

Mohammed A. Imran

Usable Security for Developers: A Nightmare

Achim D. Brucker

The term “usable security” is on everyone’s lips and there seems to be a general agreement that, first, security controls should not unnecessarily affect the usability and unfriendliness of systems. And, second, that simple to use system should be preferred as they minimize the risk of handling errors that can be the root cause of security incidents such as data leakages. But it also seems to be a general surprise (at least for security experts), why software developers always (still) make so many easy to avoid mistakes that lead to insecure software systems. In fact, many of the large security incidents of the last weeks/months/years are caused by “seemingly simple to fix” programming errors. Bringing both observations together, it should be obvious that we need usable and developer-friendly security controls and programming frameworks that make it easy to build secure systems. Still, reality looks different: many programming languages, APIs, and frameworks provide complex interfaces that are, actually, hard to use securely. In fact, they are miles away from providing usable security for developers. In this talk, I will discuss examples of complex and “non-usable” security for developers such as APIs that, in fact, are (nearly) impossible to use securely or that require a understanding of security topics that most security experts to not have (and, thus, that we cannot expert from software developers).

The Dev, Sec and Ops of API Security - NordicAPIs

42Crunch

4.Security Assessment And Testingphanleson

Complexity is Outside the Code - Craft Conference

jessitron

Why you need API Security Automation

42Crunch

600.250 UI Cross Platform Development and the Android Security Model

Michael Rushanan

Integration into the Secure SDLC Process.ppt

Imam Halim Mursyidin

curl security by Daniel Stenberg from curl up 2024

Daniel Stenberg

rust in curl by Daniel Stenberg from- curl up 2024

Daniel Stenberg

Similar to Writing safe and secure code

Testing curl for security

Daniel Stenberg

Coverity Data SheetJon Lundquist

The Emergent Cloud Security Toolchain for CI/CD

James Wickett

The Dev, Sec and Ops of API Security - API World

42Crunch

Agile Chennai 2022 - Shyam Sundar | Everything there is to know about Cyber s...

AgileNetwork

SmartphoneHacking_Android_Exploitation

Malachi Jones

DEFCON 21: EDS: Exploitation Detection System WP

Amr Thabet

(Isc)² secure johannesburg

Tunde Ogunkoya

Código Seguro

Thiago Bertuzzi

The DevSecOps Builder’s Guide to the CI/CD Pipeline

James Wickett

Jason Kent - AppSec Without Additional Tools

centralohioissa

DevSecOps and the CI/CD Pipeline

James Wickett

How to find Zero day vulnerabilities

Mohammed A. Imran

Usable Security for Developers: A Nightmare

Achim D. Brucker

The Dev, Sec and Ops of API Security - NordicAPIs

42Crunch

4.Security Assessment And Testingphanleson

Complexity is Outside the Code - Craft Conference

jessitron

Why you need API Security Automation

42Crunch

600.250 UI Cross Platform Development and the Android Security Model

Michael Rushanan

Integration into the Secure SDLC Process.ppt

Imam Halim Mursyidin

Similar to Writing safe and secure code (20)

Testing curl for security

Coverity Data Sheet

The Emergent Cloud Security Toolchain for CI/CD

The Dev, Sec and Ops of API Security - API World

Agile Chennai 2022 - Shyam Sundar | Everything there is to know about Cyber s...

SmartphoneHacking_Android_Exploitation

DEFCON 21: EDS: Exploitation Detection System WP

(Isc)² secure johannesburg

Código Seguro

The DevSecOps Builder’s Guide to the CI/CD Pipeline

Jason Kent - AppSec Without Additional Tools

DevSecOps and the CI/CD Pipeline

How to find Zero day vulnerabilities

Usable Security for Developers: A Nightmare

The Dev, Sec and Ops of API Security - NordicAPIs

4.Security Assessment And Testing

Complexity is Outside the Code - Craft Conference

Why you need API Security Automation

600.250 UI Cross Platform Development and the Android Security Model

Integration into the Secure SDLC Process.ppt

Recently uploaded

Designing Great Products: The Power of Design and Leadership by Chief Designe...

Product School

FIDO Alliance Osaka Seminar: Overview.pdf

FIDO Alliance

To Graph or Not to Graph Knowledge Graph Architectures and LLMs

Paul Groth

State of ICS and IoT Cyber Threat Landscape Report 2024 preview

Prayukth K V

The IoT and OT threat landscape report has been prepared by the Threat Research Team at Sectrio using data from Sectrio, cyber threat intelligence farming facilities spread across over 85 cities around the world. In addition, Sectrio also runs AI-based advanced threat and payload engagement facilities that serve as sinks to attract and engage sophisticated threat actors, and newer malware including new variants and latent threats that are at an earlier stage of development. The latest edition of the OT/ICS and IoT security Threat Landscape Report 2024 also covers: State of global ICS asset and network exposure Sectoral targets and attacks as well as the cost of ransom Global APT activity, AI usage, actor and tactic profiles, and implications Rise in volumes of AI-powered cyberattacks Major cyber events in 2024 Malware and malicious payload trends Cyberattack types and targets Vulnerability exploit attempts on CVEs Attacks on counties – USA Expansion of bot farms – how, where, and why In-depth analysis of the cyber threat landscape across North America, South America, Europe, APAC, and the Middle East Why are attacks on smart factories rising? Cyber risk predictions Axis of attacks – Europe Systemic attacks in the Middle East Download the full report from here: https://sectrio.com/resources/ot-threat-landscape-reports/sectrio-releases-ot-ics-and-iot-security-threat-landscape-report-2024/

LF Energy Webinar: Electrical Grid Modelling and Simulation Through PowSyBl -...

DanBrown980551

Do you want to learn how to model and simulate an electrical network from scratch in under an hour? Then welcome to this PowSyBl workshop, hosted by Rte, the French Transmission System Operator (TSO)! During the webinar, you will discover the PowSyBl ecosystem as well as handle and study an electrical network through an interactive Python notebook. PowSyBl is an open source project hosted by LF Energy, which offers a comprehensive set of features for electrical grid modelling and simulation. Among other advanced features, PowSyBl provides: - A fully editable and extendable library for grid component modelling; - Visualization tools to display your network; - Grid simulation tools, such as power flows, security analyses (with or without remedial actions) and sensitivity analyses; The framework is mostly written in Java, with a Python binding so that Python developers can access PowSyBl functionalities as well. What you will learn during the webinar: - For beginners: discover PowSyBl's functionalities through a quick general presentation and the notebook, without needing any expert coding skills; - For advanced developers: master the skills to efficiently apply PowSyBl functionalities to your real-world scenarios.

Mission to Decommission: Importance of Decommissioning Products to Increase E...

Product School

GenAISummit 2024 May 28 Sri Ambati Keynote: AGI Belongs to The Community in O...

Sri Ambati

UiPath Test Automation using UiPath Test Suite series, part 3

DianaGray10

GDG Cloud Southlake #33: Boule & Rebala: Effective AppSec in SDLC using Deplo...

James Anderson

Effective Application Security in Software Delivery lifecycle using Deployment Firewall and DBOM The modern software delivery process (or the CI/CD process) includes many tools, distributed teams, open-source code, and cloud platforms. Constant focus on speed to release software to market, along with the traditional slow and manual security checks has caused gaps in continuous security as an important piece in the software supply chain. Today organizations feel more susceptible to external and internal cyber threats due to the vast attack surface in their applications supply chain and the lack of end-to-end governance and risk management. The software team must secure its software delivery process to avoid vulnerability and security breaches. This needs to be achieved with existing tool chains and without extensive rework of the delivery processes. This talk will present strategies and techniques for providing visibility into the true risk of the existing vulnerabilities, preventing the introduction of security issues in the software, resolving vulnerabilities in production environments quickly, and capturing the deployment bill of materials (DBOM). Speakers: Bob Boule Robert Boule is a technology enthusiast with PASSION for technology and making things work along with a knack for helping others understand how things work. He comes with around 20 years of solution engineering experience in application security, software continuous delivery, and SaaS platforms. He is known for his dynamic presentations in CI/CD and application security integrated in software delivery lifecycle. Gopinath Rebala Gopinath Rebala is the CTO of OpsMx, where he has overall responsibility for the machine learning and data processing architectures for Secure Software Delivery. Gopi also has a strong connection with our customers, leading design and architecture for strategic implementations. Gopi is a frequent speaker and well-known leader in continuous delivery and integrating security into software delivery.

From Siloed Products to Connected Ecosystem: Building a Sustainable and Scala...

Product School

Slack (or Teams) Automation for Bonterra Impact Management (fka Social Soluti...

Jeffrey Haguewood

Sidekick Solutions uses Bonterra Impact Management (fka Social Solutions Apricot) and automation solutions to integrate data for business workflows. We believe integration and automation are essential to user experience and the promise of efficient work through technology. Automation is the critical ingredient to realizing that full vision. We develop integration products and services for Bonterra Case Management software to support the deployment of automations for a variety of use cases. This video focuses on the notifications, alerts, and approval requests using Slack for Bonterra Impact Management. The solutions covered in this webinar can also be deployed for Microsoft Teams. Interested in deploying notification automations for Bonterra Impact Management? Contact us at sales@sidekicksolutionsllc.com to discuss next steps.

Assuring Contact Center Experiences for Your Customers With ThousandEyes

ThousandEyes

When stars align: studies in data quality, knowledge graphs, and machine lear...

Elena Simperl

GraphRAG is All You need? LLM & Knowledge Graph

Guy Korland

Guy Korland, CEO and Co-founder of FalkorDB, will review two articles on the integration of language models with knowledge graphs. 1. Unifying Large Language Models and Knowledge Graphs: A Roadmap. https://arxiv.org/abs/2306.08302 2. Microsoft Research's GraphRAG paper and a review paper on various uses of knowledge graphs: https://www.microsoft.com/en-us/research/blog/graphrag-unlocking-llm-discovery-on-narrative-private-data/

DevOps and Testing slides at DASA Connect

Kari Kakkonen

From Daily Decisions to Bottom Line: Connecting Product Work to Revenue by VP...

Product School

FIDO Alliance Osaka Seminar: FIDO Security Aspects.pdf

FIDO Alliance

Unsubscribed: Combat Subscription Fatigue With a Membership Mentality by Head...

Product School

Transcript: Selling digital books in 2024: Insights from industry leaders - T...

BookNet Canada

The publishing industry has been selling digital audiobooks and ebooks for over a decade and has found its groove. What’s changed? What has stayed the same? Where do we go from here? Join a group of leading sales peers from across the industry for a conversation about the lessons learned since the popularization of digital books, best practices, digital book supply chain management, and more. Link to video recording: https://bnctechforum.ca/sessions/selling-digital-books-in-2024-insights-from-industry-leaders/ Presented by BookNet Canada on May 28, 2024, with support from the Department of Canadian Heritage.

Search and Society: Reimagining Information Access for Radical Futures

Bhaskar Mitra

The field of Information retrieval (IR) is currently undergoing a transformative shift, at least partly due to the emerging applications of generative AI to information access. In this talk, we will deliberate on the sociotechnical implications of generative AI for information access. We will argue that there is both a critical necessity and an exciting opportunity for the IR community to re-center our research agendas on societal needs while dismantling the artificial separation between the work on fairness, accountability, transparency, and ethics in IR and the rest of IR research. Instead of adopting a reactionary strategy of trying to mitigate potential social harms from emerging technologies, the community should aim to proactively set the research agenda for the kinds of systems we should build inspired by diverse explicitly stated sociotechnical imaginaries. The sociotechnical imaginaries that underpin the design and development of information access technologies needs to be explicitly articulated, and we need to develop theories of change in context of these diverse perspectives. Our guiding future imaginaries must be informed by other academic fields, such as democratic theory and critical theory, and should be co-developed with social science scholars, legal scholars, civil rights and social justice activists, and artists, among others.

Recently uploaded (20)