veyepar: Make more Secure Code! - Overview of Security Development Lifecycle and Static Code Analysis

Author(s):	Jason Cohen
Location	Plenary Hall
Date	jan Mon 16	Days Raw Files
Start	21:30	First Raw Start	21:17
Duration	0:30:0	Offset	0:12:47
End	22:00	Last Raw End	22:17
Chapters	00:00 0:16:19
Total cuts_time	31 min.

http://linux.conf.au/schedule/presentation/129/
raw-playlist raw-mp4-playlist encoded-files-playlist host archive tweet mp4 svg png

assets release.pdf Make_more_Secure_Code_Overview_of_Security_Development_Lifecycle_and_Static_Code_Analysis.json
logs
Admin: episode episode list cut list raw files day marks day marks day image_files

State:

Locked:

clear this to unlock

Locked by:

user/process that locked.

Start:

initially scheduled time from master, adjusted to match reality

Duration:

length in hh:mm:ss

Name:

Video Title (shows in video search results)

Emails:

email(s) of the presenter(s)

Released:

has someone authorised pubication

Normalise:

Channelcopy:

m=mono, 01=copy left to right, 10=right to left, 00=ignore.

Thumbnail:

filename.png

Description:

markdown

It would seem that, despite the exponential growth in security products, security services, security companies, security certifications, and general interest in the security topic; we are still bombarded with a constant parade of security vulnerability disclosures on a seemingly daily basis. It turns out that we in the Open Source community can no longer shake a disapproving finger at the closed-source giants without also pointing to ourselves and asking what we can do better. In this era of increasingly modular code development and reuse of common libraries, we need to be considering the impact of potential flaws in code we assume to be secure due simply to its widespread use and Open Source nature.  So, what do we do?  Although it’s not a magical solution or panacea to the problem; implementing Security Development Lifecycle best practices and principles for each and every software development endeavor we undertake (whether it is for your job or for an Open Source Project) can go a long way to reducing the potential for common security flaws.  In addition, there is no reason that Static Code Analysis should not be part of every development effort.  We are still seeing obvious, easy to fix flaws in modern source code. Input sanitization issues, Cross-Site-Scripting, buffer overflows, and many other known issues still represent the bulk of security issues present. Static Code Analysis can help catch many of these unnoticed issues before code makes it out of the developer’s hands. In addition, we can perform our own analysis on libraries that we wish to leverage to help determine risk ourselves.  In this talk, we will explore some common best practice Security Development Lifecycle theory and how we can integrate this into modern code development schemes.  We will also look at how to integrate Static Code analysis tools into the development process, to include a demo.

Comment:

production notes