Secure Coding Best Practices

Computer systems are under siege 24 hours a day, day in and day out. The critical security infrastructure designed to protect those systems, won’t:

* Perimeter security won’t protect you.
* Network analytics won’t protect you.
* Virus scanners won’t protect you.
* Even the users who should know better than to click on that too-good-to-be-true offer won’t protect you.

The other side has the best security hardware and software systems other people’s money can buy and they have all the time in the world to find creative ways to defeat them. Meltdown and Spectre are prime examples security vulnerabilities that have lurked dormant for decades. Or have they? If your systems are in any way connected to the outside world, the other side will get inside the wire on you. Know that going in.

Whether you write applications, libraries or work in kernel code, the line of code you write today may very well be the vulnerability someone else finds tomorrow. By nature every code base contains hundreds of attack surfaces and it only takes one serious vulnerability to compromise your system.

But what exactly is an attack surface?

While Modern C++ is designed to be secure, the ways we use it often aren’t. And with each vulnerability comes new questions:

* Is it serious?
* If I fix it, do I take a performance hit?
* How do I write efficient, scalable code that’s also secure?
* How do I know which vulnerabilities will compromise my system and which ones are a low enough risk?

Yes, there are trade-offs. We make them every day and security is no different. In this talk, we’ll look at the ways our software often fails. We’ll walk through code samples to uncover their silent vulnerabilities and show how to correct them. And we’ll discuss what trade-offs we can make to balance security vs. performance. Finally, we’ll look at ways to deal with those threats starting at design time, baking security directly into the code from the very first line.

The critical security infrastructure designed to protect your systems is largely out of your control. The one thing you can control is the next line of code you write. This talk is for anyone that uses C++ or Modern C++ for kernel, applications or libraries that run in the real-world and that face real-world attacks.

EVENT:

C++Now 2018

SPEAKER:

Matthew Butler

PERMISSIONS:

Original video was published with the Creative Commons Attribution license (reuse allowed).

CREDITS:

Original video source: https://www.youtube.com/watch?v=oW3rRfjWwUE

source