Secure Development Lifecycle and Fixing Vulnerabilities with Linters
Details
Join us for this online learning and networking opportunity about secure development landscape!
=====================================================
š TOPIC: Security Development Lifecycle
š ABSTRACT: Cybercrime poses a significant threat to every organization, large or small. By adopting the Security Development Lifecycle methodology in their development processes, organizations will be better able to reduce risk and improve trust by making software inherently more secure and better at protecting sensitive information.
This talk will cover Security Development Lifecycle methodology as well as Microsoft SDL, Secure DevOps (DevSecOps) and different tools which can help on secure development journey.
š SPEAKER: Irina Kostina, Cloud Solution Architect at Microsoft
=====================================================
š TOPIC: Fixing Vulnerabilities Automatically with Linters
š ABSTRACT: Static analysis is a tried-and-tested approach to eliminate vulnerabilities in software. However, despite decades of successful use by experts, mainstream programmers often deem static analysis too costly to use. Mainstream programmers do routinely use linters, which are static analysis tools geared towards identifying simple bugs and stylistic issues in software. Can linters serve as a medium for delivering vulnerability detection to mainstream programmers?
We investigate the extent of which linters can be leveraged to help programmers write secure software. We present new rules for ESLint that detect---and automatically fix---certain classes of cross-site scripting, SQL injection, and misconfiguration vulnerabilities in JavaScript. Evaluating our experience, we find that there is enormous potential in using linters to eliminate vulnerabilities in software, due to the relative ease with which linter rules can be implemented and shared to the community. We identify several open challenges, including third-party library dependencies and linter configuration, and propose ways to address them.
š SPEAKER: Willard Rafnsson, Assistant Professor at the IT University of Copenhagen