2016 IEEE Cybersecurity Development (SecDev)最新文献_第2页

Secure DevOps Process and Implementation 安全的DevOps流程和实现

2016 IEEE Cybersecurity Development (SecDev) Pub Date : 2016-11-01 DOI: 10.1109/SecDev.2016.048

Hasan Yasar, Kiriakos Kontostathis

引用次数: 3

Codiscope SecureAssist™ — The Developer’s Security Assistant Codiscope SecureAssist™-开发人员的安全助手

2016 IEEE Cybersecurity Development (SecDev) Pub Date : 2016-11-01 DOI: 10.1109/SecDev.2016.046

N. Murthy

引用次数: 1

Beyond errno: Error Handling in “C” 超越errno:“C”中的错误处理

2016 IEEE Cybersecurity Development (SecDev) Pub Date : 2016-11-01 DOI: 10.1109/SecDev.2016.045

David Svoboda

引用次数: 0

Toward Semantic Cryptography APIs 迈向语义加密api

2016 IEEE Cybersecurity Development (SecDev) Pub Date : 2016-11-01 DOI: 10.1109/SecDev.2016.014

Soumya Indela, Mukul Kulkarni, Kartik Nayak, T. Dumitras

{"title":"Toward Semantic Cryptography APIs","authors":"Soumya Indela, Mukul Kulkarni, Kartik Nayak, T. Dumitras","doi":"10.1109/SecDev.2016.014","DOIUrl":"https://doi.org/10.1109/SecDev.2016.014","url":null,"abstract":"While several mature cryptographic frameworks exist, and have been utilized for building complex applications, developers often use these frameworks incorrectly and introduce security vulnerabilities. This stems from several challenges, including (i) an expectation that framework users understand security attacks and defenses and the subtle impact of various low level parameters, (ii) the need to take into account information external to the system to ensure security (e.g. TLS certificate revocations), and (iii) the frequent need to disable security checks during development and testing, as sometimes these checks remain disabled in production. We propose guidelines for designing cryptography APIs that are semantically meaningful for developers and that can be implemented consistently on top of existing frameworks. We also propose the Regulator design pattern, for incorporating security-critical external information, and build management hooks for isolating security workarounds needed during the development and test phases. Our API is a first step toward striking the right balance between restricting the security decisions that developers make and giving them the flexibility needed for complex applications that use cryptography.","PeriodicalId":166406,"journal":{"name":"2016 IEEE Cybersecurity Development (SecDev)","volume":"55 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2016-11-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"114108695","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 4

Continuous Fuzzing with libFuzzer and AddressSanitizer 使用libFuzzer和AddressSanitizer实现连续模糊检测

2016 IEEE Cybersecurity Development (SecDev) Pub Date : 2016-11-01 DOI: 10.1109/SecDev.2016.043

Kosta Serebryany

引用次数: 95

A Case for Combining Industrial Pragmatics with Formal Methods 工业语用学与形式方法结合的案例

2016 IEEE Cybersecurity Development (SecDev) Pub Date : 2016-11-01 DOI: 10.1109/SecDev.2016.021

Eric L. McCorkle

引用次数: 0

How to find and fix software vulnerabilities with coverity static analysis 如何用覆盖率静态分析发现和修复软件漏洞

2016 IEEE Cybersecurity Development (SecDev) Pub Date : 2016-11-01 DOI: 10.1109/SecDev.2016.041

Bill Baloglu

引用次数: 4

Using Dr. Fuzz, Dr. Memory, and Custom Dynamic Tools for Secure Development 使用Dr. Fuzz、Dr. Memory和自定义动态工具进行安全开发

2016 IEEE Cybersecurity Development (SecDev) Pub Date : 2016-11-01 DOI: 10.1109/SecDev.2016.044

Derek Bruening, Qin Zhao

引用次数: 1

Leveraging Data Provenance to Enhance Cyber Resilience 利用数据来源增强网络弹性

2016 IEEE Cybersecurity Development (SecDev) Pub Date : 2016-11-01 DOI: 10.1109/SecDev.2016.034

Thomas Moyer, Karishma Chadha, R. Cunningham, N. Schear, Warren Smith, Adam Bates, Kevin R. B. Butler, F. Capobianco, T. Jaeger, Patrick T. Cable

引用次数: 4

Safe Client/Server Web Development with Haskell 使用Haskell进行安全的客户端/服务器Web开发

2016 IEEE Cybersecurity Development (SecDev) Pub Date : 2016-11-01 DOI: 10.1109/SecDev.2016.040

Mark Mazumder, T. Braje

{"title":"Safe Client/Server Web Development with Haskell","authors":"Mark Mazumder, T. Braje","doi":"10.1109/SecDev.2016.040","DOIUrl":"https://doi.org/10.1109/SecDev.2016.040","url":null,"abstract":"We demonstrate how two Haskell libraries - Reflex-Dom and Servant - provide a powerful and complete web development framework which uses typechecking to guarantee many security and correctness properties on both the client and the server. With types as our guide, we can ensure that the data passed to our API is of the right shape, that we are forced to sanitize user input (eliminating most of the possibilities for SQL injection or XSS attacks), and that user input errors are guaranteed to be handled. We use Reflex, a Functional Reactive Programming engine, compiled with GHCJS (the Haskell-to-JavaScript transpiler) to lift user input into a safe representation. Types are used to enforce that all required data is requested from a user before the user can proceed to the next action in a workflow. Malformed user input is also cleanly separated at the type level for automatic reporting and recovery. Tutorial exercises will highlight Servant’s guarantees that a REST API is fully specified for all possible user inputs and return conditions. Tutorial attendees will gain an appreciation of how much work this up-front specification can save in development time. For example, Servant knows what all of your endpoints are, and serves error pages for everything else. Servant can also safely handle data conversions from the world of untyped Strings into the typesafe world of your API.","PeriodicalId":166406,"journal":{"name":"2016 IEEE Cybersecurity Development (SecDev)","volume":"35 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2016-11-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"115539350","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 5