2022 IEEE Secure Development Conference (SecDev)最新文献_第2页

Framework to Assess Policy Driven Security Misconfiguration Risks in Cloud Native Application 评估云原生应用中策略驱动的安全错误配置风险的框架

2022 IEEE Secure Development Conference (SecDev) Pub Date : 2022-10-01 DOI: 10.1109/SecDev53368.2022.00023

Kanchanjot Kaur Phokela, Kapil Singi, Kuntal Dey, Vikrant S. Kaulgud, Adam P. Burden

引用次数: 0

Evaluating Text Augmentation for Boosting the Automatic Mapping of Vulnerability Information to Adversary Techniques 评估文本增强促进漏洞信息自动映射到对手技术

2022 IEEE Secure Development Conference (SecDev) Pub Date : 2022-10-01 DOI: 10.1109/SecDev53368.2022.00017

Emmanouil Gionanidis, P. Karvelis, G. Georgoulas, K. Stamos, Purvi Garg

{"title":"Evaluating Text Augmentation for Boosting the Automatic Mapping of Vulnerability Information to Adversary Techniques","authors":"Emmanouil Gionanidis, P. Karvelis, G. Georgoulas, K. Stamos, Purvi Garg","doi":"10.1109/SecDev53368.2022.00017","DOIUrl":"https://doi.org/10.1109/SecDev53368.2022.00017","url":null,"abstract":"MITRE ATT&CK is a well known framework which provides knowledge about adversary techniques' lifecycle and the targeted platforms. This knowledge is acquired by manually mapping vulnerability information to adversary techniques. However, the amount of published vulnerabilities makes it tedious and impractical for the expert. To this end, a model is developed to automate this mapping by solving a multi-label text classification problem. That is, to assign multiple adversary techniques, i.e., labels, to a vulnerability text description. In this paper, state-of-the-art models based on neural networks are utilized to solve the mapping problem. A common issue in multi-label classification is the existence of underrepresented classes. Here, text augmentation techniques are leveraged to help the developed models confront this by increasing, explicitly or implicitly, the input information. It is experimentally demonstrated that the proposed models surpass previous state-of-the-art. Additionally, when the proposed text augmentation techniques are used performance is boosted across all metrics providing a more accurate mapping.","PeriodicalId":407946,"journal":{"name":"2022 IEEE Secure Development Conference (SecDev)","volume":"23 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2022-10-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"123934749","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 0

Tutorial: Threat Modeling of Cloud-based Solutions 教程:基于云的解决方案的威胁建模

2022 IEEE Secure Development Conference (SecDev) Pub Date : 2022-10-01 DOI: 10.1109/secdev53368.2022.00014

L. B. Othmane, Heinrich Gantenbein, Hasan Yasar, Simone Curzi, A. Valani, Arun Prabhakar, Robert W. Cuddy

引用次数: 1

Uncovering Product Vulnerabilities with Threat Knowledge Graphs 利用威胁知识图谱发现产品漏洞

2022 IEEE Secure Development Conference (SecDev) Pub Date : 2022-10-01 DOI: 10.1109/SecDev53368.2022.00028

Zhenpeng Shi, Nikolay Matyunin, Kalman Graffi, D. Starobinski

引用次数: 1

A Comparative Study of Log4Sheil Test Tools log4shell测试工具的比较研究

2022 IEEE Secure Development Conference (SecDev) Pub Date : 2022-10-01 DOI: 10.1109/SecDev53368.2022.00016

D. Everson, Ashish Bastola, Rajat Mittal, Siddheshwar Munde, Long Cheng

引用次数: 0

What are the Practices for Secret Management in Software Artifacts? 软件工件中的秘密管理实践是什么?

2022 IEEE Secure Development Conference (SecDev) Pub Date : 2022-08-24 DOI: 10.1109/SecDev53368.2022.00026

S. Basak, L. Neil, Bradley Reaves, L. Williams

{"title":"What are the Practices for Secret Management in Software Artifacts?","authors":"S. Basak, L. Neil, Bradley Reaves, L. Williams","doi":"10.1109/SecDev53368.2022.00026","DOIUrl":"https://doi.org/10.1109/SecDev53368.2022.00026","url":null,"abstract":"Throughout 2021, GitGuardian's monitoring of public GitHub repositories revealed a two-fold increase in the number of secrets (database credentials, API keys, and other credentials) exposed compared to 2020, accumulating more than six million secrets. A systematic derivation of practices for managing secrets can help practitioners in secure development. The goal of our paper is to aid practitioners in avoiding the exposure of secrets by identifying secret management practices in software artifacts through a systematic derivation of practices disseminated in Internet artifacts. We conduct a grey literature review of Internet artifacts, such as blog articles and question and answer posts. We identify 24 practices grouped in six categories comprised of developer and organizational practices. Our findings indicate that using local environment variables and external secret management services are the most recommended practices to move secrets out of source code and to securely store secrets. We also observe that using version control system scanning tools and employing short-lived secrets are the most recommended practices to avoid accidentally committing secrets and limit secret exposure, respectively.","PeriodicalId":407946,"journal":{"name":"2022 IEEE Secure Development Conference (SecDev)","volume":"9 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2022-08-24","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"122729282","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 4

How far are German companies in improving security through static program analysis tools? 德国公司在通过静态程序分析工具提高安全性方面取得了多大进展?

2022 IEEE Secure Development Conference (SecDev) Pub Date : 2022-08-12 DOI: 10.1109/SecDev53368.2022.00015

Goran Piskachev, Stefan Dziwok, Thorsten Koch, Sven Merschjohann, E. Bodden

{"title":"How far are German companies in improving security through static program analysis tools?","authors":"Goran Piskachev, Stefan Dziwok, Thorsten Koch, Sven Merschjohann, E. Bodden","doi":"10.1109/SecDev53368.2022.00015","DOIUrl":"https://doi.org/10.1109/SecDev53368.2022.00015","url":null,"abstract":"As security becomes more relevant for many com-panies, the popularity of static program analysis (SPA) tools is increasing. In this paper, we target the use of SPA tools among companies in Germany with a focus on security. We give insights on the current issues and the developers' willingness to configure the tools to overcome these issues. Compared to previous studies, our study considers the companies' culture and processes for using SPA tools. We conducted an online survey with 256 responses and semi-structured interviews with 17 product owners and executives from multiple companies. Our results show a diversity in the usage of tools. Only half of our survey participants use SPA tools. The free tools tend to be more popular among software developers. In most companies, software developers are encouraged to use free tools, whereas commercial tools can be requested. However, the product owners and executives in our interviews reported that their developers do not request new tools. We also find out that automatic security checks with tools are rarely performed on each release.","PeriodicalId":407946,"journal":{"name":"2022 IEEE Secure Development Conference (SecDev)","volume":"24 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2022-08-12","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"116363347","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 0

Position Paper: Towards a Hybrid Approach to Protect Against Memory Safety Vulnerabilities 立场文件:迈向防止内存安全漏洞的混合方法

2022 IEEE Secure Development Conference (SecDev) Pub Date : 2021-06-05 DOI: 10.1109/SecDev53368.2022.00020

A. Bhayat, L. Cordeiro, Giles Reger, F. Shmarov, Konstantin Korovin, T. Melham, Kaled Alshamrany, Mustafa A. Mustafa, Pierre Olivier

{"title":"Position Paper: Towards a Hybrid Approach to Protect Against Memory Safety Vulnerabilities","authors":"A. Bhayat, L. Cordeiro, Giles Reger, F. Shmarov, Konstantin Korovin, T. Melham, Kaled Alshamrany, Mustafa A. Mustafa, Pierre Olivier","doi":"10.1109/SecDev53368.2022.00020","DOIUrl":"https://doi.org/10.1109/SecDev53368.2022.00020","url":null,"abstract":"Memory corruption bugs continue to plague low-level systems software, generally written in unsafe programming languages. In order to detect and protect against such exploits, many pre- and post-deployment techniques exist. In this position paper, we propose and motivate the need for a hybrid approach for the protection against memory safety vulnerabilities, com-bining techniques that can identify the presence (and absence) of vulnerabilities pre-deployment with those that can detect and mitigate such vulnerabilities post-deployment. Our proposed hy-brid approach involves three layers: hardware runtime protection provided by capability hardware, software runtime protection provided by compiler instrumentation, and static analysis pro-vided by bounded model checking and symbolic execution. The key aspect of the proposed hybrid approach is that the protection offered is greater than the sum of its parts - the expense of post-deployment runtime checks is potentially reduced via information obtained during pre-deployment analysis. During pre-deployment analysis, static checking can be guided by runtime information.","PeriodicalId":407946,"journal":{"name":"2022 IEEE Secure Development Conference (SecDev)","volume":"14 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2021-06-05","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"122039139","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 2