Schlagwort-Archive: Secure Software Engineering

CfP: SecSE 2019

The 10th edition of the International Workshop on Secure Software Engineering in DevOps and Agile Development will take place in conjunction with the Cyber Security 2019 conference on June 3-4 2019 in Oxford, UK. The call for papers is already online and plenty of time is left to prepare a paper before the submission deadline in early February. Besides scientific paper submissions the workshop seeks short ignite talks and also industry experience talks.

Important dates:

February 6th, 2019 – Submission Deadline
March 26th, 2019 – Author Notification
April 14th, 2019 – Author Registration/camera-ready
June 3-4th, 2019 – Workshop

Eat Less Bread?

“Eat less bread” requests a British poster from WWI. We all know it makes sense, don’t we? Resources become scarce at wartime, so wasting them weakens one’s own position. Yet this kind of advice can be utterly useless: tell a hungry person to eat less bread and you will earn, at best, a blank stare. However reasonable your advice may seem to you and everyone else, a hungry person will be physically and mentally unable to comply.

“Do not call system()” or “Do not read uninitialized memory” request secure coding guides. Such advice is equally useless if directed at a person who lacks the cognitive ability to comply. Cognitive limitations do not mean a person is stupid. We all are limited in our respective ability to process information, and we are more similar to than dissimilar from each other in this regard.

Secure coding guidelines all too often dictate a large set of arbitrary dos and don’ts, but fail to take human factors into account. Do X! Don’t do Y, do Z instead! Each of these recommendations has a sound technical basis; code becomes more secure if everyone follows this advice. However, only some of these recommendations are realistic for programmers to follow. Their sheer number should raise our doubt and let us expect that only a subset will ever be adopted by a substantial number of programmers.

Some rules are better suited for adoptions than others. Programmers often acquire idioms and conventions they perceive as helpful. Using additional parentheses for clarity, for example, even though not strictly necessary, improves readability; and the const == var convention prevents certain defects that are easy to introduce and sometimes hard to debug.

Other rules seem, from a programmer’s point of view, just ridiculous. Why is there a system() function in the first place if programmers are not supposed to use it? And if developers should not read uninitialized memory, what would warn them about memory being not initialized? Such advice is inexpensive – and likely ineffective. If we want programmers to write secure code, we must offer them platforms that make secure programming easy and straightforward and insecure programming hard and difficult.

2. CAST-Seminar »Sichere Software entwickeln« am 15. Mai 2014

Unser CAST-Seminar »Sichere Software entwickeln – Erfahrungen, Methoden, Werkzeuge« geht in die zweite Runde. Am 15. Mai 2014 laden wir zum Erfahrungsaustausch ins Darmstadtium ein. Vorträge von Praktikern und aus der angewandten Forschung beleuchten das Thema von allen Seiten. Unsere Themen in diesem Jahr:

  • Organisation der sicheren Softwareentwicklung in Großunternehmen
  • Security in schlanken und agilen Processen
  • Denial-of-Service-Schwachstellen in Anwendungen
  • Sicherheitsaspekte der Schnittstellenentwicklung
  • Bedrohungsmodellierung und Sicherheitsanforderungen in der Praxis
  • Skalierung von Methoden am Beispiel der Risikoanalyse

Anmeldung und Programm unter

CAST-Seminar: Sichere Software entwickeln – Erfahrungen, Methoden, Werkzeuge am 25. April 2013

Wir veranstalten am 25. April 2013 unter dem Dach des CAST e.V. das Seminar Sichere Software entwickeln – Erfahrungen, Methoden, Werkzeuge. Es wendet sich an Praktiker der Softwareentwicklung, die für die Sicherheit der Ergebnisse verantwortlich sind. Die Themen reichen von Werkzeugen für die Praxis über Schulung und Zertifizierung für Entwickler bis zur Architektur sicherer Software. Das Vortragsprogramm steht auf der Website des CAST e.V., dort erfolgt auch die Anmeldung.