Topics of Interest: Effective Usage Analysis: The Shortest Path Between a Developer ...
summary
Claims a study of hundreds of Java .NET Python and JavaScript projects finds about 70% ineffective reported vulnerabilities; implements vulnerability fingerprinting, precise location mapping, and inter-procedural analysis across direct and transitive dependencies; produces call traces from proprietary code into OSS to prove exploitability; demonstrates that marking ineffective cases can be done with 100% accuracy for the dataset and thereby reduces developer workload and speeds releases by focusing remediation on a much smaller set of true risks.
AI-written summary · about
chapters (9)
- 0:00Introduction
- 4:44Prioritization
- 7:15Vulnerability vs Risk
- 9:05Vulnerability Effectiveness
- 9:51Effective Usage
- 17:01Code Analysis
- 19:37Technical Analysis
- 22:24Accuracy
- 25:15Risk Analysis
related talks
38mEffective Usage Analysis: Boosting Developer Productivity Via Innovative, Noise-reduced Vulnerability Analysis
14mThe State of Open Source Vulnerabilities Management in 2019
49mOpen-source vulnerability management? Use the source, Luke!
05mWhy Can't Johnny Fix Vulnerabilities: A Usability Evaluation of Static Analysis Tools
45mEradicating Vulnerability Classes by Shelving SAST and Embracing Secure Defaults and Invariants
34mHow To Find And Prevent Entire Classes Of Security Vulnerabilities
27mFind and Track the hidden vulnerabilities inside your dependencies
43mDo Certain Types Of Developers Or Teams Write More Secure Code?