IEEE Computer Societys Center for Secure Design
summary
IEEE Computer Society launches the Center for Secure Design in 2014 and documents Top 10 design flaws from a May 2014 workshop using real internal-review findings from firms, universities and government; the initiative promises concrete artifacts, checklists and templates (open CC). Examples include a Google framework that reduced XSS findings to zero in sampled apps, protocol-level failures like the TLS triple handshake issue, and recurring crypto misdesigns around key rotation and compromise.
AI-written summary · about
chapters (7)
- 0:00Start
- 0:48Kathy Clark-Fisher (from IEEE CS) wanted to start a new initiative
- 13:49Use an authentication mechanism that cannot be bypassed or tampered with
- 16:32Strictly separate data and control instructions, and never process control instructions received from untrusted sources
- 27:06Understand how integrating external components changes your attack surface
- 29:46Be flexible when considering future changes to objects and actors
- 36:06IEEE CENTER FOR SECURE DESIGN
related talks
23mSecure Code, Safe Future: Mastering Security in Critical Software Development
31mThe Product Security Imperative: Lessons from CISA
40mUnsafe At Any Speed: CISA's Plan to Foster Tech Ecosystem Security
27mSecurity by Design
01h 17mSecure by Design - Security Principles for the Working Architect
28mSecurity Through Design - Making Security Better By Designing for People
27mHow Security, Development & Testing can work together to stop ...
34mSecure by design - the secret weapon of high-performing organisations