Eradicating Vulnerability Classes by Shelving SAST and Embracing Secure Defaults and Invariants
summary
Argues that replacing mass bug hunting with enforced secure defaults and invariants removes whole classes of flaws, citing Microsoft’s ~41% reduction from banning unsafe C functions, and recommending continuous pull‑request scanning under five to ten minutes, a 95% true‑positive goal, and an enforce‑and‑autofix workflow. Implements a lightweight static analysis stack—grep for quick checks and semgrep for code‑aware patterns—to detect dangerous escape hatches like dangerouslySetInnerHTML or exec, bake safe templates into project starters, and measure impact with a 20–40 category vulnerability taxonomy.
AI-written summary · about
chapters (18)
- 0:00Intro
- 0:43A Different Way to Approach Security
- 2:04Outline
- 5:45Quiz: Does this app have XSS?
- 9:24Task vs Effort Required
- 10:57Your Internal Dialogue?
- 15:57Compounding Effects of Killing Bug Classes
- 17:51Evaluate which vulnerability class to focus on
- 24:26Select a Safe Pattern and Make it the Default
- 28:48Use Tools to Enforce the Safe Pattern
- 30:10Continuous Scanning: Related Work
- 30:36Continuous Scanning: Best Practices
- 34:15How to Find Escape Hatches?
- 38:29Secure defaults + types
- 39:20Beyond OWASP Top10: Business Logic
- 40:19If developers don't security team...
- 40:57So make developers security team!
- 41:57#3 Autofix
related talks
33mBattle Tested Application Security
41mSkillful, Scalefull Fullstack Security in a State of Constant Flux
38mEffective Usage Analysis: Boosting Developer Productivity Via Innovative, Noise-reduced Vulnerability Analysis
45mState of (Absolute) AppSec
01h 06mEscaping Vulnerability Hell: Bridging the Gap Between Developers and Security Teams
01h 03m“Secure Coding Best Practices: Your First Line Is The Last Line Of Defense (2 of 2)”
30mTopics of Interest: Automatic Vulnerability Remediation: The Trusted and Secure Road ...
34mHow To Find And Prevent Entire Classes Of Security Vulnerabilities