David  Brumley's guest appearances

David  Brumley

Security Weekly Podcast Network (Video)

Enterprise Security Weekly (Video)

OwlTail

David Brumley

Log4j, solar winds, tesla hacks, and the wave of high profile appsec problems aren’t going to go away with current approaches like SAST and SCA. Why? They are: -40 years old, with little innovation -Haven’t solved the problem. In this segment, we talk about fully autonomous application security. Vetted by DARPA in the Cyber Grand Challenge, the approach is different: -Prove bugs, rather than trying to list all of them. -Zero false positives, which leads to better autonomy.   Segment Resources: Article on competition: https://www.darpa.mil/about-us/timeline/cyber-grand-challenge Technical article on approach:  https://spectrum.ieee.org/mayhem-the-machine-that-finds-software-vulnerabilities-then-patches-them Example vulns discovered:  https://forallsecure.com/blog/forallsecure-uncovers-critical-vulnerabilities-in-das-u-boot https://github.com/forallsecure/vulnerabilitieslab Visit https://www.securityweekly.com/esw for all the latest episodes! Show Notes: https://securityweekly.com/esw255

Log4j, solar winds, tesla hacks, and the wave of high profile appsec problems aren’t going to go away with current approaches like SAST and SCA. Why? They are: -40 years old, with little innovation -Haven’t solved the problem. In this segment, we talk about fully autonomous application security. Vetted by DARPA in the Cyber Grand Challenge, the approach is different: -Prove bugs, rather than trying to list all of them. -Zero false positives, which leads to better autonomy. Segment Resources: Article on competition: <a href="https://www.darpa.mil/about-us/timeline/cyber-grand-challenge" rel="nofollow" target="_blank">https://www.darpa.mil/about-us/timeline/cyber-grand-challenge</a> Technical article on approach: <a href="https://spectrum.ieee.org/mayhem-the-machine-that-finds-software-vulnerabilities-then-patches-them" rel="nofollow" target="_blank"> https://spectrum.ieee.org/mayhem-the-machine-that-finds-software-vulnerabilities-then-patches-them</a> Example vulns discovered: <a href="https://forallsecure.com/blog/forallsecure-uncovers-critical-vulnerabilities-in-das-u-boot" rel="nofollow" target="_blank"> https://forallsecure.com/blog/forallsecure-uncovers-critical-vulnerabilities-in-das-u-boot</a> <a href="https://github.com/forallsecure/vulnerabilitieslab" rel="nofollow" target="_blank">https://github.com/forallsecure/vulnerabilitieslab</a> Visit <a href="https://www.securityweekly.com/esw" rel="nofollow" target="_blank">https://www.securityweekly.com/esw</a> for all the latest episodes! Show Notes: <a href="https://securityweekly.com/esw255" rel="nofollow" target="_blank">https://securityweekly.com/esw255</a>

Bringing Autonomy to AppSec - Dr. David  Brumley  - ESW #255

Log4j, solar winds, tesla hacks, and the wave of high profile appsec problems aren’t going to go away with current approaches like SAST and SCA. Why? They are: -40 years old, with little innovation -Haven’t solved the problem. In this segment, we talk about fully autonomous application security. Vetted by DARPA in the Cyber Grand Challenge, the approach is different: -Prove bugs, rather than trying to list all of them. -Zero false positives, which leads to better autonomy. Segment Resources: Article on competition: <a href="https://www.darpa.mil/about-us/timeline/cyber-grand-challenge" rel="nofollow" target="_blank">https://www.darpa.mil/about-us/timeline/cyber-grand-challenge</a> Technical article on approach: <a href="https://spectrum.ieee.org/mayhem-the-machine-that-finds-software-vulnerabilities-then-patches-them" rel="nofollow" target="_blank"> https://spectrum.ieee.org/mayhem-the-machine-that-finds-software-vulnerabilities-then-patches-them</a> Example vulns discovered: <a href="https://forallsecure.com/blog/forallsecure-uncovers-critical-vulnerabilities-in-das-u-boot" rel="nofollow" target="_blank"> https://forallsecure.com/blog/forallsecure-uncovers-critical-vulnerabilities-in-das-u-boot</a> <a href="https://github.com/forallsecure/vulnerabilitieslab" rel="nofollow" target="_blank">https://github.com/forallsecure/vulnerabilitieslab</a> Visit <a href="https://www.securityweekly.com/esw" rel="nofollow" target="_blank">https://www.securityweekly.com/esw</a> for all the latest episodes! Show Notes: <a href="https://securityweekly.com/esw255" rel="nofollow" target="_blank">https://securityweekly.com/esw255</a>