Bad software is eating the world. - DefCamp 1/20161109...2016/11/09 · “Software is eating the...
Transcript of Bad software is eating the world. - DefCamp 1/20161109...2016/11/09 · “Software is eating the...
![Page 1: Bad software is eating the world. - DefCamp 1/20161109...2016/11/09 · “Software is eating the world” 3 Challenges of the software economy need skilled people to build secure](https://reader036.fdocuments.us/reader036/viewer/2022081615/5fde534748c8937d3c33d5bb/html5/thumbnails/1.jpg)
1
Bad software is eating the world.
Mark Felegyhazi
CrySyS Lab / avatao
![Page 2: Bad software is eating the world. - DefCamp 1/20161109...2016/11/09 · “Software is eating the world” 3 Challenges of the software economy need skilled people to build secure](https://reader036.fdocuments.us/reader036/viewer/2022081615/5fde534748c8937d3c33d5bb/html5/thumbnails/2.jpg)
2
“Software is eating the world”
![Page 3: Bad software is eating the world. - DefCamp 1/20161109...2016/11/09 · “Software is eating the world” 3 Challenges of the software economy need skilled people to build secure](https://reader036.fdocuments.us/reader036/viewer/2022081615/5fde534748c8937d3c33d5bb/html5/thumbnails/3.jpg)
3
Challenges of the software economy
need skilled people
to build secure software
![Page 4: Bad software is eating the world. - DefCamp 1/20161109...2016/11/09 · “Software is eating the world” 3 Challenges of the software economy need skilled people to build secure](https://reader036.fdocuments.us/reader036/viewer/2022081615/5fde534748c8937d3c33d5bb/html5/thumbnails/4.jpg)
4
Internet of Things
![Page 5: Bad software is eating the world. - DefCamp 1/20161109...2016/11/09 · “Software is eating the world” 3 Challenges of the software economy need skilled people to build secure](https://reader036.fdocuments.us/reader036/viewer/2022081615/5fde534748c8937d3c33d5bb/html5/thumbnails/5.jpg)
5
![Page 6: Bad software is eating the world. - DefCamp 1/20161109...2016/11/09 · “Software is eating the world” 3 Challenges of the software economy need skilled people to build secure](https://reader036.fdocuments.us/reader036/viewer/2022081615/5fde534748c8937d3c33d5bb/html5/thumbnails/6.jpg)
6
Barnaby Jack pacemaker hack
![Page 7: Bad software is eating the world. - DefCamp 1/20161109...2016/11/09 · “Software is eating the world” 3 Challenges of the software economy need skilled people to build secure](https://reader036.fdocuments.us/reader036/viewer/2022081615/5fde534748c8937d3c33d5bb/html5/thumbnails/7.jpg)
7
Barnaby Jack pacemaker hack
1. Bedside transmitters sold with pacemakers (9-15m) 2. Ping to discover model and serial number of
transmitter 3. Reprogram transmitter firmware 4. Reprogram the pacemaker remotely 5. Transmitters have access to remote servers 6. Upload specific firmware to remote servers and
cause mass killing
![Page 8: Bad software is eating the world. - DefCamp 1/20161109...2016/11/09 · “Software is eating the world” 3 Challenges of the software economy need skilled people to build secure](https://reader036.fdocuments.us/reader036/viewer/2022081615/5fde534748c8937d3c33d5bb/html5/thumbnails/8.jpg)
8
Self-driving cars
![Page 9: Bad software is eating the world. - DefCamp 1/20161109...2016/11/09 · “Software is eating the world” 3 Challenges of the software economy need skilled people to build secure](https://reader036.fdocuments.us/reader036/viewer/2022081615/5fde534748c8937d3c33d5bb/html5/thumbnails/9.jpg)
9
CrySyS car hacking
PC running WinCC PLC management software
PLC controlling the uranium centrifuges
uranium centrifuges
PC running a vehicle diagnostic software
ECU controlling some function of the vehicle
vehicle
![Page 10: Bad software is eating the world. - DefCamp 1/20161109...2016/11/09 · “Software is eating the world” 3 Challenges of the software economy need skilled people to build secure](https://reader036.fdocuments.us/reader036/viewer/2022081615/5fde534748c8937d3c33d5bb/html5/thumbnails/10.jpg)
10
Critical infrastructure
![Page 11: Bad software is eating the world. - DefCamp 1/20161109...2016/11/09 · “Software is eating the world” 3 Challenges of the software economy need skilled people to build secure](https://reader036.fdocuments.us/reader036/viewer/2022081615/5fde534748c8937d3c33d5bb/html5/thumbnails/11.jpg)
11
11
![Page 12: Bad software is eating the world. - DefCamp 1/20161109...2016/11/09 · “Software is eating the world” 3 Challenges of the software economy need skilled people to build secure](https://reader036.fdocuments.us/reader036/viewer/2022081615/5fde534748c8937d3c33d5bb/html5/thumbnails/12.jpg)
12
Websites are the key target
![Page 13: Bad software is eating the world. - DefCamp 1/20161109...2016/11/09 · “Software is eating the world” 3 Challenges of the software economy need skilled people to build secure](https://reader036.fdocuments.us/reader036/viewer/2022081615/5fde534748c8937d3c33d5bb/html5/thumbnails/13.jpg)
13
Apps are no better
![Page 14: Bad software is eating the world. - DefCamp 1/20161109...2016/11/09 · “Software is eating the world” 3 Challenges of the software economy need skilled people to build secure](https://reader036.fdocuments.us/reader036/viewer/2022081615/5fde534748c8937d3c33d5bb/html5/thumbnails/14.jpg)
14
What can happen? – Advanced attack
![Page 15: Bad software is eating the world. - DefCamp 1/20161109...2016/11/09 · “Software is eating the world” 3 Challenges of the software economy need skilled people to build secure](https://reader036.fdocuments.us/reader036/viewer/2022081615/5fde534748c8937d3c33d5bb/html5/thumbnails/15.jpg)
15
What can happen? – Weak suppliers
![Page 16: Bad software is eating the world. - DefCamp 1/20161109...2016/11/09 · “Software is eating the world” 3 Challenges of the software economy need skilled people to build secure](https://reader036.fdocuments.us/reader036/viewer/2022081615/5fde534748c8937d3c33d5bb/html5/thumbnails/16.jpg)
16
What can happen? – OpenSSL Heartbleed
![Page 17: Bad software is eating the world. - DefCamp 1/20161109...2016/11/09 · “Software is eating the world” 3 Challenges of the software economy need skilled people to build secure](https://reader036.fdocuments.us/reader036/viewer/2022081615/5fde534748c8937d3c33d5bb/html5/thumbnails/17.jpg)
17
How to write secure code?
![Page 18: Bad software is eating the world. - DefCamp 1/20161109...2016/11/09 · “Software is eating the world” 3 Challenges of the software economy need skilled people to build secure](https://reader036.fdocuments.us/reader036/viewer/2022081615/5fde534748c8937d3c33d5bb/html5/thumbnails/18.jpg)
18
Secure software development
hackers live here
![Page 19: Bad software is eating the world. - DefCamp 1/20161109...2016/11/09 · “Software is eating the world” 3 Challenges of the software economy need skilled people to build secure](https://reader036.fdocuments.us/reader036/viewer/2022081615/5fde534748c8937d3c33d5bb/html5/thumbnails/19.jpg)
19
cost
time
cost of security bugs
design development testing production
1x 5x
15x
60x
![Page 20: Bad software is eating the world. - DefCamp 1/20161109...2016/11/09 · “Software is eating the world” 3 Challenges of the software economy need skilled people to build secure](https://reader036.fdocuments.us/reader036/viewer/2022081615/5fde534748c8937d3c33d5bb/html5/thumbnails/20.jpg)
20
cost
time
cost of security bugs
design development testing production
1x 5x
15x
60x
![Page 21: Bad software is eating the world. - DefCamp 1/20161109...2016/11/09 · “Software is eating the world” 3 Challenges of the software economy need skilled people to build secure](https://reader036.fdocuments.us/reader036/viewer/2022081615/5fde534748c8937d3c33d5bb/html5/thumbnails/21.jpg)
21
Code reuse
![Page 22: Bad software is eating the world. - DefCamp 1/20161109...2016/11/09 · “Software is eating the world” 3 Challenges of the software economy need skilled people to build secure](https://reader036.fdocuments.us/reader036/viewer/2022081615/5fde534748c8937d3c33d5bb/html5/thumbnails/22.jpg)
22
Debugging (for security)
![Page 23: Bad software is eating the world. - DefCamp 1/20161109...2016/11/09 · “Software is eating the world” 3 Challenges of the software economy need skilled people to build secure](https://reader036.fdocuments.us/reader036/viewer/2022081615/5fde534748c8937d3c33d5bb/html5/thumbnails/23.jpg)
23
Rubber-duck debugging
![Page 24: Bad software is eating the world. - DefCamp 1/20161109...2016/11/09 · “Software is eating the world” 3 Challenges of the software economy need skilled people to build secure](https://reader036.fdocuments.us/reader036/viewer/2022081615/5fde534748c8937d3c33d5bb/html5/thumbnails/24.jpg)
24
Code review
![Page 25: Bad software is eating the world. - DefCamp 1/20161109...2016/11/09 · “Software is eating the world” 3 Challenges of the software economy need skilled people to build secure](https://reader036.fdocuments.us/reader036/viewer/2022081615/5fde534748c8937d3c33d5bb/html5/thumbnails/25.jpg)
25
Pair programming
![Page 26: Bad software is eating the world. - DefCamp 1/20161109...2016/11/09 · “Software is eating the world” 3 Challenges of the software economy need skilled people to build secure](https://reader036.fdocuments.us/reader036/viewer/2022081615/5fde534748c8937d3c33d5bb/html5/thumbnails/26.jpg)
26
Automated code testing
![Page 27: Bad software is eating the world. - DefCamp 1/20161109...2016/11/09 · “Software is eating the world” 3 Challenges of the software economy need skilled people to build secure](https://reader036.fdocuments.us/reader036/viewer/2022081615/5fde534748c8937d3c33d5bb/html5/thumbnails/27.jpg)
27
Use reliable crypto protocols
![Page 28: Bad software is eating the world. - DefCamp 1/20161109...2016/11/09 · “Software is eating the world” 3 Challenges of the software economy need skilled people to build secure](https://reader036.fdocuments.us/reader036/viewer/2022081615/5fde534748c8937d3c33d5bb/html5/thumbnails/28.jpg)
28
Need people to write secure code
![Page 29: Bad software is eating the world. - DefCamp 1/20161109...2016/11/09 · “Software is eating the world” 3 Challenges of the software economy need skilled people to build secure](https://reader036.fdocuments.us/reader036/viewer/2022081615/5fde534748c8937d3c33d5bb/html5/thumbnails/29.jpg)
29
Businesses need IT people
![Page 30: Bad software is eating the world. - DefCamp 1/20161109...2016/11/09 · “Software is eating the world” 3 Challenges of the software economy need skilled people to build secure](https://reader036.fdocuments.us/reader036/viewer/2022081615/5fde534748c8937d3c33d5bb/html5/thumbnails/30.jpg)
30
No bad developers, please
![Page 31: Bad software is eating the world. - DefCamp 1/20161109...2016/11/09 · “Software is eating the world” 3 Challenges of the software economy need skilled people to build secure](https://reader036.fdocuments.us/reader036/viewer/2022081615/5fde534748c8937d3c33d5bb/html5/thumbnails/31.jpg)
31
Security is missing from education
![Page 32: Bad software is eating the world. - DefCamp 1/20161109...2016/11/09 · “Software is eating the world” 3 Challenges of the software economy need skilled people to build secure](https://reader036.fdocuments.us/reader036/viewer/2022081615/5fde534748c8937d3c33d5bb/html5/thumbnails/32.jpg)
32
security @ universities?
![Page 33: Bad software is eating the world. - DefCamp 1/20161109...2016/11/09 · “Software is eating the world” 3 Challenges of the software economy need skilled people to build secure](https://reader036.fdocuments.us/reader036/viewer/2022081615/5fde534748c8937d3c33d5bb/html5/thumbnails/33.jpg)
33
Practice labs are very costly
costly to build practice labs (infrastructure AND content)
![Page 34: Bad software is eating the world. - DefCamp 1/20161109...2016/11/09 · “Software is eating the world” 3 Challenges of the software economy need skilled people to build secure](https://reader036.fdocuments.us/reader036/viewer/2022081615/5fde534748c8937d3c33d5bb/html5/thumbnails/34.jpg)
34
it must be fun
![Page 35: Bad software is eating the world. - DefCamp 1/20161109...2016/11/09 · “Software is eating the world” 3 Challenges of the software economy need skilled people to build secure](https://reader036.fdocuments.us/reader036/viewer/2022081615/5fde534748c8937d3c33d5bb/html5/thumbnails/35.jpg)
35
Need practical, fun learning!
![Page 36: Bad software is eating the world. - DefCamp 1/20161109...2016/11/09 · “Software is eating the world” 3 Challenges of the software economy need skilled people to build secure](https://reader036.fdocuments.us/reader036/viewer/2022081615/5fde534748c8937d3c33d5bb/html5/thumbnails/36.jpg)
36
avatao High-quality, up-to-date
IT security exercises
![Page 37: Bad software is eating the world. - DefCamp 1/20161109...2016/11/09 · “Software is eating the world” 3 Challenges of the software economy need skilled people to build secure](https://reader036.fdocuments.us/reader036/viewer/2022081615/5fde534748c8937d3c33d5bb/html5/thumbnails/37.jpg)
37
Security tool tutorials
![Page 38: Bad software is eating the world. - DefCamp 1/20161109...2016/11/09 · “Software is eating the world” 3 Challenges of the software economy need skilled people to build secure](https://reader036.fdocuments.us/reader036/viewer/2022081615/5fde534748c8937d3c33d5bb/html5/thumbnails/38.jpg)
38
Hacking events (created in 5 mins)
![Page 39: Bad software is eating the world. - DefCamp 1/20161109...2016/11/09 · “Software is eating the world” 3 Challenges of the software economy need skilled people to build secure](https://reader036.fdocuments.us/reader036/viewer/2022081615/5fde534748c8937d3c33d5bb/html5/thumbnails/39.jpg)
39
Security for developers
![Page 40: Bad software is eating the world. - DefCamp 1/20161109...2016/11/09 · “Software is eating the world” 3 Challenges of the software economy need skilled people to build secure](https://reader036.fdocuments.us/reader036/viewer/2022081615/5fde534748c8937d3c33d5bb/html5/thumbnails/40.jpg)
40
Join our community to build secure software!
http://platform.avatao.com/defcamp2016
(open until Sunday, Nov 13)
Mark Felegyhazi w: http://avatao.com e: [email protected]
![Page 41: Bad software is eating the world. - DefCamp 1/20161109...2016/11/09 · “Software is eating the world” 3 Challenges of the software economy need skilled people to build secure](https://reader036.fdocuments.us/reader036/viewer/2022081615/5fde534748c8937d3c33d5bb/html5/thumbnails/41.jpg)
41
Security tools and fun adventures
Hands-on IT security challenges
Hands-on exams proving true skills
Expert community
Cost-effective training
Cloud-based virtual platform
KNOWLEDGE YOU NEED