Detecting security issues as fast as you making them

Presented at ToorCon San Diego 19 (2017), Sept. 3, 2017, 4:30 p.m. (20 minutes).

It is widely accepted that security mistakes are quicker and cheaper to fix the sooner they are identified after being introduced. With that as a guiding principle, DevSkim was developed to help identify certain insecure patterns as the developer is writing code within their IDE. Currently integrating with Visual Studio, Visual Studio Code, and Sublime, DevSkim is an open sourced extension that flags insecure patterns inline in the IDE, provides security guidance to explain the issue, and offers automatic fixes. DevSkim supports multiple programming and scripting languages, and its rules syntax makes adding a new rule for any language straightforward. The most effective security processes use layers of validation to identify and address security mistakes - DevSkim aims to be the first layer in that approach, complementing rather than replacing more time intensive build time Static Analysis, or post-build Dynamic Analysis.


Presenters:

  • Pavel Bansky
    I was not accepted into the soccer team at the age of seven, so I start spending more time with the Sinclair ZX Spectrum+ and learned programming. I never played nor watched soccer from that point on. Today I work as a security engineer at Microsoft Trustworthy Computing.

Links:

Similar Presentations: