We're sorry but this page doesn't work properly without JavaScript enabled. Please enable it to continue.
Feedback

Compiler Options Hardening for C and C++

Formale Metadaten

Titel
Compiler Options Hardening for C and C++
Serientitel
Anzahl der Teile
798
Autor
Mitwirkende
Lizenz
CC-Namensnennung 2.0 Belgien:
Sie dürfen das Werk bzw. den Inhalt zu jedem legalen Zweck nutzen, verändern und in unveränderter oder veränderter Form vervielfältigen, verbreiten und öffentlich zugänglich machen, sofern Sie den Namen des Autors/Rechteinhabers in der von ihm festgelegten Weise nennen.
Identifikatoren
Herausgeber
Erscheinungsjahr
Sprache

Inhaltliche Metadaten

Fachgebiet
Genre
Abstract
C and C++ are consistently the preferred languages for systems programming, embedded systems, and various performance-critical applications. C and C++ are also susceptible to various defects, such as memory-safety issues, that account for a significant portion of security vulnerabilities in C and C++ software. Addressing the memory-safety challenge has recently received new focus as leading cybersecurity organizations from various countries have collectively emphasized the significant risks posed by memory-safety issues. With the ubiquitous use of C and C++ in the embedded device, industrial controls, and IoT space, the chances of removing and replacing C and C++ are virtually nil. To improve software to be more memory-safe, a series of techniques will need to be undertaken to gradually evolve the quality and security of the code: migration to memory-safe alternatives, such as Rust, especially for critical software easier to use tooling for debugging, diagnostics and application security testing pro-active vulnerability mitigation and prevention in software though the use of compiler-based binary hardening mechanisms In November 2023, the Open Source Security Foundation (OpenSSF) published the Compiler Options Hardening Guide for C and C++ that is focused on helping developers make informed choices regarding compiler options to harden their software against prevalent software defects. Compiler flags are powerful tools that can significantly enhance the security of C and C++ code without requiring expensive refactoring or rewriting in newer, more memory-safe languages. Many such compiler features are also useful for discovering memory safety issues during debugging and testing. In this talk, Thomas will give an introduction to the OpenSSF Compiler Options Hardening Guide for C and C++. He will talk about how the guide came into existence in the OpenSSF, its current structure and future extensions. This talk particularly intends to actively invite feedback and call for collaboration.