Make It Fixable
CppCon 2018
Patricia Aas, 25 September 2018
From experience we have learned that almost any surface we expose could have weaknesses. We have to have a plan on how to deal with issues as they arise, and an architecture that allows us to correct and protect in products that are already in use. When security is lifted up to the discretion of the user, however, we often fail to inform their decision properly. The usability of security and the architecture of fixability are closely connected, and both need continued refinement and focus. This talk will describe architectural and organizational features that make it easier to make corrective measures. They are down-to-earth everyday scenarios, illustrated by real world software projects and security incidents. Some of the stories are well known, some are anonymized to protect the innocent. Finally we will show examples of how difficult it is to design the user experience of security.
“This session will feature four panelists who have extensive experience in designing systems that have to work securely in an insecure world. Two of the panelists have multiple decades defending everything from operating systems to networks to sensitive military systems from attackers.”