Inferring and Securing Software Configurations using Automated Reasoning (Video, ESEC/FSE 2020)
"Inferring and Securing Software Configurations using Automated Reasoning (Video, ESEC/FSE 2020)
Paul Gazzillo
(University of Central Florida, USA)
Abstract: Software configurability opens the door to misconfiguration vulnerabilities, invalid settings that expose software weaknesses. Misconfiguration is one the top ten most critical security risks and the most common. This paper envisions a world without misconfiguration vulnerabilities through the use of automated reasoning techniques to infer and secure software configurations. Real-world software, however, often lacks an explicit specification of secure configurations, relying on hand-validation by users. Real-world systems comprise many individual highly-configurable software components, making the space of possible configurations for the whole system enormous. To realize our vision and overcome these challenges, we aim to create a rigorous definition of configuration specifications, use formal methods to mechanize the inference and generation of valid configurations, and develop algorithms to automatically secure against misconfiguration.
Article: https://doi.org/10.1145/3368089.3417041
ORCID: https://orcid.org/0000-0003-1425-8873
Submitted to the conference by Paul Gazzillo on 2020-10-31
Video Tags: software configuration, formal logic, configuration sampling, fse20vr-p6-p, DOI: 10.1145/3368089.3417041, ORCID: 0000-0003-1425-8873
Presentation at the ESEC/FSE 2020 conference, November 8–13, 2020, https://2020.esec-fse.org/
Sponsored by ACM SIGSOFT, https://www.sigsoft.org/
Twitter: / fseconf
Reddit: / esecfse "
ISSTA 2021: Panels Celebrating 30 editions of ISSTA (statements from panel in timeband 1)
ISSTA 2021: Panels Celebrating 30 editions of ISSTA (statements from panel in timeband 3)