1
00:00:00,000 --> 00:00:04,400
Okay, so we're diving into the world of secure software development.

2
00:00:04,400 --> 00:00:08,560
And you've given us a ton of info to unpack with these excerpts from 0-0 to

3
00:00:08,560 --> 00:00:11,600
Chris Demain 8-section2.pdf.

4
00:00:11,600 --> 00:00:13,680
Yeah, this stuffs everywhere these days, isn't it?

5
00:00:13,680 --> 00:00:17,040
You know, even if you don't write a line of code yourself, everyone's using software,

6
00:00:17,040 --> 00:00:19,680
and all that software, it needs to be secure.

7
00:00:19,680 --> 00:00:22,080
That's what we're going to dig into today.

8
00:00:22,080 --> 00:00:26,640
By the end of this deep dive, you'll be talking about classes and objects like a pro.

9
00:00:26,640 --> 00:00:29,760
Okay, so no coding boot camp required for our listeners then.

10
00:00:29,760 --> 00:00:34,560
Oh, like so this document jumps into the history of programming languages, which

11
00:00:34,560 --> 00:00:39,360
all be honest, consumer about is exciting is watching paint dry, but it's important stuff.

12
00:00:39,360 --> 00:00:41,360
It starts with machine language personally.

13
00:00:42,000 --> 00:00:45,040
0-0's and 1's just aren't my love language.

14
00:00:45,040 --> 00:00:47,040
Can imagine having to write out code like that.

15
00:00:47,040 --> 00:00:49,120
Yeah, it's a bit of a headscratcher to imagine, right?

16
00:00:49,120 --> 00:00:53,680
I mean, it's the earliest form of programming, but thankfully, it's a lot more well human

17
00:00:53,680 --> 00:00:54,720
readable these days.

18
00:00:54,720 --> 00:00:56,640
I think goodness for a simple language, right?

19
00:00:56,640 --> 00:01:01,680
At least that gave us commands like ADD. It's too pretty bare bones, but hey, it's a start.

20
00:01:01,680 --> 00:01:03,040
Right, baby steps.

21
00:01:03,040 --> 00:01:06,240
But then we made a big leap forward with high level languages, am I right?

22
00:01:06,240 --> 00:01:07,200
Yeah, you got it.

23
00:01:07,200 --> 00:01:10,480
Language is like foretran and cobalt really changed the game.

24
00:01:10,480 --> 00:01:13,440
Suddenly, you didn't have to be a computer whisperer to write code.

25
00:01:14,080 --> 00:01:19,120
And this is where things get juicy from a security angle, because high level languages brought us

26
00:01:19,120 --> 00:01:20,560
this huge shift.

27
00:01:21,200 --> 00:01:23,120
Object-oriented programming.

28
00:01:23,120 --> 00:01:25,920
We call it O-O-P-O-P.

29
00:01:25,920 --> 00:01:27,680
I think that term thrown around a lot.

30
00:01:27,680 --> 00:01:29,600
What makes it so revolutionary?

31
00:01:30,400 --> 00:01:33,680
It sounds like the best thing since sliced bread for software development,

32
00:01:33,680 --> 00:01:34,880
or is that an exaggeration?

33
00:01:34,880 --> 00:01:38,160
You know, exaggeration. Imagine if I don't know, imagine if you had to build a house, right?

34
00:01:38,160 --> 00:01:39,360
And I mean, build it from scratch.

35
00:01:39,920 --> 00:01:43,760
Every single brick, every plank of wood, that's kind of how programming was before O-O-P.

36
00:01:43,760 --> 00:01:48,000
Then O-P came along and it's like someone handed you pre-built walls, doors, windows.

37
00:01:48,000 --> 00:01:50,480
Okay, that makes way more sense than trying to bake code bricks.

38
00:01:50,480 --> 00:01:50,880
Mm-hmm.

39
00:01:50,880 --> 00:01:54,320
So O-O-P is all about like reusable components.

40
00:01:54,800 --> 00:01:55,360
Exactly.

41
00:01:55,360 --> 00:01:58,480
We call this components objects, they're the building blocks.

42
00:01:58,480 --> 00:02:02,240
And they're based on these things called classes, which are like blueprints.

43
00:02:02,240 --> 00:02:04,400
So let's say you're building a social media app.

44
00:02:04,400 --> 00:02:07,920
You might have a class for user that says, okay,

45
00:02:07,920 --> 00:02:11,760
a user needs a username, a password, maybe a profile picture.

46
00:02:11,760 --> 00:02:16,320
Then each new person who signs up, they become an object based on that class,

47
00:02:16,320 --> 00:02:17,760
with their own unique data.

48
00:02:17,760 --> 00:02:21,920
Makes sense. So instead of writing the same code over and over for each new user,

49
00:02:21,920 --> 00:02:26,000
you just create this blueprint and tweak it, saves time, keeps things organized.

50
00:02:26,000 --> 00:02:28,000
You're getting it, and that organization.

51
00:02:28,000 --> 00:02:29,360
That's key for security.

52
00:02:29,360 --> 00:02:33,680
This document we've got, it compares a well-designed program to a well-organized house.

53
00:02:33,680 --> 00:02:35,760
If everything's labeled in its place,

54
00:02:35,760 --> 00:02:39,360
way easier to find what you need, fix problems, keep things secure.

55
00:02:39,360 --> 00:02:40,320
Love that analogy.

56
00:02:40,320 --> 00:02:40,720
Okay.

57
00:02:40,720 --> 00:02:44,320
Okay, so O-O-P, I brought some order to the Wild West of early programming.

58
00:02:44,320 --> 00:02:45,440
What happened next?

59
00:02:45,440 --> 00:02:48,880
That, my friend, is where things get even more interesting.

60
00:02:48,880 --> 00:02:54,160
We're talking Python, C++, Java, languages that took those O-P principles

61
00:02:54,160 --> 00:02:56,320
and really, really ran with them.

62
00:02:56,320 --> 00:02:58,800
They made code cleaner, more efficient.

63
00:02:58,800 --> 00:03:02,000
Suddenly, you could build much more complex software.

64
00:03:02,000 --> 00:03:06,000
It's mind-blowing how these languages evolve to handle such complexity.

65
00:03:06,000 --> 00:03:07,280
You know, it is, isn't it?

66
00:03:07,280 --> 00:03:10,800
But of course, with great power comes great responsibility, right?

67
00:03:10,800 --> 00:03:11,760
Always.

68
00:03:11,760 --> 00:03:16,480
And speaking of responsibility, this document dies into some really crucial concepts

69
00:03:16,480 --> 00:03:18,960
for building secure software.

70
00:03:18,960 --> 00:03:22,960
There's this one part that talks about cohesion and coupling.

71
00:03:22,960 --> 00:03:26,560
Honestly, those words always make me think of like a high school physics class,

72
00:03:26,560 --> 00:03:27,520
which I barely passed.

73
00:03:27,520 --> 00:03:29,200
Can you break those down from me and plain English?

74
00:03:29,200 --> 00:03:29,840
Definitely.

75
00:03:29,840 --> 00:03:32,080
It's actually a lot less intimidating than it sounds.

76
00:03:32,080 --> 00:03:33,440
Think of it like building a car right.

77
00:03:33,440 --> 00:03:35,840
You want all the parts to work together, obviously.

78
00:03:35,840 --> 00:03:40,640
But you don't want one loose screw in the engine to make the whole thing fall apart on the highway.

79
00:03:40,640 --> 00:03:42,400
Okay, terrifying analogy.

80
00:03:42,400 --> 00:03:43,600
Yeah. But I get your point.

81
00:03:43,600 --> 00:03:46,480
So how does that apply to building secure systems?

82
00:03:46,480 --> 00:03:50,800
So cohesion, that's all about how well the different parts

83
00:03:50,800 --> 00:03:54,640
within a module, like one specific part of the system, how well they all work together,

84
00:03:54,640 --> 00:03:59,200
you want high cohesion, like a well organized toolbox, every tool has a purpose, right?

85
00:03:59,200 --> 00:04:02,960
So it's about creating those focus modules, everything in its place.

86
00:04:02,960 --> 00:04:04,800
What about coupling then?

87
00:04:04,800 --> 00:04:09,120
Coupling is more about how much those different modules depend on each other.

88
00:04:09,120 --> 00:04:11,280
Ideally, you want low coupling.

89
00:04:11,280 --> 00:04:15,920
Meaning changes in one module, shouldn't cause a domino effect and mess up a bunch of others.

90
00:04:15,920 --> 00:04:20,000
Going back to the car, you wouldn't want your brakes to stop working if the radio glitches out

91
00:04:20,000 --> 00:04:20,720
would you?

92
00:04:20,720 --> 00:04:22,000
I mean, I really wouldn't.

93
00:04:22,000 --> 00:04:27,760
So high cohesion well defined modules, low coupling clear boundaries between them.

94
00:04:27,760 --> 00:04:28,800
Got it.

95
00:04:28,800 --> 00:04:31,280
But how does that actually make this software more secure?

96
00:04:31,280 --> 00:04:32,320
Think of it this way.

97
00:04:32,320 --> 00:04:36,080
When your code is well organized, high cohesion, low coupling,

98
00:04:36,080 --> 00:04:39,920
it's just easier to understand, easier to test, vulnerabilities.

99
00:04:39,920 --> 00:04:43,600
They're way less likely to slip through the cracks because you can actually see how everything

100
00:04:43,600 --> 00:04:44,080
connects.

101
00:04:44,080 --> 00:04:45,040
Makes sense.

102
00:04:45,040 --> 00:04:49,440
It's like it's easier to find a rogue sock in a perfectly organized drawer than in a huge

103
00:04:49,440 --> 00:04:50,720
messy pile of laundry.

104
00:04:51,440 --> 00:04:52,480
Exactly.

105
00:04:52,480 --> 00:04:58,160
And if a problem does pop up, it's way easier to fix it without breaking something else in the process.

106
00:04:58,160 --> 00:05:00,800
Now there's another concept the stock mint touches on.

107
00:05:00,800 --> 00:05:02,080
Polyonstantiation.

108
00:05:02,800 --> 00:05:04,000
It's mouthful, I know.

109
00:05:04,000 --> 00:05:05,280
Polyinstit what?

110
00:05:05,280 --> 00:05:07,440
Yeah, that one sounds a little intimidating, not gonna lie.

111
00:05:07,440 --> 00:05:09,200
Don't worry, it's not as scary as it sounds.

112
00:05:09,200 --> 00:05:11,600
It's all about keeping sensitive information safe.

113
00:05:12,720 --> 00:05:15,520
Imagine a database, right, with employee information.

114
00:05:15,520 --> 00:05:19,760
Polyonstantiation lets you have multiple versions of that data,

115
00:05:19,760 --> 00:05:22,240
but each version has different security levels.

116
00:05:22,240 --> 00:05:24,640
This is kind of like some people see the basic info.

117
00:05:24,640 --> 00:05:26,000
Others get the top secret stuff.

118
00:05:26,000 --> 00:05:26,800
You got it.

119
00:05:26,800 --> 00:05:30,320
Someone in HR might need access to salary details, but someone in marketing.

120
00:05:31,520 --> 00:05:32,720
Not so much.

121
00:05:32,720 --> 00:05:36,960
It's like having different levels of security clearance for accessing stuff within a system.

122
00:05:36,960 --> 00:05:40,400
Clever. So it helps you control exactly who sees what?

123
00:05:40,400 --> 00:05:44,800
Speaking of accessing control, this document goes deep on developer tools,

124
00:05:44,800 --> 00:05:47,360
starting with integrated development environments.

125
00:05:48,080 --> 00:05:50,240
I think I've heard those called IDEs, right?

126
00:05:50,240 --> 00:05:53,840
What are some super exclusive developer club?

127
00:05:53,840 --> 00:05:54,640
Not exactly.

128
00:05:54,640 --> 00:05:58,880
Think of it as a developer's super power tool box and IDE.

129
00:05:58,880 --> 00:06:02,720
It's a single platform where they can write their code, test it, find the bugs,

130
00:06:02,720 --> 00:06:06,720
you name it, and there's seriously advanced these days that can even help with things like

131
00:06:06,720 --> 00:06:08,160
security analysis.

132
00:06:08,160 --> 00:06:10,960
So it's like the ultimate productivity hack for programmers.

133
00:06:10,960 --> 00:06:11,520
Yeah.

134
00:06:11,520 --> 00:06:17,040
But with all of those features, are there security concerns with IDEs themselves?

135
00:06:17,040 --> 00:06:18,560
Could they be a vulnerability?

136
00:06:18,560 --> 00:06:20,240
You're thinking like a security pro.

137
00:06:20,240 --> 00:06:21,920
That's a great question.

138
00:06:21,920 --> 00:06:23,680
Now IDEs themselves.

139
00:06:23,680 --> 00:06:25,680
Generally, very secure.

140
00:06:25,680 --> 00:06:28,800
This document, though, it points out a potential issue.

141
00:06:28,800 --> 00:06:32,320
It's the plugins, the add-ons that developers sometimes use.

142
00:06:32,320 --> 00:06:36,080
If those aren't from trusted sources, if they're not kept updated,

143
00:06:36,080 --> 00:06:37,680
that's where things can get dicey.

144
00:06:37,680 --> 00:06:40,000
So it's like adding fancy features to your car.

145
00:06:40,000 --> 00:06:43,680
Gotta make sure those additions don't actually make it less safe, right?

146
00:06:43,680 --> 00:06:45,600
It's not just having the tools as using them carefully.

147
00:06:46,720 --> 00:06:47,840
Okay, so let's shift gears a bit.

148
00:06:47,840 --> 00:06:50,080
Let's talk code repositories and version control.

149
00:06:50,080 --> 00:06:53,280
I know there are these platforms get up being one, but I'll be honest,

150
00:06:53,280 --> 00:06:54,560
there are a bit of a mystery to me.

151
00:06:54,560 --> 00:06:59,440
I like to think of them as the collaborative heart of software development.

152
00:06:59,440 --> 00:07:02,240
It's where developers come together to work on projects.

153
00:07:02,240 --> 00:07:06,320
These platforms track every single change made to the code.

154
00:07:06,320 --> 00:07:10,400
It's like imagine multiple people trying to edit the same document at the same time.

155
00:07:10,960 --> 00:07:12,720
Recipes for disaster, right?

156
00:07:12,720 --> 00:07:13,680
Version control.

157
00:07:13,680 --> 00:07:14,720
That's our saving grace.

158
00:07:14,720 --> 00:07:19,840
So it's like having a detailed history of every edit every tweak to a document.

159
00:07:19,840 --> 00:07:20,880
Okay, that makes sense.

160
00:07:20,880 --> 00:07:26,720
But how does this relate to secure software for the average person?

161
00:07:26,720 --> 00:07:28,800
Ah, that is the million dollar question.

162
00:07:28,800 --> 00:07:34,080
So these code repositories, especially the ones that host open source software, they're incredible.

163
00:07:34,080 --> 00:07:35,120
It's all about sharing.

164
00:07:35,120 --> 00:07:37,680
Developers can share code, build on each other's work,

165
00:07:37,680 --> 00:07:40,720
is how innovation happens fast, but of course there's a flip side.

166
00:07:40,720 --> 00:07:44,080
Let me guess open source code isn't always squeaky clean.

167
00:07:44,080 --> 00:07:49,680
Exactly. It's not always intentional, but sometimes vulnerabilities can sneak into open source components.

168
00:07:49,680 --> 00:07:53,280
And if those components end up in other software without anyone checking,

169
00:07:53,280 --> 00:07:55,840
those vulnerabilities, they spread like wildfire.

170
00:07:55,840 --> 00:08:00,400
Yikes, like a bad batch of ingredients ending up in a whole bunch of cakes.

171
00:08:00,400 --> 00:08:05,200
So how do we avoid that recipe for disaster?

172
00:08:05,200 --> 00:08:07,680
That's where the next piece of the puzzle comes in.

173
00:08:07,680 --> 00:08:09,840
Application security testing.

174
00:08:09,840 --> 00:08:14,160
We're talking about rigorously testing software throughout its entire existence.

175
00:08:14,160 --> 00:08:19,120
From the moment it's just an idea, it's like having a dedicated team of taste testers,

176
00:08:19,120 --> 00:08:24,400
making absolutely sure that software is safe to use, no nasty surprises.

177
00:08:24,400 --> 00:08:27,440
Okay, so we got our taste testers. What are they actually doing?

178
00:08:27,440 --> 00:08:31,600
The document mentions a bunch of different testing methods, but honestly it's an alphabet soup.

179
00:08:31,600 --> 00:08:32,240
Ah.

180
00:08:32,240 --> 00:08:34,960
Sask, date, dastery, it dastery, it what does it all mean?

181
00:08:34,960 --> 00:08:36,880
Right, it's like a secret code, isn't it?

182
00:08:36,880 --> 00:08:38,160
Don't worry, I'm here to decode.

183
00:08:38,160 --> 00:08:38,720
Please do.

184
00:08:38,720 --> 00:08:42,320
Okay, so sask that stands for static application security testing.

185
00:08:42,320 --> 00:08:48,480
It's all about examining the source code itself, like looking for weaknesses in the blueprint before you even start building.

186
00:08:48,480 --> 00:08:52,480
So no fancy software simulations just looking at the raw code.

187
00:08:52,480 --> 00:08:55,120
Pretty much, it's a very meticulous process,

188
00:08:55,120 --> 00:08:59,440
analyzing the code, line by line to find any security flaws,

189
00:08:59,440 --> 00:09:03,200
and then you've got dast dynamic application security testing.

190
00:09:03,200 --> 00:09:07,360
This one's more like taking the software for a spin, seeing how it behaves in the while.

191
00:09:07,360 --> 00:09:11,600
So if sask is checking the recipe, dast is tasting the final dish.

192
00:09:11,600 --> 00:09:13,360
Exactly, great analogy.

193
00:09:13,360 --> 00:09:16,880
And then there's IASTS or interactive application security testing.

194
00:09:16,880 --> 00:09:20,880
It's like having a security camera running inside your software 247,

195
00:09:20,880 --> 00:09:22,480
watching every little thing that happens.

196
00:09:22,480 --> 00:09:25,600
Okay, so it's the most, I don't know, vigilant of the three.

197
00:09:25,600 --> 00:09:26,880
You could say that.

198
00:09:26,880 --> 00:09:31,600
IASTS gives you real-time feedback tells you exactly where a vulnerability might be hiding in the code.

199
00:09:32,320 --> 00:09:36,080
And there's one more acronym to add to the mix, even though it's not a testing method itself,

200
00:09:36,080 --> 00:09:39,040
SCA or software composition analysis.

201
00:09:39,040 --> 00:09:41,680
It's all about securing the software supply chain.

202
00:09:41,680 --> 00:09:43,520
Okay, this is where I get lost.

203
00:09:43,520 --> 00:09:44,400
Supply chain.

204
00:09:44,400 --> 00:09:47,680
Remember, we were talking about those open source components and the risks they can bring?

205
00:09:47,680 --> 00:09:49,360
That's where SCA comes in.

206
00:09:49,360 --> 00:09:54,560
These tools scam through the code and identify every single third-party library,

207
00:09:54,560 --> 00:09:58,240
every component, imagine it like a background check for your software.

208
00:09:58,240 --> 00:10:01,920
Making sure none of the ingredients are expired or something.

209
00:10:01,920 --> 00:10:05,280
Exactly. SCA helps make sure that everything's on the up and up.

210
00:10:05,280 --> 00:10:08,800
That you're using those open source components safely and legally.

211
00:10:08,800 --> 00:10:12,560
It's all connected secure code, secure component, secure systems.

212
00:10:12,560 --> 00:10:14,080
It's a team effort.

213
00:10:14,080 --> 00:10:16,080
Yeah, sounds like it's like building a house.

214
00:10:16,080 --> 00:10:20,640
You know, you need strong walls, a sturdy roof, a good security system.

215
00:10:20,640 --> 00:10:22,400
You can't just focus on one thing.

216
00:10:22,400 --> 00:10:25,040
Exactly. Building secure software.

217
00:10:25,040 --> 00:10:26,720
It's not a one-and-done thing.

218
00:10:26,720 --> 00:10:31,120
It's something you gotta think about every step of the way from the initial design to the ongoing

219
00:10:31,120 --> 00:10:32,000
maintenance.

220
00:10:32,000 --> 00:10:33,840
And it's not just on the developers.

221
00:10:33,840 --> 00:10:37,440
Everyone involved has a role to play and making sure things are secure.

222
00:10:38,160 --> 00:10:43,040
This deep dive has definitely given me a whole new appreciation for how complex this all is.

223
00:10:43,040 --> 00:10:47,760
And how important it is. We've gone from like the birth of programming languages to

224
00:10:47,760 --> 00:10:49,600
testing and everything in between.

225
00:10:49,600 --> 00:10:52,000
It's clearly not just for techies anymore.

226
00:10:52,000 --> 00:10:55,200
You got it. We all rely on technology every single day.

227
00:10:55,200 --> 00:11:00,000
So the more we know about how it works, the potential risks, the better choices we can make.

228
00:11:00,000 --> 00:11:04,480
It's all about staying informed and advocating for systems that are, well,

229
00:11:04,480 --> 00:11:06,160
systems we can actually trust.

230
00:11:06,160 --> 00:11:07,280
Couldn't agree more.

231
00:11:07,280 --> 00:11:09,840
Well, thank you so much for joining me for this deep dive.

232
00:11:09,840 --> 00:11:11,600
This has been an incredible conversation.

233
00:11:11,600 --> 00:11:14,960
My pleasure. I'll always happy to geek out about secure software.

234
00:11:14,960 --> 00:11:18,720
And to everyone listening, thanks for sticking with us on this journey into the world of

235
00:11:18,720 --> 00:11:20,800
secure software development.

236
00:11:20,800 --> 00:11:23,760
Remember, a little knowledge goes a long way.

237
00:11:23,760 --> 00:11:43,920
Until next time, stay curious out there.