Program analysis and programming languages for security

Abstract

The security of a software system is almost always retrofitted to an afterthought. When security problems arise, understanding and correcting them can be very challenging. On the one hand, the program-analysis and programming-languages research community has created numerous static and dynamic analysis tools for performance optimization and bug detection in object-oriented programs. On the other hand, the security and privacy research community has been looking for solutions to automatically detect security problems, information-flow violations, and access-control requirements in object-oriented programs. This tutorial discusses advantages and disadvantages of static and dynamic analysis for automated detection of security problems such as access-control violations and information-flow vulnerabilities. © 2008 Springer-Verlag Berlin Heidelberg.