Fighting Vulnerabilities With Process, Insight, and Automation

In this talk, I will discuss my journey in fighting vulnerabilities through the process of vulnerability modeling, discovery, assessment, and remediation. In each task of the process, we are often required to answer questions with binary answers such as “is there a vulnerability?”, “is the vulnerability exploitable?”, and “is the vulnerability patched?”. Even though the answer looks simple, it can be quite difficult to arrive at the right answer. This is because all of these questions require some unique thought process, some way of searching, or insights in general. These insights can come from both academia and the hacking community (e.g., regarding exploitation techniques). We bridge the gap by taking insights from both communities and feeding them into automated solutions. The talk will cover my experience practicing vulnerability research on both novel and known types of vulnerabilities.