Skip to main content

Rust Foundation outlines many improvements to the language’s security structure

The Rust Foundation outlined many improvements to the security structure of the language and expressed its commitment to developing tools, features, and recommendations based on security research in its Security Initiative Report

The Rust advancements follow the White House’s National Cybersecurity Strategy Implementation Plan that signals a deep civic investment in more secure programming languages like Rust and how popular, growing languages that are perceived as “secure” need to work swiftly to address security gaps in the midst of this wider adoption.

One of the core pillars of the strategy is to “promote open-source software security and the adoption of memory-safe programming languages.” Among these languages, Rust is one of the fastest-growing and most used memory-safe options. 

The Rust Foundation initiated an audit of the state of security within the Rust ecosystem that  will allow both the Rust Foundation and project to anticipate risks better and define how security can be economically maintained on an ongoing basis.

This year, the Rust team aimed to enhance insights into crate security and emphasize information related to it. Their current focus is on software supply chain security, and they are working collaboratively with the Rust Foundation and crates.io teams. Their efforts involve revealing individual crate security information, including assessments for leaked secrets, identifying malicious crates, and creating security best practices scoring models.

So far, the team has not encountered any actively malicious crates. However, they have discovered several cases of leaked credentials, and they have taken proactive steps to reach out to the affected crate owners and address the issue, according to the report.

Also, threat modeling exercises have been conducted by the Rust Foundation and Rust Project to gain a deeper understanding of the risks highlighted in the Security Audit. The development of four distinct threat models involved collaboration with various internal teams, including the crates.io Team, Infrastructure Team, Security Response Working Group, and Secure Code Working Group, as well as external stakeholders. The details of all these threat models are expected to be shared with the community in the near future.

 

The post Rust Foundation outlines many improvements to the language’s security structure appeared first on SD Times.



from SD Times https://ift.tt/hwKRCfu

Comments

Popular posts from this blog

A guide to data integration tools

CData Software is a leader in data access and connectivity solutions. It specializes in the development of data drivers and data access technologies for real-time access to online or on-premise applications, databases and web APIs. The company is focused on bringing data connectivity capabilities natively into tools organizations already use. It also features ETL/ELT solutions, enterprise connectors, and data visualization. Matillion ’s data transformation software empowers customers to extract data from a wide number of sources, load it into their chosen cloud data warehouse (CDW) and transform that data from its siloed source state, into analytics-ready insights – prepared for advanced analytics, machine learning, and artificial intelligence use cases. Only Matillion is purpose-built for Snowflake, Amazon Redshift, Google BigQuery, and Microsoft Azure, enabling businesses to achieve new levels of simplicity, speed, scale, and savings. Trusted by companies of all sizes to meet...

Olive and NTT DATA Join Forces to Accelerate the Global Development and Deployment of AI Solutions

U.S.A., March 14, 2021 — Olive , the automation company creating the Internet of Healthcare, today announced an alliance with NTT DATA , a global digital business and IT services leader. The collaboration will fast track the creation of new healthcare solutions to transform the health experience for humans — both in the traditional healthcare setting and at home. As a member of Olive’s Deploy, Develop and Distribute Partnership Programs , NTT DATA is leveraging Olive’s open platform to innovate, build and distribute solutions to Olive’s customers, which include some of the country’s largest health providers. Olive and NTT DATA will co-develop new Loops — applications that work on Olive’s platform to provide humans real-time intelligence — and new machine learning and robotic process automation (RPA) models. NTT DATA and Olive will devote an early focus to enabling efficiencies in supply chain and IT, with other disciplines to follow. “This is an exciting period of growth at Olive, so...

2022: The year of hybrid work

Remote work was once considered a luxury to many, but in 2020, it became a necessity for a large portion of the workforce, as the scary and unknown COVID-19 virus sickened and even took the lives of so many people around the world.  Some workers were able to thrive in a remote setting, while others felt isolated and struggled to keep up a balance between their work and home lives. Last year saw the availability of life-saving vaccines, so companies were able to start having the conversation about what to do next. Should they keep everyone remote? Should they go back to working in the office full time? Or should they do something in between? Enter hybrid work, which offers a mix of the two. A Fall 2021 study conducted by Google revealed that over 75% of survey respondents expect hybrid work to become a standard practice within their organization within the next three years.  Thus, two years after the world abruptly shifted to widespread adoption of remote work, we are dec...