Cookies Policy
We use strictly necessary cookies whilst you are here. These are to enable the website to work and cannot be disabled. To read more about what this means, please see our Privacy Policy.Arachne
June 28, 2024
Introduction
Memory Safety
The Arachne Digital mission has always been to create innovative and secure software solutions that empower our users and protect their data.
Why Memory Safety Matters
Memory safety vulnerabilities are among the most prevalent and severe issues in the software industry. These vulnerabilities arise when programming languages that do not manage memory automatically (such as C and C++) allow developers to make errors in memory handling, leading to potential exploits like buffer overflows and use-after-free errors. These exploits can compromise software integrity, leading to data breaches, system crashes, and other critical failures.
Recent studies highlight the widespread nature of these vulnerabilities:
- Prevalence of Memory Unsafe Code: Analysis of 172 critical open source projects showed that 52% contain code written in memory-unsafe languages, with 55% of the total lines of code being memory-unsafe.
- Dependency Risks: Even projects primarily written in memory-safe languages often depend on components written in memory-unsafe languages, posing hidden security risks.
You can read more about memory safe languages here.
Given these challenges, transitioning to memory safe programming languages is not just a technical necessity but a strategic imperative. Memory safe languages like Rust, Go, and Swift automatically handle memory management, significantly reducing the risk of memory-related vulnerabilities. By adopting these languages, we can enhance the security, reliability, and maintainability of our software, ultimately delivering safer products to our users.
Our Plan for Thread and Tracery
To ensure the highest standards of security for Thread and Tracery, we are embarking on a comprehensive project to develop memory safe roadmaps for both. This process involves several critical steps:
Comprehensive Codebase Audit
- Identify Memory-Unsafe Code: We will conduct a thorough audit of the Thread and Tracery codebases to identify all instances of memory-unsafe code.
- Catalogue Dependencies: We will list all third-party libraries and dependencies, noting which ones are written in memory-unsafe languages.
Software Architecture and Critical Components
- Map the Architecture: Understanding the overall architecture of Thread and Tracery, including major components and their interactions, will help us identify security-critical and performance-critical areas.
- Prioritise Components: We will prioritise the components that handle sensitive data or are frequently targeted by attacks for migration to memory safe languages.
Current Mitigation Strategies
- Review Existing Measures: We will document and assess current security practices, such as the use of static and dynamic application security testing (SAST/DAST) tools, code reviews, and secure coding guidelines.
- Evaluate Memory Safety Measures: We will evaluate existing measures specifically targeting memory safety and identify areas for improvement.
Development Practices and Tools
- Analyse the Development Workflow: Understanding the current development workflow, including CI/CD practices, testing frameworks, and deployment processes, will help us integrate memory safe practices effectively.
- Assess Tool Compatibility: We will identify the tools currently used for development, testing, and deployment and their compatibility with memory safe programming languages.
Team Expertise and Training Needs
- Evaluate Developer Skills: We will assess the current skill set of our development team regarding memory safe languages.
- Plan Training Programs: Based on our assessment, we will develop training programs to upskill our team in memory safe programming practices.
Long-term Goals and Constraints
- Align with Business Objectives: We will ensure that our memory safe roadmap aligns with Arachne Digital’s long-term goals and customer expectations.
- Consider Resource Constraints: Identifying budget, time, and personnel constraints will help us create a realistic and achievable roadmap.
Moving Forward
Developing memory safe roadmaps for Thread and Tracery is a complex but crucial endeavour. By systematically addressing each step and gathering the necessary information, we can create memory safe roadmaps for both our products. This allows Arachne Digital to make informed decisions that enhance the security and reliability of our software.
We believe that investing in memory safety is an investment in the future of secure, resilient software. We are committed to leading the way in adopting memory safe programming practices and invite our community to join us on this journey. Together, we can build a safer digital world.
Stay tuned for more updates as we progress on this important initiative!
Benefits
Why select Arachne?
Our platform searches the internet for information on threat actors, gathers reports, and categorises the findings by region, industry, and threat actor. Our process automatically maps TTPs to MITRE ATT&CK®, slashing research time and saving you money.
Testimonials & Partnerships
“Arachne Digital’s team works closely with us in integrating our tool, Speculo, with their data. Speculo is designed to help organisations get a full picture of their cyber risk with reliable analytics and a streamlined risk assessment process. The integration of Arachne Digital’s threat intelligence into Speculo provides evidence-based insights into cyber risks, making the tool more relevant to our customers. Arachne facilitated multiple face-to-face meetings and video calls, provided technical resources, comprehensive documentation, and example reports. This collaboration ensured that we could seamlessly integrate and utilize their data, significantly enriching the value we deliver to our clients.
Arachne Digital’s commitment to excellence and their proactive approach in supporting our needs have made them an indispensable partner. We highly recommend their services to any organisation looking to strengthen their threat intelligence capabilities.”
Speculo
Partnership
Arachne Digital is proud to partner with the DISARM Foundation as the inaugural member of their Partner Programme, launched at the beginning of 2024.
This partnership is crucial in supporting the DISARM Foundation’s mission to maintain and enhance the DISARM Framework, ensuring it remains a free and continuously updated resource in the fight against disinformation.
Through our collaboration, Arachne Digital provides valuable feedback, promotes the integration of the framework into our operations, and encourages wider adoption within the defender community. This partnership highlights our commitment to combating evolving threats and fostering a secure digital environment.
