Hands-On Security in DevOps

Secure compiling

Memory corruption and buffer overflow may result in exploit code injection attacks. For the C/C++ programming language, these can be protected by compiler options. By a properly secured configuration of a C/C++ compiler (GCC, MS Visual Studio), the application will be able to add an additional layer of runtime defenses against exploit code injection attacks. These are also mostly ignored by a development team. The common secure options are summarized in the following table:

Protection techniques	Secure options	OS/Compiler
Address Space Layout Randomization (ASLR)	echo 1 >/proc/sys/kernel/randomize_va_space	Android, Linux OS
Stack-based buffer overrun protection	-fstack-protector –fstack-protector-all ...