161 - Christoph Kern

On Episode 161 of the Silver Bullet Security Podcast, BIML’s Gary McGraw hosts Christoph Kern. Christoph talks about software security by construction and the importance of architecture, wiping out entire classes of bugs at Google, why mixing control and data in one untyped token stream is rather silly,  agentic AI security from tool wielders to massive swarms.  We end on a positive note, by emphasizing the important of human intuition, ingenuity and insight to architectural beauty. Silver Bullet episode 100: IEEE Center for Secure Design [https://apothecaryshed.files.wordpres...] Christoph Kern - Google Research [https://research.google/people/christ...] Secure by Design at Google [https://research.google/pubs/secure-b...] IEEE Center for Secure Design Avoiding the Top Ten Software Security Design Flaws [http://bit.ly/ieee-CSD-gem] 00:00 Introduction to Machine Learning Security Podcast 00:34 Interview with Christoph Kern 00:49 From Bug Hunting to Secure by Design 01:39 Evolution of Security by Design 02:54 Starting New Projects with Security by Design 03:54 Transitioning Legacy Systems to Secure Frameworks 05:22 Challenges in Transitioning C++ Codebases 06:44 Reducing Vulnerabilities in Legacy Systems 08:09 Role of Advanced Type Systems in Security 09:08 Securing LLM Systems 12:51 Designing Security Boundaries for Agent Systems 18:22 Emergent Behaviors in Multi-Agent Systems 20:36 Human Engineers and Autonomous Systems 22:12 Ensuring Critical System Invariants 26:53 Machine Verification in System Security 32:53 Conclusion and Further Resources