Defending Rust is a course designed to provide you with a comprehensive understanding of how to defend Rust applications against various security threats.
Course Learning Objectives
This course has been designed to provide you with a comprehensive understanding of how to defend Rust applications against various security threats. In module one, we’ll explore the growing role of Rust in the software industry, focusing on its performance demands, safety features, and potential risks.
In module two, we’ll delve into securing the development environment, covering topics such as managing Rust versions, verifying the toolchain, and best practices with Clippy and rustfmt. In module three, we’ll discuss safe memory management, including identifying memory vulnerabilities, preventing leaks, and managing sensitive data.
In module four, we’ll look at secure programming patterns, addressing issues like integer overflows, panics, recoverable errors, and the proper use of unsafe code. Finally, in module five, we’ll examine the importance of protecting the supply chain, emphasizing crate safety, cargo audits, reproducible builds, and package vetting.
Description
Defending Rust is a course tailored for Rust developers and testers who seek to enhance their knowledge of secure coding practices in Rust. This course offers an in-depth look at the security features of Rust, the best practices for maintaining a secure development environment, and techniques for safe memory management.
As Rust continues to gain traction for its performance and safety, understanding how to mitigate security risks becomes crucial. This course equips you with the skills to implement secure programming patterns and safeguard the supply chain, ensuring robust and secure Rust applications.
| Audience | Time Required |
|---|---|
| Rust Developers Testers | Tailored learning – 90 minutes total |
Course Outline
1. Introducing Rust
- The growing role of Rust
- Raw code performance demands
- Evaluating Rust
- Secure Rust
- Find a matching programming language
- Rust safety features
- Rust’s safeguards
- Compile-time checks
- Risks in Rust
- Unsafe Rust code
- Insecure application logic
- Maturity of the ecosystem
- Online package registry
2. Securing the Development Environment
- Managing Rust versions
- Verifying the toolchain
- Code sample: Verifying the toolchain
- Rust editions
- Rust CVEs
- Linting with Clippy
- Code sample: Clippy
- Disable Clippy rules
- Clippy best practices
- Formatting with rustfmt
- Rustfmt best practices
3. Safe Memory Management
- Memory vulnerabilities
- Memory safety
- Memory leaks
- Don’t use forget()
- Avoid circular references
- Other types of memory leaks
- The drop trait
- Drop best practices
- Sensitive data in memory
- Clearing memory
4. Secure Programming Patterns
- Best practices in Rust
- Integer overflows
- Safe overflows
- Panics
- Recoverable errors
- Unsafe Rust code
- Using unsafe code
- Best practices with unsafe code
- External functions
- Using wrappers
- Type safety
5. Protecting the Supply Chain
- Understanding crates
- Crate safety
- Cargo-audit
- Reproducible builds
- Cargo version policy
- Cargo-outdated
- Vetting packages