Bonnes pratiques de cybersécurité pour le développement logiciel

Oct 16, 2018·
Olivier D'Hénin
,
Franck Sadmi
Florian Stosse
Florian Stosse
,
Florent Kirchner
· 1 min read
Abstract
Avec l’émergence de la problématique « cybersécurité » dans le domaine industriel et l’importance croissante du développement logiciel pour les domaines de rupture (IoT, Industrie 4.0, nouvelles mobilités, etc.), Bureau Veritas, en partenariat avec le CEA-List a souhaité concentrer dans un guide unique l’ensemble des bonnes pratiques en matière de développement logiciel sécurisé pour l’industrie.
Type
Publication
21e Congrès de Maîtrise des Risques et Sûreté de Fonctionnement (λµ21)
publication

Presented at the 21e Congrès de Maîtrise des Risques et Sûreté de Fonctionnement (λµ21) in Reims, France, 16-18 October 2018.

English Title & Summary

Guidelines for secure software development

With the emerging concerns about industrial cybersecurity and the ever-growing importance of software development for innovative fields (IoT, smart factory …), Bureau Veritas and its partner CEA-List have developed state of the art guidelines on best practices applied to secure software development for industrial users.

Software Security Cybersecurity Industrial Systems Best Practices
Florian Stosse
Authors
Florian Stosse
Cybersecurity engineer

About Me

Hi, I’m Florian Stosse, just another information security engineer !

Current work

I currently work at the European Space Agency, as a cybersecurity engineer for the Galileo programme, specifically for the Galileo Mission Segment (GMS).

Experience summary

I previously worked at Safran Data Systems, in the Space & Communications business unit. I focused on hardening and securing our embedded Windows 7 and 10/11 platforms (Cortex family of TT&C and high data rate receivers), among other cool things :)

Before that, in October 2018, I started a PhD thesis at CEA-List and ANSSI to work on formal methods applied to software security. More specifically, I was working on software defenses and hardening against hardware vulnerabilities, such as Spectre and Meltdown, using sound static analysis tools (Frama-C in particular).

My thesis was under the supervision of Julien Signoles (CEA), and my advisors were Patricia Mouy (ANSSI) and Florent Kirchner (CEA).

Unfortunately, we had to put a stop to the thesis, but hey, that’s life !

Education summary

I graduated with a M.Sc in Computer Science (major in cybersecurity, minor in embedded systems) from ESIEA Paris (a top French engineering school, part of the “Grandes écoles”) in August 2018. During my graduate studies, I was an apprentice at Bureau Veritas’ R&D center in La Défense, Paris.

I worked in the RAMS department, and my main areas of work were:

  • software security (e.g. static analysis, SDLC),
  • connected/autonomous vehicles security (e.g. ISO 21434 for automotive security engineering),
  • and industrial systems security (e.g. ISO 62443 certification).

Do not hesitate to get in touch if you want to chat about these topics (or anything else, really) !