Mudge Zatko and Sarah Zatko

### The Asymmetry of Software Security and Market Failure For decades, the software marketplace has suffered from severe information asymmetry: software consumers, enterprise procurement teams, and government agencies possess no objective, empirical method to verify the actual defensive robustness of the applications they purchase. Marketing claims, security compliance certifications, and vendor self-attestations fail to correlate with exploit resistance. In this presentation, legendary hacker and security executive Peiter "Mudge" Zatko and mathematician Sarah Zatko introduce the Cyber Independent Testing Lab (CITL), an independent, non-profit testing organization created to bring rigorous, empirical transparency to software security.

### Founding the Cyber Independent Testing Lab (CITL) CITL was established to replicate for software what organizations like Consumer Reports, Underwriters Laboratories (UL), and the National Highway Traffic Safety Administration (NHTSA) crash tests did for physical consumer goods and automotive safety. By analyzing binary executables at massive scale—evaluating over 38,000 off-the-shelf software binaries across Linux, macOS, and Windows—CITL aims to quantify the true cost and difficulty an attacker faces when attempting to exploit a given application. The lab combines automated static binary inspection with dynamic, high-throughput fuzz testing to produce standardized, comparative security ratings.

### Static Binary Analysis and Hygiene Measurement CITL's automated static analysis pipeline interrogates compiled binaries to measure the adoption of baseline compiler-level defensive mitigations and code hygiene: - **Binary Exploit Mitigations:** Evaluating whether binaries are compiled with Address Space Layout Randomization (ASLR / PIE), Data Execution Prevention (DEP / NX), and stack smashing protection (stack canaries). - **Unsafe C/C++ Function Heuristics:** Identifying the presence and density of historically dangerous, unbounded memory manipulation functions (such as `strcpy`, `strcat`, `gets`, and `sprintf`) versus modern safer alternatives (`strlcpy`, `strlcat`, `snprintf`). - **Compiler Hardening Adoption:** Tracking the utilization of compile-time fortification technologies, specifically examining how effectively vendors leverage `_FORTIFY_SOURCE` on Linux and macOS to automatically detect and arrest buffer overflows at runtime.

### Dynamic Crash Testing and Empirical Exploitation Scoring Static analysis alone cannot determine software stability; CITL pairs static metrics with automated dynamic fuzzing running in virtualized environments: - **Fault Density and Mutation Resilience:** Software binaries are subjected to high-volume mutation-based fuzzing to measure how quickly input variations trigger unhandled exceptions, memory faults, and application crashes. - **Exploitability Classification:** When crashes occur, CITL's triage engines categorize the underlying root cause—differentiating between benign termination faults and exploitable memory corruption states (such as controlled instruction pointer overwrites, write-what-where conditions, and heap corruptions). - **Mathematical Modeling:** Leveraging Bayesian statistics and linear regression, CITL constructs predictive models that estimate the total number of latent exploitable vulnerabilities in a binary based on its initial crash rate and code complexity metrics.

### Establishing Nutritional Labels for Consumer Software The ultimate vision of CITL is the creation of standardized, user-facing "nutritional labels" for software: - **Empirical Scoring Continuum:** Rather than binary "secure" or "insecure" certifications, CITL plots applications along a quantitative percentile continuum comparing them directly against industry peers (e.g., comparing web browsers against web browsers, or office productivity suites against each other). - **Economic Inversion:** By giving enterprise CISOs, consumer buyers, and cyber insurance underwriters quantifiable data, CITL creates economic incentives for vendors to invest in security engineering. When high-hygiene software can command higher market trust and lower insurance premiums, the economic balance fundamentally shifts in favor of defensive security.

(AI summary — Gemini 3.8 Flash)