Tools and trade-offs for security adaptation

从网络浏览器到工业控制系统，软件越来越容易受到原本设计不能防御的攻击。随着应用程序要求的复杂性增加，开发人员将来自自己代码的不同来源的模块合并到恶意的互联网连接环境中，将新的攻击载体引入广泛部署的系统。例如，开源的FFmpeg项目允许用户操作和转换各种格式的音频/视频内容。多年来，用户一直在自己的电脑上信任FFmpeg，但当集成到Chrome Web浏览器并暴露于互联网上的任意内容时，1000多个以前未被检测到的安全漏洞被曝光。工业控制系统(ICS)结合了第三方软件以提供Web界面等现代功能，但此软件可能会引入心脏出血等安全漏洞。

From Web browsers to industrial control systems, software is increasingly subject to attacks it was not designed to defend against. As the complexity of application requirements increases, developers incorporate modules with different provenance from their own code into hostile, Internet-connected environments, introducing new attack vectors into widely-deployed systems. For instance, the open-source FFmpeg project allows users to manipulate and convert various formats of audio/video content. Users have trusted FFmpeg on their own computers for years, but when integrated into the Chrome Web browser and exposed to arbitrary content on the Internet, over a thousand previously-undetected security vulnerabilities were brought to light. Industrial control systems (ICSs) incorporate third-party software to provide modern functionality such as Web interfaces, but this software can introduce security vulnerabilities such as Heartbleed.