Just over two years ago I moved to a new area, cloud security, when I going the startup company Lacework with the aim of building out a code security offering to complement the cloud workload (runtime) security offering they were based on. In this talk I will tell you about some the fascinating program analysis problems and solutions that I bumped into, both for static (code) analysis and for runtime analysis. I’ll describe the the challenges that arise when attempting to scale static analysis to many customers, the unusual uses of dynamic analysis I’ve observed, and how having an a holistic approach that mixes different analysis signals can lead to greater accuracy. The talk won’t be too technical: it’s more experience report than technical novelty, and will mainly contain a mixture of observations and demos.

He is a Professor of Computer Science at University College London and an Engineer at Lacework. He likes to think that fundamental theory, tool development and application can and even should play off one another via mutual feedback in computer science.

He is best known for separation logic, a theory he developed with John C. Reynolds that unearthed new domains for scaling logical reasoning about code. He was awarded twice a Most Influential POPL Paper Award. With Stephen Brookes, Carnegie Mellon University, he was co-recipient of the 2016 Gödel Prize, for the invention of Concurrent Separation Logic.