The programming language Rust is increasingly being used for the development of embedded systems. Rust places a strong focus on safety and security. Due to the growing interconnection of systems and the upcoming regulations of the European Union, most notably the Cyber Resilience Act and the EU Machinery Regulation, protecting against security attacks and preventing negative effects of security incidents on the functional safety of embedded systems are becoming essential.

Rust provides numerous features that are intended to help developers program safely and securely by avoiding bugs and security vulnerabilities. Nevertheless, in practice, a wide variety of security problems occur even when Rust is used.

In this talk, we give an overview of the dos and don'ts when implementing security-relevant functionality with Rust. In addition, we present tools that help developers program safely and securely with Rust. These include tools that detect undefined behavior as well as program crashes, tools that uncover unintended information leaks, and a research prototype that uses a public vulnerability database for Rust libraries to automatically check whether your own project is affected by vulnerabilities.

■  Second author: Dr. Matthias Meyer, Fraunhofer IEM

Short Bio

M.Eng. Ingo Budde has worked since 2018 as a software engineer and research associate in the Secure IoT Systems department within the Software Engineering & IT Security research division at Fraunhofer IEM in Paderborn. He works on projects with industrial and academic partners on security by design and program analysis, conducts professional trainings sessions for industry customers on secure software development, investigates the security of Rust, and is developing novel security tooling for Rust.