Am I missing something? I don’t actually see any analysis of the costs of these. I was expecting to see an analysis of how much the 0.5%, 2%, performance-overhead mitigations end up costing in total. When we looked at the mitigations that Windows enabled by default, we estimated that the performance cost of the ones that you don’t need with CHERI is 5-30% (depending on the workload), which means that the overhead of CHERI looks really good in comparison.
I had the same impression as you, but I think the point of the presentation was to cover how small mitigations can still provide cumulative benefit in frustrating real attack efforts.
Am I missing something? I don’t actually see any analysis of the costs of these. I was expecting to see an analysis of how much the 0.5%, 2%, performance-overhead mitigations end up costing in total. When we looked at the mitigations that Windows enabled by default, we estimated that the performance cost of the ones that you don’t need with CHERI is 5-30% (depending on the workload), which means that the overhead of CHERI looks really good in comparison.
I had the same impression as you, but I think the point of the presentation was to cover how small mitigations can still provide cumulative benefit in frustrating real attack efforts.