Programming Books C Java PHP Python Learn more Browse Programming Books
Secure Programming with Static Analysis and over one million other books are available for Amazon Kindle. Learn more
  • List Price: $59.99
  • Save: $14.37 (24%)
Only 13 left in stock (more on the way).
Ships from and sold by
Gift-wrap available.
Add to Cart
FREE Shipping on orders over $35.
Condition: Used: Good
Comment: Shared Knowledge is a not for profit public charity! Check us out on facebook. We provide funding for educational programs in Richmond, Virginia. PLEASE READ FULL DESCRIPTION -USED GOOD- This book has been read and may show wear to the cover and or pages. There may be some dog-eared pages. In some cases the internal pages may contain highlighting/margin notes/underlining or any combination of these markings. The binding will be secure in all cases. This is a good reading and studying copy and has been verified that all pages are legible and intact. If the book contained a CD it is not guaranteed to still be included. Your purchase directly supports our scholarship program as well as our partner charities. All items are packed and shipped from the Amazon warehouse. Thanks so much for your purchase!
Access codes and supplements are not guaranteed with used items.
Add to Cart
Trade in your item
Get a $5.35
Gift Card.
Have one to sell? Sell on Amazon
Flip to back Flip to front
Listen Playing... Paused   You're listening to a sample of the Audible audio edition.
Learn more
See this image

Secure Programming with Static Analysis Paperback – July 9, 2007

ISBN-13: 978-0321424778 ISBN-10: 0321424778

Buy New
Price: $45.62
30 New from $29.98 37 Used from $16.98
Amazon Price New from Used from
"Please retry"
"Please retry"
$29.98 $16.98


Frequently Bought Together

Secure Programming with Static Analysis + The Web Application Hacker's Handbook: Finding and Exploiting Security Flaws
Price for both: $75.36

Buy the selected items together


Shop the new
New! Introducing the, a hub for Software Developers and Architects, Networking Administrators, TPMs, and other technology professionals to find highly-rated and highly-relevant career resources. Shop books on programming and big data, or read this week's blog posts by authors and thought-leaders in the tech industry. > Shop now

Product Details

  • Paperback: 624 pages
  • Publisher: Addison-Wesley Professional (July 9, 2007)
  • Language: English
  • ISBN-10: 0321424778
  • ISBN-13: 978-0321424778
  • Product Dimensions: 9.1 x 6.7 x 1.2 inches
  • Shipping Weight: 2 pounds (View shipping rates and policies)
  • Average Customer Review: 4.6 out of 5 stars  See all reviews (11 customer reviews)
  • Amazon Best Sellers Rank: #466,473 in Books (See Top 100 in Books)

Editorial Reviews

About the Author

B rian Chess is a founder of Fortify Software. He currently serves as Fortify’s Chief Scientist, where his work focuses on practical methods for creating secure systems. Brian holds a Ph.D. in Computer Engineering from the University of California at Santa Cruz, where he studied the application of static analysis to the problem of finding security-relevant defects in source code. Before settling on security, Brian spent a decade in Silicon Valley working at huge companies and small startups. He has done research on a broad set of topics, ranging from integrated circuit design all the way to delivering software as a service. He lives in Mountain View, California.


J acob West manages Fortify Software’s Security Research Group, which is responsible for building security knowledge into Fortify’s products. Jacob brings expertise in numerous programming languages, frameworks, and styles together with knowledge about how real-world systems can fail. Before joining Fortify, Jacob worked with Professor David Wagner at the

University of California at Berkeley to develop MOPS (MOdel Checking Programs for Security properties), a static analysis tool used to discover security vulnerabilities in C programs. When he is away from the keyboard, Jacob spends time speaking at conferences and working with customers to advance their understanding of software security. He lives in San Francisco, California.


Excerpt. © Reprinted by permission. All rights reserved.



Following the light of the sun, we left the Old World. —Christopher Columbus

We live in a time of unprecedented economic growth, increasingly fueled by computer and communications technology. We use software to automate factories, streamline commerce, and put information into the hands of people who can act upon it. We live in the information age, and software is the primary means by which we tame information.

But oddly enough, much of the activity that takes place under the guise of computer security isn't really about solving security problems at all; it's about cleaning up the mess that security problems create. Virus scanners, firewalls, patch management, and intrusion-detection systems are all means by which we make up for shortcomings in software security. The software industry puts more effort into compensating for bad security than it puts into creating secure software in the first place. Do not take this to mean that we see no value in mechanisms that compensate for security failures. Just as every ship should have lifeboats, it is both good and healthy that our industry creates ways to quickly compensate for a newly discovered vulnerability. But the state of software security is poor. New vulnerabilities are discovered every day. In a sense, we've come to expect that we will need to use the lifeboats every time the ship sails.

Changing the state of software security requires changing the way software is built. This is not an easy task. After all, there are a limitless number of security mistakes that programmers could make! The potential for error might be limitless, but in practice, the programming community tends to repeat the same security mistakes. Almost two decades of buffer overflow vulnerabilities serve as an excellent illustration of this point. In 1988, the Morris worm made the Internet programming community aware that a buffer overflow could lead to a security breach, but as recently as 2005, buffer overflow was the number one cause of security problems cataloged by the Common Vulnerabilities and Exposures (CVE) Project CWE, 2006. This significant repetition of well-known mistakes suggests that many of the security problems we encounter today are preventable and that the software community possesses the experience necessary to avoid them.

We are thrilled to be building software at the beginning of the twenty-first century. It must have felt this way to be building ships during the age of exploration. When Columbus came to America, exploration was the driving force behind economic expansion, and ships were the means by which explorers traveled the world. In Columbus's day, being a world economic power required being a naval power because discovering a new land didn't pay off until ships could safely travel the new trade routes. Software security has a similar role to play in today's world. To make information technology pay off, people must trust the computer systems they use. Some pundits warn about an impending "cyber Armageddon," but we don't fear an electronic apocalypse nearly so much as we see software security as one of the primary factors that control the amount of trust people are willing to place in technology. Without adequate security, we cannot realize the full potential of the digital age.

We believe that it is the responsibility of the people who create software to make sure that their creations are secure. Software security cannot be left to the system administrator or the end user. Network security, judicious administration, and wise use are all important, but in the long run, these endeavors cannot succeed if the software is inherently vulnerable. Although security can sometimes appear to be a black art or a matter of luck, we hope to show that it is neither. Making security sound impossible or mysterious is giving it more than its due. Given the right knowledge and the right tools, good software security can be achieved by building security in to the software-development process.

We sometimes encounter programmers who question whether software security is a worthy goal. After all, if no one hacked your software yesterday, why would you believe they'll hack it tomorrow? Security requires expending some extra thought, attention, and effort. This extra work wasn't nearly so important in previous decades, and programmers who haven't yet suffered security problems use their good fortune to justify continuing to ignore security. In his investigation of the loss of the space shuttle Challenger, Richard Feynman found that NASA had based its risk assessment on the fact that previous shuttle missions had been successful Feynman, 1986. They knew anomalous behavior had taken place in the past, but they used the fact that no disaster had occurred yet as a reason to believe that no disaster would ever occur. The resulting erosion of safety margins made failure almost inevitable. Feynman writes, "When playing Russian roulette, the fact that the first shot got off safely is little comfort for the next."

Security Matters: Improving Software Security with Static Source Code Analysis

Two threads are woven throughout the book: software security and static source code analysis. We discuss a wide variety of common coding errors that lead to security problems, explain the security ramifications of each, and give advice for charting a safe course. Our most common piece of advice eventually found its way into the title of the book: Use static analysis tools to identify coding errors before they can be exploited. Our focus is on commercial software for both businesses and consumers, but our emphasis is on business systems. We won't get into the details that are critical for building software for functions that imply special security needs. A lot could be said about the specific security requirements for building an operating system or an electronic voting machine, but we encounter many more programmers who need to know how to build a secure Web site or enterprise application.

Above all else, we hope to offer practical and immediately practicable advice for avoiding software security pitfalls. We use dozens of real-world examples of vulnerable code to illustrate the pitfalls we discuss, and the book includes a static source code analysis tool on a companion CD so that readers can experiment with the detection techniques we describe.

The book is not a guide to using security features, frameworks, or APIs. We do not discuss the Java Security Manager, advanced cryptographic techniques, or the right approach to identity management. Clearly, these are important topics. They are so important, in fact, that they warrant books of their own. Our goal is to focus on things unrelated to security features that put security at risk when they go wrong.

In many cases, the devil is in the details. Security principles (and violations of security principles) have to be mapped to their manifestation in source code. We've chosen to focus on programs written in C, C++, and Java because they are the languages we most frequently encounter today. We see plenty of other languages, too. Security-sensitive work is being done in C#, Visual Basic, PHP, Perl, Python, Ruby, and COBOL, but it would be difficult to write a single book that could even scratch the surface with all these languages.

In any case, many of the problems we discuss are language independent, and we hope that you will be able to look beyond the syntax of the examples to understand the ramifications for the languages you use.

Who Should Read the Book

This book is written for people who have decided to make software security a priority. We hope that programmers, managers, and software architects will all benefit from reading it. Although we do not assume any detailed knowledge about software security or static analysis, we cover the subject matter in enough depth that we hope professional code reviewers and penetration testers will benefit, too. We do assume that you are comfortable programming in either C or Java, and that you won't be too uncomfortable reading short examples in either language. Some chapters are slanted more toward one language than another. For instance, the examples in the chapters on buffer overflow are written in C.

Our hope is that by giving a lot of examples of vulnerable code, we can help you do a better job of identifying potential problems in your own code.

How the Book Is Organized

The book is divided into four parts. Part I, "Software Security and Static Analysis," describes the big picture: the software security problem, the way static analysis can help, and options for integrating static analysis as part of the software-development process. Part II, "Pervasive Problems," looks at pervasive security problems that can impact software, regardless of its functionality, while Part III, "Features and Flavors," tackles security concerns that affect common flavors of programs and specific software features. Part IV, "Static Analysis in Practice," brings together Parts I, II, and III with a set of hands-on exercises that show how static analysis can improve software security.

Chapter 1, "The Software Security Problem," outlines the software security dilemma from a programmer's perspective: why security is easy to get wrong and why typical methods for catching bugs aren't very effective when it comes to finding security problems.

Chapter 2, "Static Analysis," introduces static source code analysis. It looks at the variety of problems that static analysis can solve, including structure, quality, and, of course, security. We take a quick tour of open-source and commercial static analysis tools.

Chapter 3, "Static Analysis as Part of Code Review," looks at how static analysis tools can be put to work as part of a security review process. We examine the organizational decisions that are es...

More About the Author

Discover books, learn about writers, read author blogs, and more.

Customer Reviews

4.6 out of 5 stars
5 star
4 star
3 star
2 star
1 star
See all 11 customer reviews
If you are wondering what that means, buy this book.
Gary McGraw
ALL of these things can be prevented through static code analysis, like the type described in this book.
Kenneth R. Van Wyk
Every software developer who has to write secure code should read this book.
David Wagner

Most Helpful Customer Reviews

12 of 16 people found the following review helpful By James Walden on July 5, 2007
Format: Paperback
After having read every secure programming book in print, this is the book I would recommend to both working developers and students. The abundance of code examples in C/C++ and Java help this book stand out from the shelf of other secure programming books, but that's just the beginning of what sets this book apart from the rest.

While most secure programming books focus on the basics of security mistakes like buffer overflows, they're short on how to find and fix security flaws in a large body of code. Most of us have too much code to inspect manually line by line by the next release, so this book shows the reader how to effectively use static analysis tools as a part of the code review process to automate finding security bugs. The CD that comes with the book has a working demo version of the Fortify Source Code Analyzer tool, so the reader can gain hands-on experience with static analysis.

Once you've found the bugs, you could attempt to fix them one by one, or you could fix them in a consistent, structured manner using secure design strategies to solve problems like input validation and memory management that are the source of so many security problems. Secure Programming with Static Analysis has a readable and practical discussion of these strategies, with many code examples so the reader can easily apply these strategies. It also shows how to use static analysis tools to ensure that all of your code follows these strategies, so that no input escapes validation.

Every software developer needs to know how to program securely, and there's no better place to start learning than this book.
Comment Was this review helpful to you? Yes No Sending feedback...
Thank you for your feedback. If this review is inappropriate, please let us know.
Sorry, we failed to record your vote. Please try again
10 of 15 people found the following review helpful By Avi Rubin on July 4, 2007
Format: Paperback
In this exceptional book, Brian Chess and Jacob West provide an invaluable resource to programmers. Armed with with the hands-on instruction provided in Secure Programming with Static Analysis, developers will finally be in a position to fully utilize technological advances to produce better code. Reading this book is a prerequisite for any serious programming.
Comment Was this review helpful to you? Yes No Sending feedback...
Thank you for your feedback. If this review is inappropriate, please let us know.
Sorry, we failed to record your vote. Please try again
4 of 6 people found the following review helpful By David Wagner on July 11, 2007
Format: Paperback
Every software developer who has to write secure code should read this book. This book will tell you how to use static analysis tools to help you build more secure software. It's a great primer for software developers who are new to static analysis and for security practitioners who want to learn how recent advances in the field can improve their software.

I reviewed an pre-release version. It's good stuff. It's well-written, easy to read, and tells you what you need to know without getting bogged down in the details. Brian Chess and Jacob West have a great deal of experience in this area and they do a good job of conveying pragmatic information you can apply in practice to improve your software.
Comment Was this review helpful to you? Yes No Sending feedback...
Thank you for your feedback. If this review is inappropriate, please let us know.
Sorry, we failed to record your vote. Please try again
4 of 6 people found the following review helpful By G. Cheng on July 4, 2007
Format: Paperback
I had the privilege to read the manuscript of this book before its publication. Highly recommended to developers who are starting to learn application security from a more practical view. With lots of real code examples, this book explains security vulnerabilities from a coding practice perspective, which is unique and easy for an average developer to understand. In my opinion, this book is extremely valuable for an organization to promote security into a software development life cycle(SDLC). It uses easy-to-understand "coding" language and examples to explain many of the vulnerabilities and security concepts that are usually hard to learn for developers with little security experience and expertise. A must-have application security book for the average developers.
Comment Was this review helpful to you? Yes No Sending feedback...
Thank you for your feedback. If this review is inappropriate, please let us know.
Sorry, we failed to record your vote. Please try again
By Keith Makan on February 7, 2014
Format: Kindle Edition Verified Purchase
If you're looking to get into jacking instruction pointers and doing some serious bug hunting, this book is a must read!
Comment Was this review helpful to you? Yes No Sending feedback...
Thank you for your feedback. If this review is inappropriate, please let us know.
Sorry, we failed to record your vote. Please try again
Format: Paperback Verified Purchase
I brought this book as a course requirement and it has been much more than that. This book enlightens you with situations which you would have encountered previously but never realized how an adversary could exploit the situation to either break into your system or just cause havoc from outside. The authors have shared their company Software named Fortify which helps us analyze programs using static analysis. The only drawback is that the software is an out of date one which refuses to configure with windows 7 system and requires XP compatibility. Also understandably it is a demo version which has extreme constrains on the size of code being analyzed. Wish the authors would have looked into these minor details.
Comment Was this review helpful to you? Yes No Sending feedback...
Thank you for your feedback. If this review is inappropriate, please let us know.
Sorry, we failed to record your vote. Please try again

Customer Images