Keep black-hat hackers at bay with the tips and techniques in this entertaining, eye-opening book! Developers will learn how to padlock their applications throughout the entire development process—from designing secure applications to writing robust code that can withstand repeated attacks to testing applications for security flaws. Easily digested chapters reveal proven principles, strategies, and coding techniques. The authors—two battle-scarred veterans who have solved some of the industry’s toughest security problems—provide sample code in several languages. This edition includes updated information about threat modeling, designing a security process, international issues, file-system issues, adding privacy to applications, and performing security code reviews. It also includes enhanced coverage of buffer overruns, Microsoft® .NET security, and Microsoft ActiveX® development, plus practical checklists for developers, testers, and program managers.
FREE Two-Day Shipping for students on millions of items. Learn more |
| ||||||||||||||||||
Book Description
Special Offers and Product Promotions
- Buy $50 in qualifying physical textbooks, get $2 in Amazon MP3 Credit. Here's how (restrictions apply)
Frequently Bought Together
Editorial Reviews
From the Publisher
About the Author
Michael Howard, CISSP, is a leading security expert. He is a senior security program manager at Microsoft® and the coauthor of The Software Security Development Lifecycle. Michael has worked on Windows security since 1992 and now focuses on secure design, programming, and testing techniques. He is the consulting editor for the Secure Software Development Series of books by Microsoft Press.
David LeBlanc, Ph.D., is a founding member of the Trustworthy Computing Initiative at Microsoft®. He has been developing solutions for computing security issues since 1992 and has created award-winning tools for assessing network security and uncovering security vulnerabilities. David is a senior developer in the Microsoft Office Trustworthy Computing group.
Product Details
Would you like to update product info or give feedback on images?
|
More About the Authors
Discover books, learn about writers, read author blogs, and more.
Customer Reviews
(1) Not writing non-secure code. Covers several issues, some more obvious, like buffer overruns and validating user input, some more complex, like escaping URLs and socket security. I thought the book would teach me best practices about organizing code, as in "do like I do". Instead it goes like "don't do like I'm telling you".
(2) Using Windows security APIs. This is THE BEST part of the book. Gives you a very good overview about several different APIs, including ACLs, protecting sensitive data, securing DCOM and .NET code, excellent tips on installing programs etc. etc.
Keep in mind that this book is said to be used internally within Microsoft with "security pushes", with the audience of 8000 people, including not only developers of all levels, but managers as well, therefore the book is by definition a high level overview.
Sometimes the book feels like MS educational course. Ex. (tip on p.77) "I created the ... diagrams ... using ... Microsoft Visio Professional 2002". That's cool, but what does it have to do with security ?
Some topics should never be there. How about 3 pages of tips for a kernel driver writer ? It's a huge topic in itself and how many readers outside MS do this anyway ? Privacy issues are covered idealistically. Yeah, sure, if you put a specially crafted XML to the special place on your site, the users magically start trusting you... I'd better read about real situation with privacy, not how the government rules it to be. Oh, and how about 40 pages about cryptography ? Please...
The book tries to show you the security process with development and testing. I can easily see they use this process in Microsoft, with 8000 people. For a small team it's completely useless. How about using 4 (!) people for a code review ? Sure, upon reading this book you will know that security code review is a must (if you have enough resources). Didn't you know that before ?
The code samples are ugly. How about this: "... X is cool ... several pages of Perl (!) ... see what I mean ?". Ok, one of the authors admits to be a Perl fan, but how am I supposed to read through all this gibberish ? C(++) samples are not much better. May be they are fully functional and compilable and all, but please, they are huge and inconsistent in themselves.
All in all, 5 stars for Microsoft, 3 stars for the rest of the world.
The book explains in very clear language almost every aspect of secure programming and gives a good overview of all common security flaws that can (and will!) enter your programming code. You'll learn how to securely design, implement, test and deploy your programs. Ofcourse buffer overruns are handled (Public Enemy #1 according to the authors), but that's only the tip of the iceberg. The book does a great job by identifying and providing solutions to common security pitfalls. Topics that are handled include: database access, user privileges and Access Control, Cryptography, handling secret data, user input, encoding and internationalization, RPC, DCOM, DOS attacks, .NET and writing secure program documentation.
I recommend this book to every programmer out there, even if you're not programming for the Win32-platform. Don't let the fact that this is a Microsoft publication refrain you from buying this book. If you are serious about writing secure programs this is the book to get.
The book is complete in its explanation of how to make sure your application code, be it web-based or otherwise, is secured from attack.
I learned a great deal from this book, and, based on code and design reviews of my company's code, the authors obviously know what they are talking about - as we made a lot of fixes, and added many new security test cases to our test suites.
Simply put, we never knew we had problems, until we read this book, now it's mandatory reading for all our software engineers.
I am not a internet programmer, but still this book covers lot of topics how my stand alone... Read more
- The classical buffer overflows on the stack and on the heap
-... Read more
As the Internet grows in importance, applications are becoming highly interconnected. Read the first page Key Phrases - Statistically Improbable Phrases (SIPs): (learn more)
protecting secret data, canonical representation issues, running with least privilege, unsigned long err, information disclosure threats, impersonation functions, security code review, secure coding techniques, threat modeling, building secure applications, heap overruns, malformed data, untrusted data, building secure systems, restricted token, security push, compact policy, network service account, security bugs, packet privacy, scripting issues, security defects, buffer overrun, threat trees, writing secure code Key Phrases - Capitalized Phrases (CAPs): (learn more)
Internet Explorer, Microsoft Windows, Visual Basic, Microsoft Visual, Program Files, Visual Studio, Windows Security Push, Terminal Server, Microsoft Press, Mount Doom, Secure Windows Initiative, Authenticated Users, Cryptographic Foibles, Memory Descriptor List Read, Threat Description Attacker, Acme Incorporated, Active Template Library, Back Orifice, Microsoft Office, Power Users, Risk Damage, Code Complete, Configuration Properties, Domain Name System, Imports System New!
Books on Related Topics | Concordance | Text Stats Browse Sample Pages:
Front Cover | Table of Contents | First Pages | Index | Surprise Me!
- Trust in Cyberspace by Committee on Information Systems Trustworthiness in Back Matter
- The Mathematical Theory of Communication by Claude E Shannon on page 270
- Programming Windows Security by Keith Brown in Back Matter
- Rain Forest by Laurie Agopian in Front Matter
- How to Break Software: A Practical Guide to Testing W/CD by James A. Whittaker on page 596
See all 16 books this book cites
- The Security Development Lifecycle by Michael Howard on 13 pages
- 19 Deadly Sins of Software Security: Programming Flaws and How to Fix Them (Security One-off) by Michael Howard on 11 pages
- Assessing Network Security by Kevin Lam on 7 pages
- Hunting Security Bugs by Tom Gallagher on 4 pages
- Security Operations Guide for Microsoft Windows 2000 Server (Patterns & Practices) by Microsoft Corporation on 4 pages
See all 58 books citing this book
|
What Other Items Do Customers Buy After Viewing This Item?
Tags Customers Associate with This Product(What's this?)Click on a tag to find related items, discussions, and people.
|
Customer Discussions
|
This product's forum
Active discussions in related forums
Search Customer Discussions
|
Related forums
|
Listmania!
|
|
So You'd Like to...
|
|
Look for Similar Items by Category
- Books > Computers & Technology > Programming > Software Design, Testing & Engineering > Software Development
- Books > Computers & Technology > Security & Encryption
- Books > Computers & Technology > Software
- Books > Education & Reference
- Books > New & Used Textbooks > Computer Science > Programming Languages
- Books > New & Used Textbooks > Computer Science > Software Design & Engineering
- Books > Science & Math > Mathematics
