Book description
"When it comes to software
security, the devil is in the details. This book tackles the
details."
--Bruce Schneier, CTO and founder, Counterpane, and author of
Beyond Fear and Secrets and Lies
"McGraw's book shows you how to make the
'culture of security' part of your development
lifecycle."
--Howard A. Schmidt, Former White House Cyber Security Advisor
"McGraw is leading the charge in software
security. His advice is as straightforward as it is actionable. If
your business relies on software (and whose doesn't), buy this book
and post it up on the lunchroom wall."
--Avi Rubin, Director of the NSF ACCURATE Center; Professor, Johns
Hopkins University; and coauthor of Firewalls and Internet
Security
Beginning where the best-selling book Building Secure Software left off, Software Security teaches you how to put software security into practice.The software security best practices, or touchpoints, described in this book have their basis in good software engineering and involve explicitly pondering security throughout the software development lifecycle. This means knowing and understanding common risks (including implementation bugsand architectural flaws), designing for security, and subjecting all software artifacts to thorough, objective risk analyses and testing.
Software Security is about putting the touchpoints to work for you. Because you can apply these touchpoints to the software artifacts you already produce as you develop software, you can adopt this book's methods without radically changing the way you work. Inside you'll find detailed explanations of
Risk management frameworks and processes
Code review using static analysis tools
Architectural risk analysis
Penetration testing
Security testing
Abuse case development
In addition to the touchpoints, Software Security covers knowledge management, training and awareness, and enterprise-level software security programs. Now that the world agrees that software security is central to computer security, it is time to put philosophy into practice. Create your own secure development lifecycle by enhancing your existing software development lifecycle with the touchpoints described in this book. Let this expert author show you how to build more secure software by building security in.
Table of contents
- Copyright
- Advance Praise for Software Security
- Addison-Wesley Software Security Series
- Foreword
- Preface
- Acknowledgments
- About the Author
-
I. Software Security Fundamentals
- 1. Defining a Discipline
-
2. A Risk Management Framework
- Putting Risk Management into Practice
- How to Use This Chapter
- The Five Stages of Activity
- The RMF Is a Multilevel Loop
- Applying the RMF: KillerAppCo’s iWare 1.0 Server
- The Importance of Measurement
- The Cigital Workbench
- Risk Management Is a Framework for Software Security
-
II. Seven Touchpoints for Software Security
- 3. Introduction to Software Security Touchpoints
- 4. Code Review with a Tool
-
5. Architectural Risk Analysis
- Common Themes among Security Risk Analysis Approaches
- Traditional Risk Analysis Terminology
- Knowledge Requirement
- The Necessity of a Forest-Level View
- A Traditional Example of a Risk Calculation
- Limitations of Traditional Approaches
- Modern Risk Analysis
- Touchpoint Process: Architectural Risk Analysis
- Getting Started with Risk Analysis
- Architectural Risk Analysis Is a Necessity
- 6. Software Penetration Testing
- 7. Risk-Based Security Testing
- 8. Abuse Cases
- 9. Software Security Meets Security Operations
- III. Software Security Grows Up
-
IV. Appendices
-
A. Fortify Source Code Analysis Suite Tutorial
- 1. Introducing the Audit Workbench
- 2. Auditing Source Code Manually
- 3. Ensuring a Working Build Environment
- 4. Running the Source Code Analysis Engine
- 5. Exploring the Basic SCA Engine Command Line Arguments
- 6. Understanding Raw Analysis Results
- 7. Integrating with an Automated Build Process
- 8. Using the Audit Workbench
- 9. Auditing Open Source Applications
- B. ITS4 Rules
- C. An Exercise in Risk Analysis: Smurfware
-
D. Glossary
-
A. Fortify Source Code Analysis Suite Tutorial
- InsideFrontCover
- InsideBackCover
Product information
- Title: Software Security: Building Security In
- Author(s):
- Release date: January 2006
- Publisher(s): Addison-Wesley Professional
- ISBN: 9780321356703
You might also like
book
Web Application Security
While many resources for network and IT security are available, detailed knowledge regarding modern web application …
book
Web Application Security, 2nd Edition
In the first edition of this critically acclaimed book, Andrew Hoffman defined the three pillars of …
book
Application Security Program Handbook
Stop dangerous threats and secure your vulnerabilities without slowing down delivery. This practical book is a …
book
Enterprise Security Architecture
Security is too important to be left in the hands of just one department or employee-it's …