This essential book for all software developers--regardless of platform, language, or type of application--outlines the “19 deadly sins” of software security and shows how to fix each one. Best-selling authors Michael Howard and David LeBlanc, who teach Microsoft employees how to secure code, have partnered with John Viega, the man who uncovered the 19 deadly programming sins to write this much-needed book. Coverage includes: <ul>
<li>Windows, UNIX, Linux, and Mac OS X </li>
<li>C, C++, C#, Java, PHP, Perl, and Visual Basic </li>
<li>Web, small client, and smart-client applications </li>
</ul>

19 Deadly Sins of Software Security: Programming Flaws and How to Fix Them

Computers & Technology

Viega, John

LeBlanc, David

Howard., Michael

Certification

McGraw-Hill/Osborne Media

Most organizations have a firewall, antivirus software, and intrusion detection systems, all of which are intended to keep attackers out. So why is computer security a bigger problem today than ever before? The answer is simple--bad software lies at the heart of all computer security problems. Traditional solutions simply treat the symptoms, not the problem, and usually do so in a reactive way. This book teaches you how to take a proactive approach to computer security. Building Secure Software cuts to the heart of computer security to help you get security right the first time. If you are serious about computer security, you need to read this book, which includes essential lessons for both security professionals who have come to realize that software is the problem, and software developers who intend to make their code behave. Written for anyone involved in software development and use—from managers to coders—this book is your first step toward building more secure software. Building Secure Software provides expert perspectives and techniques to help you ensure the security of essential software. If you consider threats and vulnerabilities early in the devel-opment cycle you can build security into your system. With this book you will learn how to determine an acceptable level of risk, develop security tests, and plug security holes before software is even shipped. Inside you'll find the ten guiding principles for software security, as well as detailed coverage of: <ul>
<li>Software risk management for security</li> <li>Selecting technologies to make your code more secure</li> <li>Security implications of open source and proprietary software</li> <li>How to audit software</li> <li>The dreaded buffer overflow</li> <li>Access control and password authentication</li> <li>Random number generation</li> <li>Applying cryptography</li> <li>Trust management and input</li> <li>Client-side security</li> <li>Dealing with firewalls</li> </ul>
Only by building secure software can you defend yourself against security breaches and gain the confidence that comes with knowing you won't have to play the "penetrate and patch" game anymore. Get it right the first time. Let these expert authors show you how to properly design your system; save time, money, and credibility; and preserve your customers' trust.

Building Secure Software: How to Avoid Security Problems the Right Way

McGraw, Gary

Addison-Wesley Professional

What is it about software that makes security such a problem? If you want to build secure software, how do you do it? These questions and the perseverance of three of the world's leading security experts, Gary McGraw, John Viega, and Greg Hoglund, led to the three books contained in this package. Building Secure Software: How to Avoid Security Problems the Right Way, the white hat book, seems to have touched off a revolution. Security people who once relied solely on firewalls, intrusion detection, and anti-virus mechanisms came to understand and embrace the necessity of better software. This book provides a coherent and sensible philosophical foundation for the blossoming field of software security. Exploiting Software: How to Break Code, the black hat book, provides a much needed balance, teaching how to break software and how malicious hackers write exploits. This book is meant as a reality check for software security, ensuring that the good guys address real attacks and invent and peddle solutions that actually work. Exploiting Software and Building Secure Software are in some senses mirror images. Software Security: Building Security In unifies the two sides of software security--attack and defense, exploiting and designing, breaking and building--into a coherent whole. Like the yin and the yang, software security requires a careful balance.

Software Security Library Boxed Set, First Edition

Hoglund, Greg

Most organizations have a firewall, antivirus software, and intrusion detection systems, all of which are intended to keep attackers out. So why is computer security a bigger problem today than ever before? The answer is simple--bad software lies at the heart of all computer security problems. Traditional solutions simply treat the symptoms, not the problem, and usually do so in a reactive way. This book teaches you how to take a proactive approach to computer security. Building Secure Software cuts to the heart of computer security to help you get security right the first time. If you are serious about computer security, you need to read this book, which includes essential lessons for both security professionals who have come to realize that software is the problem, and software developers who intend to make their code behave. Written for anyone involved in software development and use—from managers to coders—this book is your first step toward building more secure software. Building Secure Software provides expert perspectives and techniques to help you ensure the security of essential software. If you consider threats and vulnerabilities early in the devel-opment cycle you can build security into your system. With this book you will learn how to determine an acceptable level of risk, develop security tests, and plug security holes before software is even shipped. Inside you'll find the ten guiding principles for software security, as well as detailed coverage of: <ul>
<li>Software risk management for security </li>
<li>Selecting technologies to make your code more secure </li>
<li>Security implications of open source and proprietary software </li>
<li>How to audit software </li>
<li>The dreaded buffer overflow </li>
<li>Access control and password authentication </li>
<li>Random number generation </li>
<li>Applying cryptography </li>
<li>Trust management and input </li>
<li>Client-side security </li>
<li>Dealing with firewalls </li> </ul>
Only by building secure software can you defend yourself against security breaches and gain the confidence that comes with knowing you won't have to play the "penetrate and patch" game anymore. Get it right the first time. Let these expert authors show you how to properly design your system; save time, money, and credibility; and preserve your customers' trust.

Building Secure Software: How to Avoid Security Problems the Right Way (paperback) (Addison-wesley Professional Computing Series)

Networking & Cloud Computing

Most applications these days are at least somewhat network aware, but how do you protect those applications against common network security threats? Many developers are turning to OpenSsl, an open source version of Ssl/Tls, which is the most widely used protocol for secure network communications. The OpenSsl library is seeing widespread adoption for web sites that require cryptographic functions to protect a broad range of sensitive information, such as credit card numbers and other financial transactions. The library is the only free, full-featured Ssl implementation for C and C++, and it can be used programmatically or from the command line to secure most Tcp-based network protocols. Network Security with OpenSsl enables developers to use this protocol much more effectively. Traditionally, getting something simple done in OpenSsl could easily take weeks. This concise book gives you the guidance you need to avoid pitfalls, while allowing you to take advantage of the library's advanced features. And, instead of bogging you down in the technical details of how Ssl works under the hood, this book provides only the information that is necessary to use OpenSsl safely and effectively. In step-by-step fashion, the book details the challenges in securing network communications, and shows you how to use OpenSsl tools to best meet those challenges. As a system or network administrator, you will benefit from the thorough treatment of the OpenSsl command-line interface, as well as from step-by-step directions for obtaining certificates and setting up your own certification authority. As a developer, you will further benefit from the in-depth discussions and examples of how to use OpenSsl in your own programs. Although OpenSsl is written in C, information on how to use OpenSsl with Perl, Python and Php is also included. OpenSsl may well answer your need to protect sensitive data. If that's the case, Network Security with Ope

Network Security with OpenSSL: Cryptography for Secure Communications

Messier, Matt

Chandra, Pravir

O'Reilly Media

Password sniffing, spoofing, buffer overflows, and denial of service: these are only a few of the attacks on today's computer systems and networks. At the root of this epidemic is poorly written, poorly tested, and insecure code that puts everyone at risk. Clearly, today's developers need help figuring out how to write code that attackers won't be able to exploit. But writing such code is surprisingly difficult. Secure Programming Cookbook for C and C++ is an important new resource for developers serious about writing secure code. It contains a wealth of solutions to problems faced by those who care about the security of their applications. It covers a wide range of topics, including safe initialization, access control, input validation, symmetric and public key cryptography, cryptographic hashes and Macs, authentication and key exchange, Pki, random numbers, and anti-tampering. The rich set of code samples provided in the book's more than 200 recipes will help programmers secure the C and C++ programs they write for both Unix (including Linux) and Windows environments. Readers will learn: How to avoid common programming errors, such as buffer overflows, race conditions, and format string problems How to properly Ssl-enable applications How to create secure channels for client-server communication without Ssl How to integrate Public Key Infrastructure (Pki) into applications Best practices for using cryptography properly Techniques and strategies for properly validating input to programs How to launch programs securely How to use file access mechanisms properly Techniques for protecting applications from reverse engineering The book's web site supplements the book by providing a place to post new recipes, including those written in additional languages like Perl, Java, and Python. Monthly prizes will reward the best recipes submitted by readers. Secure Programming Cookbook for C and C++ is destined to become an e

Secure Programming Cookbook for C and C++: Recipes for Cryptography, Authentication, Input Validation & More

If you think computer security has improved in recent years, The Myths of Security will shake you out of your complacency. Longtime security professional John Viega, formerly Chief Security Architect at McAfee, reports on the sorry state of the industry, and offers concrete suggestions for professionals and individuals confronting the issue. Why is security so bad? With many more people online than just a few years ago, there are more attackers - and they're truly motivated. Attacks are sophisticated, subtle, and harder to detect than ever. But, as Viega notes, few people take the time to understand the situation and protect themselves accordingly. This book tells you:Why it's easier for bad guys to "own" your computer than you think Why anti-virus software doesn't work well - and one simple way to fix it Whether Apple Os X is more secure than Windows What Windows needs to do better How to make strong authentication pervasive Why patch management is so bad Whether there's anything you can do about identity theft Five easy steps for fixing application security, and more Provocative, insightful, and always controversial, The Myths of Security not only addresses It professionals who deal with security issues, but also speaks to Mac and Pc users who spend time online.

The Myths of Security: What the Computer Security Industry Doesn't Want You to Know

Business & Money

Industries

In this thought-provoking anthology, today's security experts describe bold and extraordinary methods used to secure computer systems in the face of ever-increasing threats. Beautiful Security features a collection of essays and insightful analyses by leaders such as Ben Edelman, Grant Geyer, John McManus, and a dozen others who have found unusual solutions for writing secure code, designing secure applications, addressing modern challenges such as wireless security and Internet vulnerabilities, and much more. Among the book's wide-ranging topics, you'll learn how new and more aggressive security measures work--and where they will lead us. Topics include: 
<ul>
<li> Rewiring the expectations and assumptions of organizations regarding security 
</li> <li>Security as a design requirement 
</li> <li>Evolution and new projects in Web of Trust 
</li> <li>Legal sanctions to enforce security precautions 
</li> <li>An encryption/hash system for protecting user data 
</li> <li>The criminal economy for stolen information 
</li> <li>Detecting attacks through context </li> </ul>
Go beyond the headlines, hype, and hearsay. With Beautiful Security, you'll delve into the techniques, technology, ethics, and laws at the center of the biggest revolution in the history of network security. It's a useful and far-reaching discussion you can't afford to miss.

Beautiful Security: Leading Security Experts Explain How They Think

Oram, Andy

See the best price to sell, buy, or rent books by Viega, John. BookScouter helps to compare book prices from 25+ online bookstores and 30+ buyback vendors with a single search.

Books by Viega, John