| |||||||||||||||
 Trade In this Item for up to £10.35
Get an extra £5 when you trade in books worth £10 or more until June 30, 2012. Trade in 24 Deadly Sins of Software Security: Programming Flaws and How to Fix Them for an Amazon.co.uk gift card of up to £10.35, which you can then spend on millions of items across the site. Trade-in values may vary (terms apply). Find more products eligible for trade-in.
|
Frequently Bought Together
Product details
|
More About the Author
Product Description
Product Description
"What makes this book so important is that it reflects the experiences of two of the industry's most experienced hands at getting real-world engineers to understand just what they're being asked for when they're asked to write secure code. The book reflects Michael Howard's and David LeBlanc's experience in the trenches working with developers years after code was long since shipped, informing them of problems." --From the Foreword by Dan Kaminsky, Director of Penetration Testing, IOActive
Eradicate the Most Notorious Insecure Designs and Coding Vulnerabilities
Fully updated to cover the latest security issues, 24 Deadly Sins of Software Security reveals the most common design and coding errors and explains how to fix each one-or better yet, avoid them from the start. Michael Howard and David LeBlanc, who teach Microsoft employees and the world how to secure code, have partnered again with John Viega, who uncovered the original 19 deadly programming sins. They have completely revised the book to address the most recent vulnerabilities and have added five brand-new sins. This practical guide covers all platforms, languages, and types of applications. Eliminate these security flaws from your code:
- SQL injection
- Web server- and client-related vulnerabilities
- Use of magic URLs, predictable cookies, and hidden form fields
- Buffer overruns
- Format string problems
- Integer overflows
- C++ catastrophes
- Insecure exception handling
- Command injection
- Failure to handle errors
- Information leakage
- Race conditions
- Poor usability
- Not updating easily
- Executing code with too much privilege
- Failure to protect stored data
- Insecure mobile code
- Use of weak password-based systems
- Weak random numbers
- Using cryptography incorrectly
- Failing to protect network traffic
- Improper use of PKI
- Trusting network name resolution
About the Author
Michael Howard is is a principal security program manager on the Trustworthy Computing Group’s Security Engineering team at Microsoft. He is the author or coauthor of many well-known software security books and is an editor of IEEE Security & Privacy.
David LeBlanc, Ph.D., is a principal software development engineer on the Microsoft Office security team. He is a coauthor, with Michael Howard, of Writing Secure Code (Microsoft Press).
John Viega is CTO of the SaaS Business Unit at McAfee and was previously their chief security architect. He is the author of five other security books. Mr. Viega first defined the 19 deadly sins of software security for the Department of Homeland Security.
Suggested Tags from Similar Products(What's this?)Be the first one to add a relevant tag (keyword that's strongly related to this product)
|
What Other Items Do Customers Buy After Viewing This Item?
Customer Reviews
Having owned the previous "edition" for years I did NOT think twice before ordering this one when it was published.
The 24 deadly sins cover the things you MUST consider, the ESSENTIAL security stuff you CANNOT miss. Got it? This is probably one of the most important books about security, which you will return to again and again to remind yourself of the importance, and to make sure you can persuade others to the risks associated with these security issues.
This said lets look into some details, the parts included are very vendor neutral (good thing), covers multiple languages (some bias perhaps, but pretty neutral), the book includes lots of code examples to show the problems and lots of references to papers, tools, methods - enough to keep anyone busy doing better at software security.
The product description already list the specific sins, so there you have it - buy the book, hit your developers or yourself repeatedly if you forget some of these when doing development, system work, implementation projects etc.
Highly recommended - and do NOT consider it "old" just because it is published in 2009, the stuff is still too important.
The organization of the book lends itself to a straight read through and as a jump around reference to cover the problems you need to look at when you need to look at them. Most chapters stand alone quite well and most references to other chapters are about closely related sins. It describes the basics of the problem, goes into more detail and helps you try to spot the problem in various languages. It covers some of the ways you can avoid the problems and provides additional remediation if available.
The book lends itself to being a decent text book on software security problems and its basic structure is not a bad approach to an introduction to the topic. I've been teaching an introduction to secure development class for a couple of years that was mostly based on the original book and I'm finishing updating that to the new 24 Deadly Sins breakdown.
Howard is the real deal, a straight shooter and known for telling it like it is. This book is no different - no fluff, no extraneous material, just the stuff every project manager of a software development effort should know, so they know what to ask of their team.
The Web Application Hacker's Handbook: Finding and Exploiting Security Flaws is a much better treatment of security in web applications if that is what you are looking for.
Listmania!
Look for similar items by category
Look for similar items by subject
Feedback
- Would you like to update product info or give feedback on images?
- I am the Author, and I want to comment on my book.
- I am the Publisher, and I want to comment on this book.
|
