book

Secure Software Systems

Name: Secure Software Systems
ISBN: 9781284261219

by Erik Fretheim, Marie Deschene

March 2023

Intermediate to advanced

384 pages

15h 8m

English

Jones & Bartlett Learning

Read now

Unlock full access

Cover
Title Page
Copyright Page
Contents
Preface
Acknowledgments
CHAPTER 1 Secure Software Systems Development
Introduction
Secure Software Systems Life Cycle
Understanding the ModelSystem InitiationDefining and PlanningDesign and DecisionDevelopmentTest and EvaluationDeploymentOperations and MaintenanceRetirementVariations in the Life Cycle
The Five Ps

Combining the Five Ps with the Secure Software Systems Life Cycle
KEY TERMS
CHAPTER 2 Product and Portfolio Management
Introduction
Product Management
Identifying OpportunitiesProduct DefinitionProduct PlanningBringing the Product to MarketEcosystem Management
Portfolio Management
SUMMARY
KEY TERMS
CHAPTER 3 Program and Project Management
Introduction
Project Management
Phase 1—Initiation/Conception/AnalysisPhase 2—Define and PlanPhase 3—Implementation/ExecutionPhase 4—Monitor and ControlPhase 5—Project CloseProject Management Summary
Program Management
Strategic ApproachProgram SponsorshipProgram ManagersProgram Management Office
SUMMARY
KEY TERMS
REFERENCE
CHAPTER 4 Process Management
Introduction
Managing Processes
Identifying ProcessesUnderstanding Processes
Documenting Processes
Process DiagramsStatic Process AnalysisDynamic Process AnalysisQueueing Theory
Workflow
Process Quality
Process Improvement
Processes and Security
Defining Processes for the Developed System
SUMMARY
KEY TERMS
CHAPTER 5 Managing the Secure Software Systems Development Life Cycle
Introduction
Requirements Tracking
Change Management
Issue Management
SUMMARY
KEY TERMS
REFERENCE
CHAPTER 6 Security Culture, Responsibility, and Training
Introduction
Look and Feel of a Security Culture
Leadership Sets the Tone for CybersecuritySomeone with Responsibility and AuthoritySecurity Roles and Responsibilities Defined for AllSecurity Is Considered in All Aspects of ProductsSecurity Is Widely Discussed and Shared with CustomersSecurity Is ValuedSecurity Culture MaturityCompany Policies and Procedures Are Established and AvailableAn Effective Security Culture among Programmers and System Administrators Is Vital
Responsibility
Ethical IntegrityProfessionalismLong-Term Thinking
Training the Organization to Be Secure
What Training Is ImportantWhen to TrainTraining Style
SUMMARY
KEY TERMS
CHAPTER 7 Requirements and Security Requirements Planning
Introduction
Types of Requirements
System Definition and Scope
Sources of Requirements
Stakeholders as a Source of RequirementsIntended Security Practices as Security RequirementsOutsourcing and Cloud Services as a Source of Requirements
Requirements Engineering
Assessing Requirements for Security
Requirements Documentation and Tracing
TraceabilityFormatting Requirements for Sharing
SUMMARY
KEY TERMS
CHAPTER 8 Compliance
Introduction
Need for Compliance
Laws and Regulations Related to Compliance
Implications of Data Privacy Regulations and LawsU.S. Regulations and LawsCanadian Regulations and LawsEuropean Union Regulations and LawsChina Regulations and Laws
Compliance Models and Frameworks
Control Objectives for Information and related Technology (COBIT)Capability Maturity Model Integration (CMMI)Secure Software Development Framework (SSDF) (NIST)
Monitoring
Systems Auditing
SUMMARY
KEY TERMS
REFERENCES
CHAPTER 9 Quality Management
Introduction
Quality Assurance
ProcessesToolsTask ExpectationsTrainingAuditing and Monitoring Processes
Quality Control
Quality ExpectationsTestingRoot Cause AnalysisCorrective Actions
Quality Organizations
SUMMARY
KEY TERMS
CHAPTER 10 Modeling
Introduction
Choosing a Model
Modeling Tools
Modeling Techniques
Flow ChartsStructure ChartsE-R DiagramObject ModelUse Case ModelSequence DiagramState Diagram
SUMMARY
KEY TERMS
CHAPTER 11 Architecture
Introduction
Architecture Views or Models
Business or Functional ArchitectureLogical ArchitectureApplication ArchitectureData ArchitecturePhysical and Technical Architectures
Enterprise Architecture
Creating the Architecture
Architectural ConcernsArchitectural PrinciplesSecurity Objectives
Design Patterns
Example Design Patterns
Refinement Techniques
Architectural Reviews
SUMMARY
KEY TERMS
CHAPTER 12 Vulnerability and Threat Assessment
Introduction
Vulnerability Assessment and Mapping
The ProcessThe Vulnerability Matrix
Risk Assessment
Additional Vulnerability Assessment Tools
Trust BoundariesLife of DataOther Sources for Analysis
Threat Modeling
Purpose of the System
Threat Intelligence
Building the Threat Model
SUMMARY
KEY TERMS
CHAPTER 13 The Development Environment
Introduction
Culture of Secure Development Practices
Secure Development Tools
Software Sources
Selecting the Development Language
Using Libraries in the Development Process
Commercial ConsiderationsExcessive Library DependenceDependency IssuesInherited Vulnerabilities
Operating Systems and Architecture
Cloud Environments
Cloud Security ConsiderationsCloud Services EngagementCloud Development Practices
Coding Practices
Standing Operating Procedures (SOPs)Programming Manuals or Style GuidesFail-Safe Logic and CodingIntegration Issues
SUMMARY
KEY TERMS
REFERENCES
CHAPTER 14 Configuration Management
Introduction
Version Control
Configuration Management in Product Development
Configuration Management in Operations and Maintenance
SUMMARY
KEY TERMS
CHAPTER 15 Testing
Introduction
Test-Driven Development
The Test Plan
The Risk-Based Test StrategyThe Test TeamTest Tracking and CommunicationTest ScheduleTest CasesTesting Tools
Types of Testing
Standard Development Test MethodsUser Test MethodsSpecialized Test Methods
SUMMARY
KEY TERMS
REFERENCE
CHAPTER 16 Product Release and Deployment
Introduction
Preparing for Release
Release Review
Final Security ReviewOpen Issues
Accreditation for Release
Internal AccreditationGovernment System Accreditation
Deployment
Deployment RolesTraining before DeploymentDeployment CommunicationsDeployment or Migration PlanningDeployment/Migration Window
SUMMARY
KEY TERMS
CHAPTER 17 Operations and Maintenance
Introduction
Operations
MonitoringSecurity MonitoringUser SupportBackups
Incident Management
Incident Response PlanIncident Root Cause AnalysisIncident TrackingDisaster RecoveryPreparation and PracticePost-Incident Review
Maintenance
Configuration and Software UpdatesFunctional Fixes and PatchesSecurity Configuration and Software UpdatesVulnerability ManagementChange ManagementMaintenance Windows
Environmental Issues
Power ConsumptionE-Waste
SUMMARY
KEY TERMS
CHAPTER 18 Retirement or End-of-Life
Introduction
End-of-Life
Planning End-of-LifeArchiving
Strategies When Faced with End-of-Life
Retirement
CommunicationDeveloping a Retirement PlanPre-Retirement AuditTimelineRemoval from ServiceTransferring and Storing DataDecommissioning the HardwareLicensing AdjustmentsFinalizing the Retirement
SUMMARY
KEY TERMS
Glossary
Index

Content preview from Secure Software Systems

Index

NOTE: Page numbers followed by f, t and b indicate material in figures, tables and box respectively.

AAR. See after-action review

acceptance testing, 9

accreditation

definition of, 290

government system, 290–291

internal, 290

adherence, 138

administrator training, 292–293

advanced persistent threat (APT), 216

after-action review (AAR), 64–65

Agile movement, 93–94, 93b

Agile process management, 87

Agile programming, 13–14

alpha testing, 278

Amazon Web Services (AWS), 123

American Disabilities Act (ADA), 290

analysis phase, of project management, 41–47

APIs. See application programming interfaces

Apollo ...

Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.

Read now

Unlock full access

More than 5,000 organizations count on O’Reilly

O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.

Julian F.

Head of Cybersecurity

I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.

Addison B.

Field Engineer

I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.

Amir M.

Data Platform Tech Lead

I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.

Mark W.

Embedded Software Engineer

Publisher Resources

ISBN: 9781284261219

Cloud Computing

Data Engineering

Data Science

AI & ML

Programming Languages

Software Architecture

IT/Ops

Security

Design

Business

Soft Skills

Secure Software Systems

by Erik Fretheim, Marie Deschene

Index

Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.

More than 5,000 organizations count on O’Reilly

Julian F.

Addison B.

Amir M.

Mark W.

You might also like

Software Supply Chain Security

Secret Key Cryptography

Three Essentials for Agentic AI Security

Authentication and Access Control: Practical Cryptography Methods and Tools

Publisher Resources