book

Software Security: Building Security In

Name: Software Security: Building Security In
Author: Gary McGraw
ISBN: 9780321356703

by Gary McGraw

January 2006

Intermediate to advanced

448 pages

10h 38m

English

Addison-Wesley Professional

Read now

Unlock full access

Copyright
Dedication
Advance Praise for Software Security
Addison-Wesley Software Security Series
Foreword
Preface
Who This Book Is ForWhat This Book Is AboutIconsThe SeriesContacting the Author
Acknowledgments
About the Author
I. Software Security Fundamentals
1. Defining a Discipline
The Security ProblemThe Trinity of Trouble: Why the Problem Is GrowingConnectivityExtensibilityComplexityBasic ScienceSecurity Problems in SoftwareBugs and Flaws and Defects, Oh My!The Range of DefectsThe Problem with Application SecuritySoftware Security and OperationsSolving the Problem: The Three Pillars of Software SecurityPillar I: Applied Risk ManagementPillar II: Software Security TouchpointsPillar III: KnowledgeThe Rise of Security EngineeringSoftware Security Is Everyone’s Job
2. A Risk Management Framework
Putting Risk Management into PracticeHow to Use This ChapterThe Five Stages of ActivityStage 1: Understand the Business ContextStage 2: Identify the Business and Technical RisksStage 3: Synthesize and Rank the RisksStage 4: Define the Risk Mitigation StrategyStage 5: Carry Out Fixes and ValidateMeasuring and Reporting on RiskThe RMF Is a Multilevel LoopApplying the RMF: KillerAppCo’s iWare 1.0 ServerUnderstanding the Business ContextGathering the ArtifactsConducting Project ResearchIdentifying the Business and Technical RisksDeveloping Risk QuestionnairesInterviewing the Target Project TeamAnalyzing the Research and Interview DataUncovering Technical RisksAnalyzing Software ArtifactsSynthesizing and Ranking the RisksReviewing the Risk DataConducting the Business and Technical Peer ReviewDefining the Risk Mitigation StrategyBrainstorming on Risk MitigationAuthoring the Risk Analysis ReportProducing Final DeliverablesCarrying Out Fixes and ValidatingThe Importance of MeasurementMeasuring ReturnMeasurement and Metrics in the RMFThe Cigital WorkbenchRisk Management Is a Framework for Software Security

II. Seven Touchpoints for Software Security
3. Introduction to Software Security Touchpoints
Flyover: Seven Terrific Touchpoints1. Code Review (Tools)2. Architectural Risk Analysis3. Penetration Testing4. Risk-Based Security Testing5. Abuse Cases6. Security Requirements7. Security Operations*. External AnalysisWhy Only Seven?Black and White: Two Threads Inextricably IntertwinedMoving LeftTouchpoints as Best PracticesWho Should Do Software Security?Building a Software Security GroupDon’t start with security peopleStart with software peopleSoftware Security Is a Multidisciplinary EffortTouchpoints to Success
4. Code Review with a Tool
Catching Implementation Bugs Early (with a Tool)Aim for Good, Not PerfectAncient HistoryApproaches to Static AnalysisA History of Rule CoverageModern RulesTools from ResearchlandCommercial Tool VendorsCommercial Source Code AnalyzersKey Characteristics of a ToolThree Characteristics to AvoidThe Fortify Source Code Analysis SuiteThe Fortify Knowledge BaseUsing FortifyTouchpoint Process: Code ReviewUse a Tool to Find Security Bugs
5. Architectural Risk Analysis
Common Themes among Security Risk Analysis ApproachesTraditional Risk Analysis TerminologyKnowledge RequirementThe Necessity of a Forest-Level ViewA Traditional Example of a Risk CalculationLimitations of Traditional ApproachesModern Risk AnalysisSecurity RequirementsA Basic Risk Analysis ApproachTouchpoint Process: Architectural Risk AnalysisAttack Resistance AnalysisAmbiguity AnalysisWeakness AnalysisGetting Started with Risk AnalysisArchitectural Risk Analysis Is a Necessity
6. Software Penetration Testing
Penetration Testing TodaySoftware Penetration Testing—a Better ApproachMake Use of ToolsTest More Than OnceIncorporating Findings Back into DevelopmentUsing Penetration Tests to Assess the Application LandscapeProper Penetration Testing Is Good
7. Risk-Based Security Testing
What’s So Different about Security?Risk Management and Security TestingHow to Approach Security TestingWhoHowThinking about (Malicious) InputGetting Over InputLeapfrogging the Penetration Test
8. Abuse Cases
Security Is Not a Set of FeaturesWhat You Can’t DoCreating Useful Abuse CasesBut No One Would Ever Do That!Touchpoint Process: Abuse Case DevelopmentCreating Anti-RequirementsCreating an Attack ModelAn Abuse Case ExampleAbuse Cases Are Useful
9. Software Security Meets Security Operations
Don’t Stand So Close to MeKumbaya (for Software Security)Come Together (Right Now)Future’s So Bright, I Gotta Wear Shades
III. Software Security Grows Up
10. An Enterprise Software Security Program
The Business ClimateBuilding Blocks of ChangeBuilding an Improvement ProgramEstablishing a Metrics ProgramA Three-Step Enterprise RolloutContinuous ImprovementWhat about COTS (and Existing Software Applications)?An Enterprise Information ArchitectureAdopting a Secure Development Lifecycle
11. Knowledge for Software Security
Experience, Expertise, and SecuritySecurity Knowledge: A Unified ViewSecurity Knowledge and the TouchpointsThe Department of Homeland Security Build Security In PortalKnowledge Management Is OngoingSoftware Security Now
12. A Taxonomy of Coding Errors
On Simplicity: Seven Plus or Minus TwoInput Validation and RepresentationAPI AbuseSecurity FeaturesTime and StateError HandlingCode QualityEncapsulationEnvironmentThe PhylaMore Phyla NeededA Complete ExampleLists, Piles, and CollectionsNineteen Sins Meet Seven KingdomsSeven Kingdoms and the OWASP TenGo Forth (with the Taxonomy) and Prosper
13. Annotated Bibliography and References
Annotated Bibliography: An Emerging LiteratureRequired Reading: The Top FiveReferences Cited in Software Security: Building Security InGovernment and Standards Publications CitedOther Important ReferencesSoftware Security Puzzle PiecesBasic Science: Open Research Areas
IV. Appendices
A. Fortify Source Code Analysis Suite Tutorial
1. Introducing the Audit WorkbenchExercises for the Reader2. Auditing Source Code ManuallyExercises for the Reader3. Ensuring a Working Build Environment4. Running the Source Code Analysis EngineAnalysis Results of stackbuffer.cAnalysis Results of Eightball.javaAnalysis Results of Sample1.exeExercises for the Reader5. Exploring the Basic SCA Engine Command Line ArgumentsExercises for the Reader6. Understanding Raw Analysis ResultsExercises for the Reader7. Integrating with an Automated Build ProcessIntegrating with a MakefileIntegrating with an ant Build FileAdvanced Command Line Syntax for JavaExercises for the Reader8. Using the Audit WorkbenchExercises for the Reader9. Auditing Open Source ApplicationsExercises for the Reader
B. ITS4 Rules
C. An Exercise in Risk Analysis: Smurfware
SmurfWare SmurfScanner Risk Assessment Case StudyInstructionsSmurfWare SmurfScanner Architecture and Implementation DescriptionSmurfScanner Architecture Component DescriptionQuestionsAnswersSmurfWare SmurfScanner Design for SecurityInstructionsAnswers (Incomplete)
D. Glossary
InsideFrontCover
InsideBackCover

Content preview from Software Security: Building Security In

Appendix . InsideBackCover

InsideBackCover Three Pillars of Software Security

Applied risk management
Software security touchpoints
Knowledge

InsideBackCover Seven Touchpoints

Code review
Architectural risk analysis
Penetration testing
Risk-based security tests
Abuse cases
Security requirements
Security operations

InsideBackCover Seven Pernicious Kingdoms

Input validation and representation
API abuse
Security features
Time and state
Error handling
Code quality
Encapsulation

Environment

Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.

Read now

Unlock full access

More than 5,000 organizations count on O’Reilly

O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.

Julian F.

Head of Cybersecurity

I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.

Addison B.

Field Engineer

I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.

Amir M.

Data Platform Tech Lead

I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.

Mark W.

Embedded Software Engineer

Publisher Resources

ISBN: 0321356705Purchase book

Cloud Computing

Data Engineering

Data Science

AI & ML

Programming Languages

Software Architecture

IT/Ops

Security

Design

Business

Soft Skills

Software Security: Building Security In

by Gary McGraw

Appendix . InsideBackCover

Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.