The Art of Software Security Testing: Identifying Software Security Flaws

 
9780321304865: The Art of Software Security Testing: Identifying Software Security Flaws

Risk-based security testing, the important subject of this book, is one of seven software security touchpoints introduced in my book, Software Security: Building Security In. This book takes the basic idea several steps forward. Written by masters of software exploit, this book describes in very basic terms how security testing differs from standard software testing as practiced by QA groups everywhere. It unifies in one place ideas from Michael Howard, David Litchfield, Greg Hoglund, and me into a concise introductory package. Improve your security testing by reading this book today." -Gary McGraw, Ph.D., CTO, Cigital; Author, Software Security, Exploiting Software, Building Secure Software, and Software Fault Injection; www.cigital.com/~gem "As 2006 closes out, we will see over 5,000 software vulnerabilities announced to the public. Many of these vulnerabilities were, or will be, found in enterprise applications from companies who are staffed with large, professional, QA teams. How then can it be that these flaws consistently continue to escape even well-structured diligent testing? The answer, in part, is that testing still by and large only scratches the surface when validating the presence of security flaws. Books such as this hopefully will start to bring a more thorough level of understanding to the arena of security testing and make us all a little safer over time." -Alfred Huger, Senior Director, Development, Symantec Corporation "Software security testing may indeed be an art, but this book provides the paint-by-numbers to perform good, solid, and appropriately destructive security testing: proof that an ounce of creative destruction is worth a pound of patching later. If understanding how software can be broken is step one in every programmers' twelve-step program to defensible, secure, robust software, then knowledgeable security testing comprises at least steps two through six." -Mary Ann Davidson, Chief Security Officer, Oracle "Over the past few years, several excellent books have come out teaching developers how to write more secure software by describing common security failure patterns. However, none of these books have targeted the tester whose job it is to find the security problems before they make it out of the R&D lab and into customer hands. Into this void comes The Art of Software Security Testing: Identifying Software Security Flaws. The authors, all of whom have extensive experience in security testing, explain how to use free tools to find the problems in software, giving plenty of examples of what a software flaw looks like when it shows up in the test tool. The reader learns why security flaws are different from other types of bugs (we want to know not only that 'the program does what it's supposed to,' but also that 'the program doesn't do that which it's not supposed to'), and how to use the tools to find them. Examples are primarily based on C code, but some description of Java, C#, and scripting languages help for those environments. The authors cover both Windows and UNIX-based test tools, with plenty of screenshots to see what to expect. Anyone who's doing QA testing on software should read this book, whether as a refresher for finding security problems, or as a starting point for QA people who have focused on testing functionality." -Jeremy Epstein, WebMethods State-of-the-Art Software Security Testing: Expert, Up to Date, and Comprehensive The Art of Software Security Testing delivers in-depth, up-to-date, battle-tested techniques for anticipating and identifying software security problems before the "bad guys" do. Drawing on decades of experience in application and penetration testing, this book's authors can help you transform your approach from mere "verification" to proactive "attack." The authors begin by systematically reviewing the design and coding vulnerabilities that can arise in software, and offering realistic guidance in avoiding them. Next, they show you ways to customize software debugging tools to test the unique aspects of any program and then analyze the results to identify exploitable vulnerabilities. Coverage includes * Tips on how to think the way software attackers think to strengthen your defense strategy * Cost-effectively integrating security testing into your development lifecycle * Using threat modeling to prioritize testing based on your top areas of risk * Building testing labs for performing white-, grey-, and black-box software testing * Choosing and using the right tools for each testing project * Executing today's leading attacks, from fault injection to buffer overflows * Determining which flaws are most likely to be exploited by real-world attackers This book is indispensable for every technical professional responsible for software security: testers, QA specialists, security professionals, developers, and more. For IT managers and leaders, it offers a proven blueprint for implementing effective security testing or strengthening existing processes. Foreword xiii Preface xvii Acknowledgments xxix About the Authors xxxi Part I: Introduction Chapter 1: Case Your Own Joint: A Paradigm Shift from Traditional Software Testing 3 Chapter 2: How Vulnerabilities Get Into All Software 19 Chapter 3: The Secure Software Development Lifecycle 55 Chapter 4: Risk-Based Security Testing: Prioritizing Security Testing with Threat Modeling 73 Chapter 5: Shades of Analysis: White, Gray, and Black Box Testing 93 Part II: Performing the Attacks Chapter 6: Generic Network Fault Injection 107 Chapter 7: Web Applications: Session Attacks 125 Chapter 8: Web Applications: Common Issues 141 Chapter 9: Web Proxies: Using WebScarab 169 Chapter 10: Implementing a Custom Fuzz Utility 185 Chapter 11: Local Fault Injection 201 Part III: Analysis Chapter 12: Determining Exploitability 233 Index 251

Le informazioni nella sezione "Riassunto" possono far riferimento a edizioni diverse di questo titolo.

I migliori risultati di ricerca su AbeBooks

1.

Wysopal, Chris; Nelson, Luke; Zovi, Dino Dai; Dustin, Elfriede
Editore: Prentice Hall
ISBN 10: 0321304861 ISBN 13: 9780321304865
Nuovi Quantità: > 20
Da
INDOO
(Avenel, NJ, U.S.A.)
Valutazione libreria
[?]

Descrizione libro Prentice Hall. Condizione libro: New. Brand New. Codice libro della libreria 0321304861

Maggiori informazioni su questa libreria | Fare una domanda alla libreria

Compra nuovo
EUR 44,94
Convertire valuta

Aggiungere al carrello

Spese di spedizione: EUR 3,31
In U.S.A.
Destinazione, tempi e costi

2.

Wysopal, Chris; Nelson, Luke; Zovi, Dino Dai; Dustin, Elfriede
Editore: Addison-Wesley Professional
ISBN 10: 0321304861 ISBN 13: 9780321304865
Nuovi Quantità: 1
Da
Juggernautz
(Troy, MI, U.S.A.)
Valutazione libreria
[?]

Descrizione libro Addison-Wesley Professional. Condizione libro: New. 0321304861 Orders ship same or next business day w/ free tracking. Choose Expedited shipping for fastest (2-6 business day) delivery. Satisfaction Guaranteed. Codice libro della libreria Z0321304861ZN

Maggiori informazioni su questa libreria | Fare una domanda alla libreria

Compra nuovo
EUR 44,60
Convertire valuta

Aggiungere al carrello

Spese di spedizione: EUR 3,78
In U.S.A.
Destinazione, tempi e costi

3.

Wysopal, Chris; Nelson, Luke; Zovi, Dino Dai; Dustin, Elfriede
Editore: Pearson Education (US), United States (2006)
ISBN 10: 0321304861 ISBN 13: 9780321304865
Nuovi Paperback Quantità: 1
Da
The Book Depository US
(London, Regno Unito)
Valutazione libreria
[?]

Descrizione libro Pearson Education (US), United States, 2006. Paperback. Condizione libro: New. 231 x 173 mm. Language: English . Brand New Book. Risk-based security testing, the important subject of this book, is one of seven software security touchpoints introduced in my book, Software Security: Building Security In. This book takes the basic idea several steps forward. Written by masters of software exploit, this book describes in very basic terms how security testing differs from standard software testing as practiced by QA groups everywhere. It unifies in one place ideas from Michael Howard, David Litchfield, Greg Hoglund, and me into a concise introductory package. Improve your security testing by reading this book today. -Gary McGraw, Ph.D., CTO, Cigital; Author, Software Security, Exploiting Software, Building Secure Software, and Software Fault Injection; As 2006 closes out, we will see over 5,000 software vulnerabilities announced to the public. Many of these vulnerabilities were, or will be, found in enterprise applications from companies who are staffed with large, professional, QA teams. How then can it be that these flaws consistently continue to escape even well-structured diligent testing? The answer, in part, is that testing still by and large only scratches the surface when validating the presence of security flaws. Books such as this hopefully will start to bring a more thorough level of understanding to the arena of security testing and make us all a little safer over time. -Alfred Huger, Senior Director, Development, Symantec Corporation Software security testing may indeed be an art, but this book provides the paint-by-numbers to perform good, solid, and appropriately destructive security testing: proof that an ounce of creative destruction is worth a pound of patching later. If understanding how software can be broken is step one in every programmers twelve-step program to defensible, secure, robust software, then knowledgeable security testing comprises at least steps two through six. -Mary Ann Davidson, Chief Security Officer, Oracle Over the past few years, several excellent books have come out teaching developers how to write more secure software by describing common security failure patterns. However, none of these books have targeted the tester whose job it is to find the security problems before they make it out of the RD lab and into customer hands. Into this void comes The Art of Software Security Testing: Identifying Software Security Flaws. The authors, all of whom have extensive experience in security testing, explain how to use free tools to find the problems in software, giving plenty of examples of what a software flaw looks like when it shows up in the test tool. The reader learns why security flaws are different from other types of bugs (we want to know not only that the program does what it s supposed to, but also that the program doesn t do that which it s not supposed to ), and how to use the tools to find them. Examples are primarily based on C code, but some description of Java, C#, and scripting languages help for those environments. The authors cover both Windows and UNIX-based test tools, with plenty of screenshots to see what to expect. Anyone who s doing QA testing on software should read this book, whether as a refresher for finding security problems, or as a starting point for QA people who have focused on testing functionality. -Jeremy Epstein, WebMethods State-of-the-Art Software Security Testing: Expert, Up to Date, and Comprehensive The Art of Software Security Testing delivers in-depth, up-to-date, battle-tested techniques for anticipating and identifying software security problems before the bad guys do. Drawing on decades of experience in application and penetration testing, this book s authors can help you transform your approach from mere verification to proactive attack. The authors begin by systematically reviewing the design and coding vulnerabilities that can arise in software, and offering realistic guidance in avoiding them. Next, they show you ways to customize softwa. Codice libro della libreria AAC9780321304865

Maggiori informazioni su questa libreria | Fare una domanda alla libreria

Compra nuovo
EUR 49,36
Convertire valuta

Aggiungere al carrello

Spese di spedizione: GRATIS
Da: Regno Unito a: U.S.A.
Destinazione, tempi e costi

4.

Wysopal, Chris; Nelson, Luke; Zovi, Dino Dai; Dustin, Elfriede
Editore: Pearson Education (US), United States (2006)
ISBN 10: 0321304861 ISBN 13: 9780321304865
Nuovi Paperback Quantità: 1
Da
The Book Depository
(London, Regno Unito)
Valutazione libreria
[?]

Descrizione libro Pearson Education (US), United States, 2006. Paperback. Condizione libro: New. 231 x 173 mm. Language: English . Brand New Book. Risk-based security testing, the important subject of this book, is one of seven software security touchpoints introduced in my book, Software Security: Building Security In. This book takes the basic idea several steps forward. Written by masters of software exploit, this book describes in very basic terms how security testing differs from standard software testing as practiced by QA groups everywhere. It unifies in one place ideas from Michael Howard, David Litchfield, Greg Hoglund, and me into a concise introductory package. Improve your security testing by reading this book today. -Gary McGraw, Ph.D., CTO, Cigital; Author, Software Security, Exploiting Software, Building Secure Software, and Software Fault Injection; As 2006 closes out, we will see over 5,000 software vulnerabilities announced to the public. Many of these vulnerabilities were, or will be, found in enterprise applications from companies who are staffed with large, professional, QA teams. How then can it be that these flaws consistently continue to escape even well-structured diligent testing? The answer, in part, is that testing still by and large only scratches the surface when validating the presence of security flaws. Books such as this hopefully will start to bring a more thorough level of understanding to the arena of security testing and make us all a little safer over time. -Alfred Huger, Senior Director, Development, Symantec Corporation Software security testing may indeed be an art, but this book provides the paint-by-numbers to perform good, solid, and appropriately destructive security testing: proof that an ounce of creative destruction is worth a pound of patching later. If understanding how software can be broken is step one in every programmers twelve-step program to defensible, secure, robust software, then knowledgeable security testing comprises at least steps two through six. -Mary Ann Davidson, Chief Security Officer, Oracle Over the past few years, several excellent books have come out teaching developers how to write more secure software by describing common security failure patterns. However, none of these books have targeted the tester whose job it is to find the security problems before they make it out of the RD lab and into customer hands. Into this void comes The Art of Software Security Testing: Identifying Software Security Flaws. The authors, all of whom have extensive experience in security testing, explain how to use free tools to find the problems in software, giving plenty of examples of what a software flaw looks like when it shows up in the test tool. The reader learns why security flaws are different from other types of bugs (we want to know not only that the program does what it s supposed to, but also that the program doesn t do that which it s not supposed to ), and how to use the tools to find them. Examples are primarily based on C code, but some description of Java, C#, and scripting languages help for those environments. The authors cover both Windows and UNIX-based test tools, with plenty of screenshots to see what to expect. Anyone who s doing QA testing on software should read this book, whether as a refresher for finding security problems, or as a starting point for QA people who have focused on testing functionality. -Jeremy Epstein, WebMethods State-of-the-Art Software Security Testing: Expert, Up to Date, and Comprehensive The Art of Software Security Testing delivers in-depth, up-to-date, battle-tested techniques for anticipating and identifying software security problems before the bad guys do. Drawing on decades of experience in application and penetration testing, this book s authors can help you transform your approach from mere verification to proactive attack. The authors begin by systematically reviewing the design and coding vulnerabilities that can arise in software, and offering realistic guidance in avoiding them. Next, they show you ways to customize softwa. Codice libro della libreria AAC9780321304865

Maggiori informazioni su questa libreria | Fare una domanda alla libreria

Compra nuovo
EUR 60,45
Convertire valuta

Aggiungere al carrello

Spese di spedizione: GRATIS
Da: Regno Unito a: U.S.A.
Destinazione, tempi e costi

5.

Wysopal, Chris; Nelson, Luke; Zovi, Dino Dai; Dustin, Elfriede
Editore: Addison-Wesley Professional (2006)
ISBN 10: 0321304861 ISBN 13: 9780321304865
Nuovi Brossura Quantità: 1
Da
Book Deals
(Lewiston, NY, U.S.A.)
Valutazione libreria
[?]

Descrizione libro Addison-Wesley Professional, 2006. Condizione libro: New. Brand New, Unread Copy in Perfect Condition. A+ Customer Service! Summary: Foreword xiii Preface xvii Acknowledgments xxix About the Authors xxxi Part I: Introduction Chapter 1: Case Your Own Joint: A Paradigm Shift from Traditional Software Testing 3 Chapter 2: How Vulnerabilities Get Into All Software 19 Chapter 3: The Secure Software Development Lifecycle 55 Chapter 4: Risk-Based Security Testing: Prioritizing Security Testing with Threat Modeling 73 Chapter 5: Shades of Analysis: White, Gray, and Black Box Testing 93 Part II: Performing the Attacks Chapter 6: Generic Network Fault Injection 107 Chapter 7: Web Applications: Session Attacks 125 Chapter 8: Web Applications: Common Issues 141 Chapter 9: Web Proxies: Using WebScarab 169 Chapter 10: Implementing a Custom Fuzz Utility 185 Chapter 11: Local Fault Injection 201 Part III: Analysis Chapter 12: Determining Exploitability 233 Index 251. Codice libro della libreria ABE_book_new_0321304861

Maggiori informazioni su questa libreria | Fare una domanda alla libreria

Compra nuovo
EUR 62,30
Convertire valuta

Aggiungere al carrello

Spese di spedizione: GRATIS
In U.S.A.
Destinazione, tempi e costi

6.

Wysopal, Chris; Nelson, Luke; Zovi, Dino Dai; Dustin, Elfriede
Editore: Addison-Wesley Professional (2006)
ISBN 10: 0321304861 ISBN 13: 9780321304865
Nuovi Paperback Quantità: 1
Da
Irish Booksellers
(Rumford, ME, U.S.A.)
Valutazione libreria
[?]

Descrizione libro Addison-Wesley Professional, 2006. Paperback. Condizione libro: New. book. Codice libro della libreria 0321304861

Maggiori informazioni su questa libreria | Fare una domanda alla libreria

Compra nuovo
EUR 63,65
Convertire valuta

Aggiungere al carrello

Spese di spedizione: GRATIS
In U.S.A.
Destinazione, tempi e costi

7.

Wysopal, Chris; Nelson, Luke; Zovi, Dino Dai; Dustin, Elfriede
Editore: Addison-Wesley Professional
ISBN 10: 0321304861 ISBN 13: 9780321304865
Nuovi PAPERBACK Quantità: 1
Da
Movie Mars
(Indian Trail, NC, U.S.A.)
Valutazione libreria
[?]

Descrizione libro Addison-Wesley Professional. PAPERBACK. Condizione libro: New. 0321304861 Brand New Book. Ships from the United States. 30 Day Satisfaction Guarantee!. Codice libro della libreria 4195416

Maggiori informazioni su questa libreria | Fare una domanda alla libreria

Compra nuovo
EUR 60,72
Convertire valuta

Aggiungere al carrello

Spese di spedizione: EUR 3,78
In U.S.A.
Destinazione, tempi e costi

8.

Wysopal, Chris; Nelson, Luke; Zovi, Dino Dai; Dustin, Elfriede
ISBN 10: 0321304861 ISBN 13: 9780321304865
Nuovi Paperback Prima edizione Quantità: 1
Da
Grand Eagle Retail
(Wilmington, DE, U.S.A.)
Valutazione libreria
[?]

Descrizione libro Paperback. Condizione libro: New. 1st. 176mm x 19mm x 232mm. Paperback. Risk-based security testing, the important subject of this book, is one of seven software security touchpoints introduced in my book, "Software Security: Building Security In." T.Shipping may be from multiple locations in the US or from the UK, depending on stock availability. 266 pages. 0.599. Codice libro della libreria 9780321304865

Maggiori informazioni su questa libreria | Fare una domanda alla libreria

Compra nuovo
EUR 74,42
Convertire valuta

Aggiungere al carrello

Spese di spedizione: GRATIS
In U.S.A.
Destinazione, tempi e costi

9.

Wysopal, Chris; Nelson, Luke; Zovi, Dino Dai; Dustin, Elfriede
Editore: Addison-Wesley Professional (2006)
ISBN 10: 0321304861 ISBN 13: 9780321304865
Nuovi Brossura Quantità: > 20
Da
Palexbooks
(Sanford, NC, U.S.A.)
Valutazione libreria
[?]

Descrizione libro Addison-Wesley Professional, 2006. Condizione libro: New. Brand new! Please provide a physical shipping address. Codice libro della libreria 9780321304865

Maggiori informazioni su questa libreria | Fare una domanda alla libreria

Compra nuovo
EUR 75,45
Convertire valuta

Aggiungere al carrello

Spese di spedizione: EUR 2,84
In U.S.A.
Destinazione, tempi e costi

10.

Wysopal, Chris; Nelson, Luke; Zovi, Dino Dai; Dustin, Elfriede
Editore: Addison-Wesley (2006)
ISBN 10: 0321304861 ISBN 13: 9780321304865
Nuovi Paperback Quantità: 1
Da
Revaluation Books
(Exeter, Regno Unito)
Valutazione libreria
[?]

Descrizione libro Addison-Wesley, 2006. Paperback. Condizione libro: Brand New. 1st edition. 266 pages. 9.00x7.00x0.75 inches. In Stock. Codice libro della libreria x-0321304861

Maggiori informazioni su questa libreria | Fare una domanda alla libreria

Compra nuovo
EUR 78,43
Convertire valuta

Aggiungere al carrello

Spese di spedizione: EUR 7,14
Da: Regno Unito a: U.S.A.
Destinazione, tempi e costi

Vedi altre copie di questo libro

Vedi tutti i risultati per questo libro