Writing Secure Code - Brossura

Howard, Michael; Leblanc, David

Brossura

ISBN 10: 0735617228 ISBN 13: 9780735617223

Casa editrice: Microsoft Pr, 2002

Riassunto

Keep black-hat hackers at bay with the tips and techniques in this entertaining, eye-opening book! Developers will learn how to padlock their applications throughout the entire development process—from designing secure applications to writing robust code that can withstand repeated attacks to testing applications for security flaws. Short, easily digested chapters reveal proven principles, strategies, and coding techniques. The authors—two battle-scarred veterans who have solved some of the industry’s toughest security problems—provide sample code in several languages. This edition includes updated information about threat modeling, designing a security process, international issues, file-system issues, adding privacy to applications, and performing security code reviews. It also includes enhanced coverage of buffer overruns, Microsoft® .NET security, and Microsoft ActiveX® development, plus practical checklists for developers, testers, and program managers.

Su questo libro

L'autore

Michael Howard, CISSP, is a leading security expert. He is a senior security program manager at Microsoft® and the coauthor of The Software Security Development Lifecycle. Michael has worked on Windows security since 1992 and now focuses on secure design, programming, and testing techniques. He is the consulting editor for the Secure Software Development Series of books by Microsoft Press.

David LeBlanc, Ph.D., is a founding member of the Trustworthy Computing Initiative at Microsoft®. He has been developing solutions for computing security issues since 1992 and has created award-winning tools for assessing network security and uncovering security vulnerabilities. David is a senior developer in the Microsoft Office Trustworthy Computing group.

Contenuti

CopyrightDedicationIntroductionPart I: Contemporary Security

• Chapter 1: The Need for Secure Systems
• Chapter 2: The Proactive Security Development Process
• Chapter 3: Security Principles to Live By
• Chapter 4: Threat Modeling

Part II: Secure Coding Techniques

• Chapter 5: Public Enemy #1: The Buffer Overrun
• Chapter 6: Determining Appropriate Access Control
• Chapter 7: Running with Least Privilege
• Chapter 8: Cryptographic Foibles
• Chapter 9: Protecting Secret Data
• Chapter 10: All Input Is Evil!
• Chapter 11: Canonical Representation Issues
• Chapter 12: Database Input Issues
• Chapter 13: Web-Specific Input Issues
• Chapter 14: Internationalization Issues

Part III: Even More Secure Coding Techniques

• Chapter 15: Socket Security
• Chapter 16: Securing RPC, ActiveX Controls, and DCOM
• Chapter 17: Protecting Against Denial of Service Attacks
• Chapter 18: Writing Secure .NET Code

Part IV: Special Topics

• Chapter 19: Security Testing
• Chapter 20: Performing a Security Code Review
• Chapter 21: Secure Software Installation
• Chapter 22: Building Privacy into Your Application
• Chapter 23: General Good Practices
• Chapter 24: Writing Security Documentation and Error Messages

Part V: Appendixes

• Appendix A: Dangerous APIs
• Appendix B: Ridiculous Excuses We’ve Heard
• Appendix C: A Designer’s Security Checklist
• Appendix D: A Developer’s Security Checklist
• Appendix E: A Tester’s Security Checklist
• Appendix F: Annotated Bibliography

About the Author

Dettagli dell?edizione

• Editore: Microsoft Pr
• Data di pubblicazione: 2002
• ISBN 10: 0735617228
• ISBN 13: 9780735617223
• Rilegatura: Copertina flessibile
• Lingua: Inglese
• Numero di pagine: 650