Software Security Engineering: A Guide for Project Managers

Name: Software Security Engineering: A Guide for Project Managers
Rating: 3.5 (8 reviews)
Author: Julia Allen
ISBN: 9780321509178

Julia Allen

8 valutazioni di Goodreads

Lingua: inglese

Editore: Pearson Education (US), 2008

032150917X / 9780321509178

Serie: Libro 1 di 27 - SEI Series in Software Engineering

Brossura
Usato

Visualizza tutti i dettagli

Da: World of Books (was SecondSale), Montgomery, IL, U.S.A.World of Books (was SecondSale)

Venditore con 5 stelle

Venditore AbeBooks dal 20 dicembre 2007

Visualizza gli articoli di questo venditore

Brossura

Condizione: Usato - Buono

EUR 5,53

Spedizione gratuita

Spedito in U.S.A.

Quantità: 1 disponibile

Aggiungi al carrello

Resi gratuiti per 30 giorni

Lista dei preferitiCrea un desiderata per articoli simili

Descrizione dell’articolo da parte del venditore

?This book?s broad overview can help an organization choose a set of processes, policies, and techniques that are appropriate for its security maturity, risk tolerance, and development style. This book will help you understand how to incorporate practical security techniques into all phases of the development lifecycle.? ?Steve Riley, senior security strategist, Microsoft Corporation ?There are books written on some of the topics addressed in this book, and there are other books on secure systems engineering. Few address the entire life cycle with a comprehensive overview and discussion of emerging trends and topics as well as this one.? ?Ronda Henning, senior scientist-software/security queen, Harris Corporation Software that is developed from the beginning with security in mind will resist, tolerate, and recover from attacks more effectively than would otherwise be possible. While there may be no silver bullet for security, there are practices that project managers will find beneficial. With this management guide, you can select from a number of sound practices likely to increase the security and dependability of your software, both during its development and subsequently in its operation. Software Security Engineering draws extensively on the systematic approach developed for the Build Security In (BSI) Web site. Sponsored by the Department of Homeland Security Software Assurance Program, the BSI site offers a host of tools, guidelines, rules, principles, and other resources to help project managers address security issues in every phase of the software development life cycle (SDLC). The book?s expert authors, themselves frequent contributors to the BSI site, represent two well-known resources in the security world: the CERT Program at the Software Engineering Institute (SEI) and Cigital, Inc., a consulting firm specializing in software security. This book will help you understand why Software security is about more than just eliminating vulnerabilities and conducting penetration tests Network security mechanisms and IT infrastructure security services do not sufficiently protect application software from security risks Software security initiatives should follow a risk-management approach to identify priorities and to define what is ?good enough??understanding that software security risks will change throughout the SDLC Project managers and software engineers need to learn to think like an attacker in order to address the range of functions that software should not do, and how software can better resist, tolerate, and recover when under attack Chapter 1: Why Is Security a Software Issue? 1 1.1 Introduction 1 1.2 The Problem 2 1.3 Software Assurance and Software Security 6 1.4 Threats to Software Security 9 1.5 Sources of Software Insecurity 11 1.6 The Benefits of Detecting Software Security Defects Early 13 1.7 Managing Secure Software Development 18 1.8 Summary 23 Chapter 2: What Makes Software Secure? 25 2.1 Introduction 25 2.2 Defining Properties of Secure Software 26 2.3 How to Influence the Security Properties of Software 36 2.4 How to Assert and Specify Desired Security Properties 61 2.5 Summary 71 Chapter 3: Requirements Engineering for Secure Software 73 3.1 Introduction 73 3.2 Misuse and Abuse Cases 78 3.3 The SQUARE Process Model 84 3.4 SQUARE Sample Outputs 91 3.5 Requirements Elicitation 99 3.6 Requirements Prioritization 106 3.7 Summary 112 Chapter 4: Secure Software Architecture and Design 115 4.1 Introduction 115 4.2 Software Security Practices for Architecture and Design: Architectural Risk Analysis 119 4.3 Software Security Knowledge for Architecture and Design: Security Principles, Security Guidelines, and Attack Patterns 137 4.4 Summary 148 Chapter 5: Considerations for Secure Coding and Testing 151 5.1 Introduction 151 5.2 Code Analysis 152 5.3 Coding Practices 160 5.4 Software Security Testing 163 5.5 Security Testing Considerations Throughout the SDLC 173 5.6 Summary 180.…

Codice articolo CIN032150917XG

Contatta il venditore per questo articolo

Segnala questo articolo

Titolo: Software Security Engineering: A Guide for Project Managers
Autore: Julia Allen
Editore: Pearson Education (US)
Anno di pubblicazione: 2008
Condizione: Good
Rilegatura: Paperback
Lingua: inglese
ISBN 10: 032150917X
ISBN 13: 9780321509178
Serie: Libro 1 di 27: SEI Series in Software Engineering

“This book’s broad overview can help an organization choose a set of processes, policies, and techniques that are appropriate for its security maturity, risk tolerance, and development style. This book will help you understand how to incorporate practical security techniques into all phases of the development lifecycle.”       —Steve Riley, senior security strategist, Microsoft Corporation   “There are books written on some of the topics addressed in this book, and there are other books on secure systems engineering. Few address the entire life cycle with a comprehensive overview and discussion of emerging trends and topics as well as this one.”       —Ronda Henning, senior scientist-software/security queen, Harris Corporation   Software that is developed from the beginning with security in mind will resist, tolerate, and recover from attacks more effectively than would otherwise be possible. While there may be no silver bullet for security, there are practices that project managers will find beneficial. With this management guide, you can select from a number of sound practices likely to increase the security and dependability of your software, both during its development and subsequently in its operation.   Software Security Engineering draws extensively on the systematic approach developed for the Build Security In (BSI) Web site. Sponsored by the Department of Homeland Security Software Assurance Program, the BSI site offers a host of tools, guidelines, rules, principles, and other resources to help project managers address security issues in every phase of the software development life cycle (SDLC). The book’s expert authors, themselves frequent contributors to the BSI site, represent two well-known resources in the security world: the CERT Program at the Software Engineering Institute (SEI) and Cigital, Inc., a consulting firm specializing in software security.   This book will help you understand why <ul> <li> <div style="margin: 0px;"> Software security is about more than just eliminating vulnerabilities and conducting penetration tests </div></li> <li> <div style="margin: 0px;"> Network security mechanisms and IT infrastructure security services do not sufficiently protect application software from security risks </div></li> <li> <div style="margin: 0px;"> Software security initiatives should follow a risk-management approach to identify priorities and to define what is “good enough”—understanding that software security risks will change throughout the SDLC </div></li> <li> <div style="margin: 0px;"> Project managers and software engineers need to learn to think like an attacker in order to address the range of functions that software should not do, and how software can better resist, tolerate, and recover when under attack </div></li> </ul> Chapter 1: Why Is Security a Software Issue? 1 1.1 Introduction 1 1.2 The Problem 2 1.3 Software Assurance and Software Security 6 1.4 Threats to Software Security 9 1.5 Sources of Software Insecurity 11 1.6 The Benefits of Detecting Software Security Defects Early 13 1.7 Managing Secure Software Development 18 1.8 Summary 23   Chapter 2: What Makes Software Secure? 25 2.1 Introduction 25 2.2 Defining Properties of Secure Software 26 2.3 How to Influence the Security Properties of Software 36 2.4 How to Assert and Specify Desired Security Properties 61 2.5 Summary 71   Chapter 3: Requirements Engineering for Secure Software 73 3.1 Introduction 73 3.2 Misuse and Abuse Cases 78 3.3 The SQUARE Process Model 84 3.4 SQUARE Sample Outputs 91 3.5 Requirements Elicitation 99 3.6 Requirements Prioritization 106 3.7 Summary 112   Chapter 4: Secure Software Architecture and Design 115 4.1 Introduction 115 4.2 Software Security Practices for Architecture and Design: Architectural Risk Analysis 119 4.3 Software Security Knowledge for Architecture and Design: Security Principles, Security Guidelines, and Attack Patterns 137 4.4 Summary 148   Chapter 5: Considerations for Secure Coding and Testing 151 5.1 Introduction 151 5.2 Code Analysis 152 5.3 Coding Practices 160 5.4 Software Security Testing 163 5.5 Security Testing Considerations Throughout the SDLC 173 5.6 Summary 180   Chapter 6: Security and Complexity: System Assembly Challenges 183 6.1 Introduction 183 6.2 Security Failures 186 6.3 Functional and Attacker Perspectives for Security Analysis: Two Examples 189 6.4 System Complexity Drivers and Security 203 6.5 Deep Technical Problem Complexity 215 6.6 Summary 217   Chapter 7: Governance, and Managing for More Secure Software 221 7.1 Introduction 221 7.2 Governance and Security 223 7.3 Adopting an Enterprise Software Security Framework 226 7.4 How Much Security Is Enough? 236 7.5 Security and Project Management 244 7.6 Maturity of Practice 259 7.7 Summary 266   Chapter 8: Getting Started 267 8.1 Where to Begin 269 8.2 In Closing 281

"Riassunto" può appartenere a un’altra edizione di questo titolo.

Informazioni sull’autore

Julia H. Allen is a senior member of the technical staff within the CERT Program at the Software Engineering Institute (SEI), a unit of Carnegie Mellon University in Pittsburgh, PA. In addition to her work in software security and assurance, Allen is engaged in developing and transitioning executive outreach programs in enterprise security and governance. She is the author of The CERT Guide to System and Network Security Practices (Addison-Wesley, 2001), Governing for Enterprise Security (CMU/SEI, 2005), and the CERT Podcast Series: Security for Business Leaders (2006/2007).   Sean Barnum is a Principal Consultant at Cigital and is technical lead for their federal services practice. He has more than twenty years of experience in the software industry in the areas of development, software quality assurance, quality management, process architecture and improvement, knowledge management, and security. He is a frequent contributor and speaker for regional and national software security and software quality publications, conferences, and events. He is very active in the software assurance community and is involved in numerous knowledge standards-defining efforts, including the Common Weakness Enumeration (CWE), the Common Attack Pattern Enumeration and Classification (CAPEC), and other elements of the Software Assurance Programs of the Department of Homeland Security and the Department of Defense. He is also the lead technical subject matter expert for the Air Force Application Software Assurance Center of Excellence.   Robert J. Ellison, Ph.D., is a member of the Survivable Systems Engineering Team within the CERT Program at the Software Engineering Institute and, in that capacity, has served in a number of technical and management roles. He was a project leader for the evaluation of software engineering development environments and associated software development tools. He was also a member of the Carnegie Mellon University team that wrote the proposal for the SEI; he joined the new FFRDC in 1985 as a founding member. Ellison regularly participates in the evaluation of software architectures and contributes from the perspective of security and reliability measures.   Gary McGraw, Ph.D., is the CTO of Cigital, Inc., a software security and quality consulting firm with headquarters in the Washington, D.C., area. He is a globally recognized authority on software security and the author of six best selling books on this topic. The latest is Exploiting Online Games (Addison-Wesley, 2008). His other titles include Java Security, Building Secure Software, Exploiting Software, and Software Security; and he is editor of the Addison-Wesley Software Security series. McGraw has also written more than ninety peer-reviewed scientific publications, authors a monthly security column for darkreading.com, and is frequently quoted in the press. Besides serving as a strategic counselor for top business and IT executives, Gary is on the Advisory Boards of Fortify Software and Raven White. He serves on the Dean’s Advisory Council for the School of Informatics at Indiana University. Gary is an IEEE Computer Society Board of Governors member and produces the monthly Silver Bullet Security Podcast for IEEE Security & Privacy magazine.   Nancy R. Mead, Ph.D., is a senior member of the technical staff in the Survivable Systems Engineering Group, which is part of the CERT Program at the Software Engineering Institute. Mead is also a faculty member in the Master of Software Engineering and Master of Information Systems Management programs at Carnegie Mellon University. She has more than one hundred publications and invited presentations. She is a fellow of the Institute of Electrical and Electronic Engineers, Inc. (IEEE) and the IEEE Computer Society and is also a member of the Association for Computing Machinery (ACM).

"Descrizione articolo" può appartenere a un’altra edizione di questo titolo.

World of Books (was SecondSale)

Montgomery, IL, U.S.A.

Venditore con 5 stelle

Venditore AbeBooks dal 20 dicembre 2007

Tariffe di spedizione nazionale per U.S.A.

Articolo	Da 4 a 12 giorni lavorativi	Da 3 a 6 giorni lavorativi
Primo articolo	EUR 0,00	EUR 9,82

I tempi di consegna sono stabiliti dai venditori e variano in base al corriere e al paese. Gli ordini che devono attraversare una dogana possono subire ritardi e spetta agli acquirenti pagare eventuali tariffe o dazi associati. I venditori possono contattarti in merito ad addebiti aggiuntivi dovuti a eventuali maggiorazioni dei costi di spedizione dei tuoi articoli.

Metodi di pagamento

Descrizione dello Store

Founded in 2002, World of Books is a leading online destination for buying and selling both preloved and new books, committed to making sustainable reading accessible to all. With a mission to help people read more and waste less, World of Books offers a huge range of affordable, high-quality books — giving both new and preloved titles a second life. The company also operates World of Books – Sell Your Books, an easy-to-use platform that allows customers to trade in unwanted books for cash, helping to keep books in circulation while promoting sustainability. As a Certified B Corp, World of Books is driven by a vision to become the world’s largest and most sustainable dedicated online bookstore. The company measures its success through the positive environmental impact it creates, the value it provides to customers, and its ability to operate profitably while supporting its sustainable mission …

Informazioni sull’azienda del venditore

SBYB, Inc.

900 Knell Rd
Montgomery, IL U.S.A. 60538

Contatta il venditoreVisualizza gli articoli di questo venditoreVisita la vetrina del venditore

Condizioni di vendita

We guarantee the condition of every book as it's described on the Abebooks web sites. If you're dissatisfied with your purchase (Incorrect Book/Not as Described/Damaged) or if the order hasn't arrived, you're eligible for a refund within 30 days of the estimated delivery date. If you've changed your mind about a book that you've ordered, please use the Ask bookseller a question link to contact us and we'll respond within 2 business days.

Diritto di recesso

Se sei un consumatore puoi recedere dal contratto in conformità con quanto segue. Per Consumatore si intende qualsiasi persona fisica che agisce per scopi estranei alla propria attività commerciale, imprenditoriale, artigianale o professionale.

Informazioni sul diritto di recesso

Diritto legale di recesso

Hai il diritto di recedere dal presente contratto entro 14 giorni senza fornire alcuna motivazione.

Il periodo di recesso scade dopo 14 giorni dal giorno in cui tu o una terza parte, diversa dal vettore e da te indicata, acquisisce il possesso fisico dell'ultimo bene o dell'ultimo lotto o pezzo.

Per esercitare il diritto di recesso, compila e invia elettronicamente una dichiarazione esplicita sul nostro sito Web, alla voce “I miei acquisti” nella sezione “Mio account”. Ti comunicheremo senza indugio una conferma di ricezione di tale recesso su un supporto durevole (ad es. via e-mail).

Per rispettare il termine di recesso, è sufficiente inviare la comunicazione relativa all'esercizio del diritto di recesso prima della scadenza del periodo di recesso stesso.

Effetti del recesso

In caso di recesso dal presente contratto, ti rimborseremo tutti i pagamenti ricevuti, compresi i costi di spedizione (ad eccezione dei costi supplementari derivanti dalla tua eventuale scelta di un tipo di spedizione diverso dal tipo meno costoso di consegna standard da noi offerto).

Potremo effettuare una detrazione dal rimborso per la perdita di valore dei beni forniti, qualora tale perdita sia il risultato di una manipolazione non necessaria da parte tua.

Eseguiremo il rimborso senza indebito ritardo e non oltre 14 giorni dal giorno in cui saremo informati della tua decisione di recedere dal presente contratto.

Il rimborso sarà effettuato utilizzando lo stesso mezzo di pagamento da te usato per la transazione iniziale, salvo che tu non abbia espressamente concordato altrimenti; in ogni caso, non dovrai sostenere alcun costo quale conseguenza di tale rimborso.

Possiamo trattenere il rimborso finché non avremo ricevuto i beni oppure finché non avrai fornito la prova di averli rispediti, a seconda di quale condizione si verifichi per prima.

Dovrai rispedire i beni o consegnarli a World of Books (was SecondSale), Montgomery, Illinois, U.S.A., senza indebito ritardo e, in ogni caso, entro 14 giorni dal giorno in cui ci hai comunicato la tua volontà di recedere dal presente contratto. Il termine è rispettato se rispedisci i beni prima della scadenza del periodo di 14 giorni. I costi diretti della restituzione dei beni saranno a tuo carico. Sei responsabile solo della diminuzione del valore dei beni risultante da una manipolazione diversa da quella necessaria per stabilire la natura, le caratteristiche e il funzionamento dei beni stessi.

Eccezioni al diritto di recesso

Il diritto di recesso non si applica a:

La fornitura di giornali, periodici o riviste ad eccezione dei contratti di abbonamento; e
La fornitura di contenuto digitale non fornito su un supporto materiale (ad es. su un CD o DVD), se al momento dell'invio dell'ordine hai accettato l'inizio dell'esecuzione e hai riconosciuto che non avresti potuto recedere una volta iniziata l'esecuzione.

Condizioni di spedizione

Shipping costs are based on books weighing 2.2 LB, or 1 KG. If your book order is heavy or oversized, we may contact you to let you know extra shipping is required.