Software Security: Building Security In
by Gary McGraw
List Price:
Our Price: $39.14
You Save: $25.85 (40%)
Availability: Usually ships in 1-2 business days
Category: Book
See more book details and other editions
Book Summary Information
Author: Gary McGrawEdition: Paperback
Audio: English (Unknown); English (Original Language); English (Published)
Published: 2006-02-02
ISBN: 0321356705
Number of pages: 448
Publisher: Addison-Wesley Professional
Book Reviews of Software Security: Building Security In
Book Review: A powerful book with deep truths for secure development
Summary: 5 Stars
I read six books on software security recently, namely "Writing Secure Code, 2nd Ed" by Michael Howard and David LeBlanc; "19 Deadly Sins of Software Security" by Michael Howard, David LeBlanc, and John Viega; "Software Security" by Gary McGraw; "The Security Development Lifecycle" by Michael Howard and Steve Lipner; "High-Assurance Design" by Cliff Berg; and "Security Patterns" by Markus Schumacher, et al. Each book takes a different approach to the software security problem, although the first two focus on coding bugs and flaws; the second two examine development processes; and the last two discuss practices or patterns for improved design and implementation. My favorite of the six is Gary McGraw's, thanks to his clear thinking and logical analysis. The other five are still noteworthy books. All six will contribute to the production of more security software.
Gary McGraw's book gets my vote as the best of the six because it made the biggest impact on the way I look at the software security problem. First, Gary emphasizes the differences between bugs (coding errors) and flaws (deeper architectural problems). He shows that automated code inspection tools can be applied more or less successfully to the first problem set, but human investigation is required to address the second. Gary applauds the diversity of backgrounds found in today's security professionals, but wonders what will happen when this rag-tag bunch (myself included) is eventually replaced by "formally" trained college security graduates.
Second, Gary explains that although tools cannot replace a flaw-finding human, they can assist programmers trying to avoid writing bugs. Gary is the only author I encountered who acknowledged that it is unrealistic to expect a programmer to keep dozens or hundreds of sound coding practices and historical vulnerabilities in his head while writing software. An automated tool is a powerful way to apply secure coding lessons in a repeatable and measurable manner. Gary also reframed the way I look at software penetration testing, by showing in ch 6 that they are best used to discover environmental and configuration problems of software in production.
Third, Gary is not afraid to point out the problems with other interpretations of the software security problem. I almost fell out of my chair when I read his critique on pp 140-7 and p 213 of Microsoft's improper use of terms like "threat" in their so-called "threat model." Gary is absolutely right to say Microsoft is performing "risk analysis," not "threat analysis." (I laughed when I read him describe Microsoft's "Threat Modeling" as "[t]he unfortunately titled book" on p 310.) I examine this issue deeper in my reviews of Microsoft's books. Gary is also correct when he states on p 153 that "security is more like insurance than it is some kind of investment." I bookmarked the section (pp 292, 296-7) where Gary explained how the "19 Deadly Sins of Software Security" mix "specific types of errors and vulnerability classes and talk about them all at the same level of abstraction." He's also right that the OWASP Top Ten suffers the same problem. Finally, Gary understands the relationships between operators and developers and the importance of security vocabulary.
I was pleasantly surprised by "Software Security". I reviewed an early draft for Addison-Wesley and wondered where the author was taking this book. It ended up being my favorite software security book, easily complementing Gary's earlier book "Building Secure Software." In my opinion, Gary is thinking properly about all the fundamental issues that matter. This book should be distributed to all Microsoft developers to help them frame the software security problem properly.
Summary of Software Security: Building Security In
"When it comes to software security, the devil is in the details. This book tackles the details."
--Bruce Schneier, CTO and founder, Counterpane, and author of Beyond Fear and Secrets and Lies
"McGraw's book shows you how to make the 'culture of security' part of your development lifecycle."
--Howard A. Schmidt, Former White House Cyber Security Advisor
"McGraw is leading the charge in software security. His advice is as straightforward as it is actionable. If your business relies on software (and whose doesn't), buy this book and post it up on the lunchroom wall."
--Avi Rubin, Director of the NSF ACCURATE Center; Professor, Johns Hopkins University; and coauthor of Firewalls and Internet Security
Beginning where the best-selling book Building Secure Software left off, Software Security teaches you how to put software security into practice.The software security best practices, or touchpoints, described in this book have their basis in good software engineering and involve explicitly pondering security throughout the software development lifecycle. This means knowing and understanding common risks (including implementation bugsand architectural flaws), designing for security, and subjecting all software artifacts to thorough, objective risk analyses and testing.
Software Security is about putting the touchpoints to work for you. Because you can apply these touchpoints to the software artifacts you already produce as you develop software, you can adopt this book's methods without radically changing the way you work. Inside you'll find detailed explanations of
- Risk management frameworks and processes
- Code review using static analysis tools
- Architectural risk analysis
- Penetration testing
- Security testing
- Abuse case development
In addition to the touchpoints, Software Security covers knowledge management, training and awareness, and enterprise-level software security programs. Now that the world agrees that software security is central to computer security, it is time to put philosophy into practice. Create your own secure development lifecycle by enhancing your existing software development lifecycle with the touchpoints described in this book. Let this expert author show you how to build more secure software by building security in.
Privacy Books
Book Subjects
- Arts & Photography
- Biographies & Memoirs
- Business & Investing
- Children's Books
- Comics & Graphic Novels
- Computers & Internet
- Cooking, Food & Wine
- Entertainment
- Gay & Lesbian
- Health, Mind & Body
- History
- Home & Garden
- Horror
- Law
- Literature & Fiction
- Mystery & Thrillers
- Nonfiction
- Outdoors & Nature
- Parenting & Families
- Professional & Technical
- Reference
- Religion & Spirituality
- Romance
- Science
- Science Fiction & Fantasy
- Sports
- Teens
- Travel
Most talked about in Privacy Books
Cryptography Decryptedby H. X. Mel, Doris M. Baker
Addison-Wesley Professional; Published: 2000-12-31; Paperback; Book
Best price: $30.00
Price in other shops:
The Law of Copyright and the Internet: The 1996 WIPO Treaties, Their Interpretation and Implementationby Mihï¿1/2ly Ficsor
Oxford University Press, USA; Published: 2002-05-16; Hardcover; Book
Best price: $157.07
Price in other shops:
Network Security for Government and Corporate Executivesby Rand Morimoto, Chris Amaris, Andrew Abbate, Mark Weinhardt
Prentice Hall; Published: 2006-10-01; Paperback; Book
Best price: $70.00
Price in other shops:
Myspace: Safe Online Networking for Your Kidsby Larry Magid, Anne Collier
Prentice Hall; Published: 2006-12-07; Paperback; Book
Using Set for Secure Electronic Commerce with CDROMby Grady Drew
Prentice Hall PTR; Published: 1998-11-30; Paperback; Book
Best price: $3.80
Price in other shops:
Network Security: Private Communication in a Public World (2nd Edition)by Charlie Kaufman, Radia Perlman, Mike Speciner
Prentice Hall; Published: 2002-05-02; Hardcover; Book
Best price: $54.99
Price in other shops:
Windows Internet Security: Protecting Your Critical Databy Seth Fogie, Cyrus Peikari
Prentice Hall; Published: 2001-10-07; Paperback; Book
Best price: $6.99
Price in other shops:
Administrating Web Servers, Security, & Maintenance Interactive Workbookby Eric Larson, Brian Stephens
Prentice Hall; Published: 2000-01-09; Paperback; Book
Best price: $12.99
Price in other shops:
Keeping Found Things Found: The Study and Practice of Personal Information Management (Interactive Technologies)by William Jones
Morgan Kaufmann; Published: 2007-11-15; Paperback; Book
Best price: $34.00
Price in other shops:
Upgrade Your Life: The Lifehacker Guide to Working Smarter, Faster, Betterby Gina Trapani
Wiley; Published: 2008-03-17; Paperback; Book
Best price: $5.99
Price in other shops:
Similar Books and other products
The Art of Software Security Assessment: Identifying and Preventing Software Vulnerabilitiesby Mark Dowd, John McDonald, Justin Schuh
Addison-Wesley Professional; Published: 2006-11-30; Paperback; Book
Best price: $42.71
Price in other shops:
Secure Software Development: A Security Programmer's Guideby Jason Grembi
Delmar Cengage Learning; Published: 2008-05-08; Paperback; Book
Best price: $57.10
Price in other shops:
Security Engineering: A Guide to Building Dependable Distributed Systemsby Ross J. Anderson
Wiley; Published: 2008-04-14; Hardcover; Book
Best price: $43.75
Price in other shops:
CISSP All-in-One Exam Guide, Fifth Editionby Shon Harris
McGraw-Hill Osborne Media; Published: 2010-01-15; Hardcover; Book
Best price: $38.70
Price in other shops:
Computer Security: Art and Scienceby Matt Bishop
Addison-Wesley Professional; Published: 2002-12-12; Hardcover; Book
Best price: $64.57
Price in other shops:
The Web Application Hacker's Handbook: Discovering and Exploiting Security Flawsby Dafydd Stuttard, Marcus Pinto
Wiley; Published: 2007-10-22; Paperback; Book
Best price: $19.97
Price in other shops:
The Security Development Lifecycleby Michael Howard, Steve Lipner
Microsoft Press; Published: 2006-06-28; Paperback; Book
Best price: $17.12
Price in other shops:
How to Break Software Securityby James A. Whittaker, Herbert H. Thompson
Addison Wesley; Published: 2003-05-19; Paperback; Book
Best price: $28.54
Price in other shops:
24 Deadly Sins of Software Security: Programming Flaws and How to Fix Themby Michael Howard, David LeBlanc, John Viega
McGraw-Hill Osborne Media; Published: 2009-09-03; Paperback; Book
Best price: $26.82
Price in other shops:
Writing Secure Code, Second Editionby Michael Howard, David LeBlanc
MICROSOFT; Microsoft Press; Published: 2003-01-04; Paperback; Book
Best price: $14.99
Price in other shops: