Building Secure Software: How to Avoid Security Problems the Right Way

Most organizations have a firewall, anti-virus software, and intrusion detection systems, all intended to keep attackers out. So why is it that computer security is a bigger problem than ever before? The answer is simple--bad software lies at the heart of all computer security problems. Point solutions based on watching the network simply treat symptoms of the problem, and usually in a reactive way. If you are serious about computer security, you need to read this book.This book includes many essential lessons intended for both security professionals, who have come to realize that software is the problem, and software developers, who intend to make their code behave.Welcome to Building Secure Software , the book that cuts to the heart of computer security to help you get security right the first time. Make your software behave the way you want it to, and do security the right way.Building Secure Software provides the expertise and techniques to help you ensure the security of essential software. By considering threats and vulnerabilities early in the development cycle, security that actually works can be built into your system. You'll learn how to determine an acceptable level of risk, develop security tests, and plug security holes before software is even shipped. Written for anyone involved in software development and use, from managers to coders, this book is your first step to building more secure software.Inside you'll find the ten guiding principles for software security, as well as detailed coverageSoftware risk management for securitySelecting technologies to make your code more secureSecurity implications of open source and proprietary softwareHow to audit softwareThe dreaded buffer overflowAccess control and password authenticationRandom number generationApplying cryptographyTrust management and inputClient-Side securityDealing with firewallsOnly by building secure software can you defend yourself against security breaches and gain the confidence that comes with knowing you won't have to play the "penetrate and patch" game anymore. Wouldn't you rather design things properly and thoroughly test your system than have your problems announced to the world on the front page? Let these expert authors help save you time, money, credibility, and your customer's trust.

John Viega is the CTO of Secure Software Solutions (www.securesw.com) and a noted expert in the area of software security. He is responsible for numerous tools in this area, including code scanners (ITS4 and RATS), random number suites (EGADS), automated repair tools, and secure programming libraries. He is also the original author of Mailman, the GNU mailing list manager.

Gary McGraw, Cigital's CTO, is a leading authority on software security. Dr. McGraw is coauthor of the groundbreaking books Building Secure Software and Exploiting Software (both from Addison-Wesley). While consulting for major software producers and consumers, he has published over ninety peer-reviewed technical publications, and functions as principal investigator on grants from DARPA, the National Science Foundation, and NIST's Advanced Technology Program. He serves on the advisory boards of Authentica, Counterpane, and Fortify Software. He is also an advisor to the computer science departments at University of California, Davis, and the University of Virginia, as well as the School of Informatics at Indiana University.