Writing Secure Code

Security mistakes by software architects, designers, and developers are an ongoing plague that costs businesses millions of dollars every year when malicious intruders attack interconnected applications, steal credit-card numbers, and deface Web sites. WRITING SECURE CODE offers a ready cure. This fact-filled, eye-opening title covers the major aspects of creating secure applications through the entire development process, from secure design, to writing robust code that can easily withstand an attack, to testing applications for security vulnerabilities. Its short, easily-digested chapters can provide software designers, architects, developers, and testers with the training, theory, and techniques they need to take the right actions to ensure security. Topics it covers include security principles, how to design, code, and test for security, how to write secure managed code for Microsoft(r) .NET, why companies neglect security, the 10 immutable laws of security and security administration, and more. Developers who read this title will have the peace of mind that comes from knowing that the code they develop is not only fast, but secure. Both authors are top security experts at Microsoft who have helped solve some of the toughest security problems in the computing industry.

Michael Howard is a security program manager on the Microsoft WindowsXP team, focusing on secure design, programming and testing techniques. He works with hundreds of people both inside and outside the company to help them secure their applications each year. He is the primary author of DESIGING SECURE WEB-BASED APPLICATIONS FOR MICROSOFT WINDOWS 2000 from Microsoft Press. Prior to working in WindowsXP, Michael worked on next-generation Web server technologies and IIS. He has worked on Windows NT® security since 1992

David LeBlanc is a senior security technologist in ITG at Microsoft. His primary role is defending the Microsoft network from attack. He has worked in the security field throughout his professional life, including working at Internet Security Systems where he was the primary engineer on ISS’ award-winning security products. David serves on a number of external security-related advisory boards.