Browse Books

Reviewer: Ghita Mostéfaoui

Security has become a hot topic in both academia and industry. This interest has been encouraged by the high reliance on distributed infrastructures for sharing and accessing data and computing resources. This distribution calls for strong mechanisms to ensure access control, message privacy, and user authentication. While many contributions target security software (tools and frameworks to implement security mechanisms), software security has emerged recently as a complement to security in its broader sense. Software security can be defined as the science of discovering and correcting bugs, defects, and flaws in software applications. Buffer overflow and structured query language (SQL) injection are examples of such errors. Both aspects of security suffer from the fact that they are rarely taken into account during the design and implementation of the initial application. In this book, McGraw aims to define and detail the three pillars for achieving secure software: risk management, touchpoints, and knowledge. Organized into three parts, the content of the book is dedicated to detailing each one of the defined pillars. Part 1, "Software Security Fundamentals," comprises the book's first two chapters. Chapter 1 highlights the growing need for software security, and briefly defines the three pillars for achieving secure software. Risk management is the process of identifying and mitigating potential risks in software. Touchpoints are introduced by the author as a set of software security best practices. Finally, software security knowledge is defined as a catalog of principles, guidelines, rules, vulnerabilities, exploits, attack patterns, and historical risks. Part 2, "Seven Touchpoints for Software Security," comprises chapters 3 through 9. This part details the seven touchpoints identified by the author including code review, architectural risk analysis, penetration testing, risk-based security testing, abuse cases, security requirements, and security operation. A chapter is devoted to each one of these touchpoints including details about how to complete them in practice. Part 3, "Software Security Grows Up," comprises chapters 10 through 13. In chapter 10, the author points out that the most critical issue facing software security today is the lack of expertise, but at the same time he argues that as the field evolves, best practices can be catalogued and documented in order to provide training support for future software security practitioners. Software security knowledge is obviously essential to develop effective software protection strategies. However, the author highlights the need for managing this knowledge in order to best support the spreading of the discipline of software security (chapter 11). As in any discipline, software security must rely on a taxonomy that identifies the different bugs and flaws. A coding errors taxonomy is presented in chapter 12. Chapter 13 provides an annotated bibliography of software security publications to guide interested readers to the right information quickly. This book successfully presents software security as an emerging discipline. It presents a structured view of the discipline, with practical examples and investigations of available ancillary tools. The book contains rich information about the subject, covering the historical evolution of software security problems and their corresponding solutions. The author's expertise and many years of experience in software security are quite evident when reading the book. This book is simply a great reference that also identifies the main research issues faced in the software security area.

Reviewer: Radu State

Over the years, I have read several books covering software security from a system or programming language perspective. While most of them were outstanding and provided excellent overviews of the security features to be considered when programming in specific programming languages, I was hoping to eventually see a holistic approach to software security. This is the third work of a truly outstanding trilogy [1,2], and is just the kind of book I had in mind. It is one of the best introductions I have seen to the security of software. Although the book's content is spread over 400 pages, one phrase summarizes it well: "Software security is not security software." One of the major errors we make in development is addressing software security by adding additional features; this process is cost efficient in the short term, but raises major issues in the long run. In his book, McGraw shows that security is not a feature that can be added to extend the functionality of software, but an essential building block and key architectural design characteristic of reliable software. Although the book is written at a high level of abstraction, going beyond simple code vulnerabilities and examples, the multiple sidebars with anecdotes and real stories related to the content of the book provide suggestive illustrations and make the book easy to read. The book begins by defining the discipline, and then introduces the notion of risk management. These topics comprise the first part of the book, which also covers issues like risk mitigation, risk measures, operations, and the major stages of how to apply risk management in practice. The book's second part covers touch points for software security, and includes chapters on code review, architectural risk analysis, penetration testing, abuse cases, security requirements, security operations, and external analysis. At first, the content of the book might seem dry and targeted to less technically oriented readers, like project managers or high-level software architects. For those readers who are more interested in technical and programming issues, my favorite chapter is the fourth, addressing automated code review with the Fortify security tool. The author is one of the developers of this tool, and a CD comes with the book that contains a sample scenario to be worked out by the reader. The final part of the book deals with enterprise-level security development cycles, and shows the importance of knowledge-based management schemes for such purposes. There is a final jewel hidden at the end of the book-an annotated bibliography covering most of the essential readings from academia and industry. In fact, the contents of the book are intrinsically tied to both of these areas, and McGraw manages to provide a common view on software security from both perspectives. I highly recommend this book to all readers wishing to build security into their software. Online Computing Reviews Service

Reviewer: Riemer Brouwer

The field of software security is as old as the field of software itself, yet it is not nearly as well developed. The result is noticeable almost every single day when we either encounter software malfunctions ourselves or read about them in the news. This book addresses the causes of poor security, and aims to provide practical and sound advice for software (security) engineers, as well as for businesspeople and technical managers. The book is part of a larger trend in the information technology (IT) security world, where software security is seen as the new field of interest for hackers (now that network security can be reasonably well implemented using the latest firewall technologies and intrusion prevention systems). The book’s subtitle truly covers the nature of the book. It would be impossible to give detailed advice for every type of software, in every possible language. Instead, it makes much more sense to focus on building in security by means of project management supported by policies and procedures requiring all those involved to include security within each software development engagement. The book is structured along three pillars: applied risk management, software security touchpoints (or best practices), and knowledge. The first pillar stresses that the development of secure software requires a risk management approach based on iterative risk identification and mitigation, whereas the second pillar provides the necessary hands-on tools and methods to help ensure consistent, and hopefully complete, reduction of insecure code. The last pillar is quite important, yet has only recently been getting the attention it deserves. The software security touchpoints are the heart of the book. The author defines seven areas of critical importance to secure software development. These are, in order of effectiveness: code review, architectural risk analysis, penetration testing, risk-based security testing, abuse cases, security requirements, and security operations. One may wonder why the author rates security requirements as the second-to-last touchpoint, considering that it is exactly these security requirements that should drive the overall process. Also, the difference between penetration testing and abuse cases seems somewhat artificial. The author’s definition of black hat versus white hat as destructive versus constructive activities is simply wrong: proving something might be destroyed is often the best way to fix, and thus protect, it. Still, the coverage of each touchpoint is solid enough to provide an interesting read for both newcomers and the more experienced in the field of software security. The author’s point that penetration testing often occupies an overrated position within the testing process is well taken. Similarly, he stresses the importance of a well-balanced testing methodology that follows a risk-based approach, which is key in successfully evaluating the security of any application. The author excels in providing practical business cases for sometimes rather abstract theories (for those new to them). Handy tools and templates are included to get the reader off to a quick start. Throughout the book, his vast experience shows. Easily forgiven are small errors, such as his definition of software security as being “the idea of engineering software so that it continues to function correctly under malicious attack,” which overlooks the vast number of problems triggered by clueless, but otherwise innocent users, as well as the author’s aggressive promotion of the companies he works with. Anyone involved in computer application security should include this book in his or her library. Online Computing Reviews Service

Reviewer: Edgar R. Weippl

Software errors are the most prominent source of security flaws. In both the design and implementation phases, there are typical errors that software engineers make. This book’s goal is to teach readers how these errors can be avoided. This book is organized into three parts. Part 1 covers security basics, Part 2 outlines seven important aspects of software security, and Part 3 shows readers how software security can be integrated into a company’s life cycle. Chapter 1 starts with a typical narrative of the increase in code size and security flaws, and provides some nice statistics. It introduces the book’s approach of three pillars in software security: applied risk management, software security touchpoints, and knowledge. Chapter 2 covers risk management. The author proposes starting with the business context, identifying business and technical risks, and mapping them back to the business context. While the chapter is good to read and certainly useful, I prefer the Microsoft approach: threat modeling. The author, however, makes a good point that Microsoft’s threat modeling is basically a risk analysis. Part 2 contains a chapter on each of the seven software security touchpoints: code review, architectural risk analysis, penetration testing, risk-based security testing, abuse cases, security requirements, and security operations. It was a good idea to make these touchpoints independent of a development methodology. The last part starts with a chapter on enterprise software security programs. The authors explain that Microsoft’s Security Development Lifecycle (SDL) only worked because the management, from Bill Gates down to the engineers and mid-level managers, understood the importance of secure software. Chapter 11 briefly describes how to build knowledge management for software security, and chapter 12 provides a list of coding errors. This is a good textbook, as it gives pointers to articles in IEEE’s magazine Security & Privacy , and also discusses other related books. The Microsoft books on this topic are easier to read; for organizations that have little experience with establishing a security development life cycle, the evangelist style might helpful. For students, this book gives a broader overview of the subject, and explains some main concepts used in other books on this topic. Online Computing Reviews Service