The Art of Software Security Assessment: Identifying and Preventing Software Vulnerabilities (Paperback)

Mark Dowd, John McDonald, Justin Schuh

  • 出版商: Addison Wesley
  • 出版日期: 2006-11-01
  • 售價: $3,160
  • 貴賓價: 9.5$3,002
  • 語言: 英文
  • 頁數: 1200
  • 裝訂: Paperback
  • ISBN: 0321444426
  • ISBN-13: 9780321444424
  • 相關分類: 資訊安全
  • 已絕版

買這商品的人也買了...

商品描述

Description

There are a number of secure programming books on the market, but none that go as deep as this one. The depth and detail exceeds all books that I know about by an order of magnitude.”

Halvar Flake, CEO and head of research, SABRE Security GmbH

 

The Definitive Insider’s Guide to Auditing Software Security

 

This is one of the most detailed, sophisticated, and useful guides to software security auditing ever written. The authors are leading security consultants and researchers who have personally uncovered vulnerabilities in applications ranging from sendmail to Microsoft Exchange, Check Point VPN to Internet Explorer. Drawing on their extraordinary experience, they introduce a start-to-finish methodology for “ripping apart” applications to reveal even the most subtle and well-hidden security flaws.

 

The Art of Software Security Assessment covers the full spectrum of software vulnerabilities in both UNIX/Linux and Windows environments. It demonstrates how to audit security in applications of all sizes and functions, including network and Web software. Moreover, it teaches using extensive examples of real code drawn from past flaws in many of the industry's highest-profile applications.

 

Coverage includes

 

• Code auditing: theory, practice, proven methodologies, and secrets of the trade

• Bridging the gap between secure software design and post-implementation review

• Performing architectural assessment: design review, threat modeling, and operational review

• Identifying vulnerabilities related to memory management, data types, and malformed data

• UNIX/Linux assessment: privileges, files, and processes

• Windows-specific issues, including objects and the filesystem

• Auditing interprocess communication, synchronization, and state

• Evaluating network software: IP stacks, firewalls, and common application protocols

• Auditing Web applications and technologies

 

This book is an unprecedented resource for everyone who must deliver secure software or assure the safety of existing software: consultants, security specialists, developers, QA staff, testers, and administrators alike.

 

 

 

Table of Contents

ABOUT THE AUTHORS     xv

PREFACE     xvii

ACKNOWLEDGMENTS    xxi

I Introduction to Software Security Assessment

1 SOFTWARE VULNERABILITY FUNDAMENTALS    3

2 DESIGN REVIEW     25

3 OPERATIONAL REVIEW    67

4 APPLICATION REVIEW PROCESS    91

II Software Vulnerabilities

5 MEMORY CORRUPTION    167

6 C LANGUAGE ISSUES     203

7 PROGRAM BUILDING BLOCKS     297

8 STRINGS ANDMETACHARACTERS    387

9 UNIX I: PRIVILEGES AND FILES     459

10 UNIX II: PROCESSES     559

11 WINDOWS I: OBJECTS AND THE FILE SYSTEM     625

12 WINDOWS II: INTERPROCESS COMMUNICATION     685

13 SYNCHRONIZATION AND STATE    755

III Software Vulnerabilities in Practice

14 NETWORK PROTOCOLS    829

15 FIREWALLS    891

16 NETWORK APPLICATION PROTOCOLS    921

17 WEB APPLICATIONS    1007

18 WEB TECHNOLOGIES     1083

BIBLIOGRAPHY     1125

INDEX     1129

商品描述(中文翻譯)

描述

市場上有許多關於安全編程的書籍,但沒有一本像這本書一樣深入。這本書的深度和細節超過我所知道的所有書籍,達到了一個量級的差距。" - Halvar Flake, SABRE Security GmbH的CEO和研究主管

《The Definitive Insider's Guide to Auditing Software Security》是有史以來最詳細、複雜且實用的軟體安全審計指南之一。作者是領先的安全顧問和研究人員,他們個人發現了從sendmail到Microsoft Exchange,從Check Point VPN到Internet Explorer等應用程式中的漏洞。借助他們非凡的經驗,他們介紹了一種從頭到尾的方法論,用於"拆解"應用程式,以揭示甚至最微妙和最隱藏的安全漏洞。

《The Art of Software Security Assessment》涵蓋了UNIX/Linux和Windows環境中軟體漏洞的全譜。它演示了如何審計各種大小和功能的應用程式的安全性,包括網絡和Web軟體。此外,它還使用了許多行業中最知名應用程式過去漏洞的真實代碼示例。

內容包括:

- 代碼審計:理論、實踐、成熟的方法和行業內的秘訣
- 建立安全軟體設計和實施後審查之間的橋樑
- 進行架構評估:設計審查、威脅建模和操作審查
- 識別與內存管理、數據類型和異常數據相關的漏洞
- UNIX/Linux審計:權限、文件和進程
- Windows特定問題,包括對象和文件系統
- 審計進程間通信、同步和狀態
- 評估網絡軟體:IP堆棧、防火牆和常見應用程式協議
- 審計Web應用程式和技術

這本書對於所有必須提供安全軟體或確保現有軟體安全性的人來說,都是一個前所未有的資源:顧問、安全專家、開發人員、QA人員、測試人員和管理員。