Digital List Price: | $47.99 |
Kindle Price: | $35.99 Save $12.00 (25%) |
Sold by: | Amazon.com Services LLC |
Your Memberships & Subscriptions
Download the free Kindle app and start reading Kindle books instantly on your smartphone, tablet, or computer - no Kindle device required.
Read instantly on your browser with Kindle for Web.
Using your mobile phone camera - scan the code below and download the Kindle app.
OK
Software Security Engineering: A Guide for Project Managers (SEI Series in Software Engineering) 1st Edition, Kindle Edition
Software Security Engineering draws extensively on the systematic approach developed for the Build Security In (BSI) Web site. Sponsored by the Department of Homeland Security Software Assurance Program, the BSI site offers a host of tools, guidelines, rules, principles, and other resources to help project managers address security issues in every phase of the software development life cycle (SDLC). The book’s expert authors, themselves frequent contributors to the BSI site, represent two well-known resources in the security world: the CERT Program at the Software Engineering Institute (SEI) and Cigital, Inc., a consulting firm specializing in software security.
This book will help you understand why
- Software security is about more than just eliminating vulnerabilities and conducting penetration tests
- Network security mechanisms and IT infrastructure security services do not sufficiently protect application software from security risks
- Software security initiatives should follow a risk-management approach to identify priorities and to define what is “good enough”–understanding that software security risks will change throughout the SDLC
- Project managers and software engineers need to learn to think like an attacker in order to address the range of functions that software should not do, and how software can better resist, tolerate, and recover when under attack
- Edition1st
- PublisherAddison-Wesley Professional
- Publication dateApril 21, 2004
- LanguageEnglish
- File size4004 KB
-
Next 2 for you in this series
$85.98 -
All 22 available for you in this series
$807.95
Customers who bought this item also bought
Editorial Reviews
From the Back Cover
“This book’s broad overview can help an organization choose a set of processes, policies, and techniques that are appropriate for its security maturity, risk tolerance, and development style. This book will help you understand how to incorporate practical security techniques into all phases of the development lifecycle.”
―Steve Riley, senior security strategist, Microsoft Corporation
“There are books written on some of the topics addressed in this book, and there are other books on secure systems engineering. Few address the entire life cycle with a comprehensive overview and discussion of emerging trends and topics as well as this one.”
―Ronda Henning, senior scientist-software/security queen, Harris Corporation
Software that is developed from the beginning with security in mind will resist, tolerate, and recover from attacks more effectively than would otherwise be possible. While there may be no silver bullet for security, there are practices that project managers will find beneficial. With this management guide, you can select from a number of sound practices likely to increase the security and dependability of your software, both during its development and subsequently in its operation.
Software Security Engineering draws extensively on the systematic approach developed for the Build Security In (BSI) Web site. Sponsored by the Department of Homeland Security Software Assurance Program, the BSI site offers a host of tools, guidelines, rules, principles, and other resources to help project managers address security issues in every phase of the software development life cycle (SDLC). The book’s expert authors, themselves frequent contributors to the BSI site, represent two well-known resources in the security world: the CERT Program at the Software Engineering Institute (SEI) and Cigital, Inc., a consulting firm specializing in software security.
This book will help you understand why
- Software security is about more than just eliminating vulnerabilities and conducting penetration tests
- Network security mechanisms and IT infrastructure security services do not sufficiently protect application software from security risks
- Software security initiatives should follow a risk-management approach to identify priorities and to define what is “good enough”―understanding that software security risks will change throughout the SDLC
- Project managers and software engineers need to learn to think like an attacker in order to address the range of functions that software should not do, and how software can better resist, tolerate, and recover when under attack
Chapter 1: Why Is Security a Software Issue? 1
1.1 Introduction 1
1.2 The Problem 2
1.3 Software Assurance and Software Security 6
1.4 Threats to Software Security 9
1.5 Sources of Software Insecurity 11
1.6 The Benefits of Detecting Software Security Defects Early 13
1.7 Managing Secure Software Development 18
1.8 Summary 23
Chapter 2: What Makes Software Secure? 25
2.1 Introduction 25
2.2 Defining Properties of Secure Software 26
2.3 How to Influence the Security Properties of Software 36
2.4 How to Assert and Specify Desired Security Properties 61
2.5 Summary 71
Chapter 3: Requirements Engineering for Secure Software 73
3.1 Introduction 73
3.2 Misuse and Abuse Cases 78
3.3 The SQUARE Process Model 84
3.4 SQUARE Sample Outputs 91
3.5 Requirements Elicitation 99
3.6 Requirements Prioritization 106
3.7 Summary 112
Chapter 4: Secure Software Architecture and Design 115
4.1 Introduction 115
4.2 Software Security Practices for Arch
About the Author
Julia H. Allen is a senior member of the technical staff within the CERTProgram at the Software Engineering Institute (SEI), a unit of Carnegie Mellon University in Pittsburgh, PA. In addition to her work in software security and assurance, Allen is engaged in developing and transitioning executive outreach programs in enterprise security and governance. She is the author of The CERT Guide to System and Network Security Practices (Addison-Wesley, 2001), Governing for Enterprise Security (CMU/SEI, 2005), and the CERT Podcast Series: Security for Business Leaders (2006/2007).
Sean Barnum is a Principal Consultant at Cigital and is technical lead for their federal services practice. He has more than twenty years of experience in the software industry in the areas of development, software quality assurance, quality management, process architecture and improvement, knowledge management, and security. He is a frequent contributor and speaker for regional and national software security and software quality publications, conferences, and events. He is very active in the software assurance community and is involved in numerous knowledge standards-defining efforts, including the Common Weakness Enumeration (CWE), the Common Attack Pattern Enumeration and Classification (CAPEC), and other elements of the Software Assurance Programs of the Department of Homeland Security and the Department of Defense. He is also the lead technical subject matter expert for the Air Force Application Software Assurance Center of Excellence.
Robert J. Ellison, Ph.D., is a member of the Survivable Systems Engineering Team within the CERTProgram at the Software Engineering Institute and, in that capacity, has served in a number of technical and management roles. He was a project leader for the evaluation of software engineering development environments and associated software development tools. He was also a member of the Carnegie Mellon University team that wrote the proposal for the SEI; he joined the new FFRDC in 1985 as a founding member. Ellison regularly participates in the evaluation of software architectures and contributes from the perspective of security and reliability measures.
Gary McGraw, Ph.D., is the CTO of Cigital, Inc., a software security and quality consulting firm with headquarters in the Washington, D.C., area. He is a globally recognized authority on software security and the author of six best selling books on this topic. The latest is Exploiting Online Games (Addison-Wesley, 2008). His other titles include Java Security, Building Secure Software, Exploiting Software, and Software Security; and he is editor of the Addison-Wesley Software Security series. McGraw has also written more than ninety peer-reviewed scientific publications, authors a monthly security column for darkreading.com, and is frequently quoted in the press. Besides serving as a strategic counselor for top business and IT executives, Gary is on the Advisory Boards of Fortify Software and Raven White. He serves on the Dean’s Advisory Council for the School of Informatics at Indiana University. Gary is an IEEE Computer Society Board of Governors member and produces the monthly Silver Bullet Security Podcast for IEEE Security & Privacy magazine.
Nancy R. Mead, Ph.D., is a senior member of the technical staff in the Survivable Systems Engineering Group, which is part of the CERT Program at the Software Engineering Institute. Mead is also a faculty member in the Master of Software Engineering and Master of Information Systems Management programs at Carnegie Mellon University. She has more than one hundred publications and invited presentations. She is a fellow of the Institute of Electrical and Electronic Engineers, Inc. (IEEE) and the IEEE Computer Society and is also a member of the Association for Computing Machinery (ACM).
Product details
- ASIN : B004XI838G
- Publisher : Addison-Wesley Professional; 1st edition (April 21, 2004)
- Publication date : April 21, 2004
- Language : English
- File size : 4004 KB
- Simultaneous device usage : Up to 5 simultaneous devices, per publisher limits
- Text-to-Speech : Enabled
- Screen Reader : Supported
- Enhanced typesetting : Enabled
- X-Ray : Not Enabled
- Word Wise : Not Enabled
- Sticky notes : On Kindle Scribe
- Print length : 475 pages
- Best Sellers Rank: #5,188,164 in Kindle Store (See Top 100 in Kindle Store)
- #1,659 in Network Security (Kindle Store)
- #1,891 in Online Safety & Piracy
- #5,265 in Software Development (Kindle Store)
- Customer Reviews:
About the authors
Gary McGraw is co-founder of the Berryville Institute of Machine Learning. He is a globally recognized authority on software security and the author of eight best selling books on this topic. His titles include Software Security, Exploiting Software, Building Secure Software, Java Security, Exploiting Online Games, and 6 other books; and he is editor of the Addison-Wesley Software Security series. Dr. McGraw has also written over 100 peer-reviewed scientific publications. Gary serves on the Advisory Boards of Maxmyinterest, NTrepid, Ravenwhite, and Secure Code Warrior. He has also served as a Board member of Cigital and Codiscope (acquired by Synopsys) and as Advisor to Black Duck (acquired by Synopsys), Dasient (acquired by Twitter), Fortify Software (acquired by HP), and Invotas (acquired by FireEye). Gary produced the monthly Silver Bullet Security Podcast for IEEE Security & Privacy magazine for thirteen years. His dual PhD is in Cognitive Science and Computer Science from Indiana University where he serves on the Dean’s Advisory Council for the School of Informatics, Computing, and Engineering.
https://garymcgraw.com
https://berryvilleiml.com/
@cigitalgem
Discover more of the author’s books, see similar authors, read author blogs and more
Customer reviews
Customer Reviews, including Product Star Ratings help customers to learn more about the product and decide whether it is the right product for them.
To calculate the overall star rating and percentage breakdown by star, we don’t use a simple average. Instead, our system considers things like how recent a review is and if the reviewer bought the item on Amazon. It also analyzed reviews to verify trustworthiness.
Learn more how customers reviews work on Amazon-
Top reviews
Top reviews from the United States
There was a problem filtering reviews right now. Please try again later.
Looks nice on your desk, and is a good quick reference/glossary.
A project manager new to the concepts of software security engineering would likely find the book to be a good overview for understanding the tasks and practices that should be implemented on a secure software development effort. It provides just enough information to be able to accurately assess if development efforts are on target and on track. From the opposite perspective, a software security engineer might find the book a useful tool to convince a recalcitrant project manager of the necessity of certain tasks and activities during the development process.
The experienced security software engineer will not find much of practical use in the material covered. The authors are coming primarily from the perspective of process maturity models, and the material is fairly thin on implementation details. It does, however, provide an overview of considerations for developing secure software, and it can be used as a pointer to other sources and materials referenced in the book, which the software engineer will find useful.
The book includes several reprints from IEEE Security & Privacy magazine, and these contained some interesting and novel ideas. A prime example is the concept of "Misuse and Abuse Cases" in which abnormal and malicious behavior from actors in the system is anticipated and documented. This is a new and unique aspect on traditional requirements engineering Use Cases.
"Software Security Engineering" is a highly credible book produced by a panel of highly regarded software security researchers and consultants. It is highly recommended for project managers new to software security engineering concepts, or as a general high level reference for experienced secure software developers.