Books

Software Security Engineering: A Guide for Project Managers

Software Security Engineering: A Guide for Project Managers
Julia H. Allen, Sean Barnum, Robert J. Ellison, Gary McGraw, Nancy R. Mead
Addison-Wesley, May 2008.
ISBN-10: 032150917X
ISBN-13: 978-0321509178

Software that is developed from the beginning with security in mind will resist, tolerate, and recover from attacks more effectively than would otherwise be possible. Whether you are a project manager, lead requirements analyst, software architect, or systems integrator, Software Security Engineering: A Guide for Project Managers will teach you how to manage the development of secure, software-intensive systems. You'll also come away with the tools you need to identify and compare potential new practices that can be adapted to augment your current practices.

Exploiting Online Games

Exploiting Online Games
Gary McGraw
Addison-Wesley, July 2007.
ISBN-10: 0-132-27191-5.
ISBN-13: 978-0-132-27191-2

Exploiting Online Games frankly describes controversial security issues surrounding MMORPGs such as World of Warcraft. This no-holds-barred book comes fully loaded with code examples, debuggers, bots, and hacks. if you are a gamer, a game developer, a software security person or an interested bystander, this book exposes the inner workings of online game security for all to see. It discusses and describes security problems associated with advanced massively distributed software. With hundreds of thousands of interacting users, today's online games are a bellwether of modern software. The kinds of attack and defense techniques described in Exploiting Online Games are tomorrow's security techniques on display today.

Software Security

Software Security: Building Security In
Gary McGraw
Addison-Wesley, February 2006. ISBN: 0-321-35670-5

Beginning where the best-selling book Building Secure Software left off, Software Security teaches you how to put software security into practice. The software security best practices, or touchpoints, described in this book have their basis in good software engineering and involve explicitly pondering security throughout the software development lifecycle. This means knowing and understanding common risks (including implementation bugs and architectural flaws), designing for security, and subjecting all software artifacts to thorough, objective risk analyses and testing.

Mastering FreeBSD and OpenBSD Security

Mastering FreeBSD and OpenBSD Security
Yanek Korff, Paco Hope, Bruce Potter
O'Reilly & Associates, March 2005. ISBN: 0-596-00626-8

FreeBSD and OpenBSD continue to gain popularity because of their security benefits over Linux. In Mastering FreeBSD and OpenBSD Security, three security experts provide in-depth explanations of how to secure your most critical systems from security foundations to deployment situations to auditing and incident response.

Exploiting Software

Exploiting Software: How to Break Code
Greg Hoglund and Gary McGraw
Addison-Wesley, February 2004. ISBN: 0-201-78695-8

How does software break? How do attackers make software break on purpose? Why are firewalls, intrusion detection systems, and antivirus software not keeping out the bad guys? What tools can be used to break software? This book provides the answers. Exploiting Software is loaded with examples of real attacks, attack patterns, tools, and techniques used by bad guys to break software. If you want to protect your software from attack, you must first learn how real attacks are really carried out.

Malicious Cryptography

Malicious Cryptography: Exposing Cryptovirology
Adam Young and Moti Yung
John Wiley & Sons, February 2004. ISBN: 0-7645-4975-8

In the public eye, the word cryptography is virtually synonymous with security. The field as a whole is hailed as the primary enabling technology for electronic commerce, and provides for confidential as well as authentic digital communications. However, all that glitters is not gold, and Malicious Cryptography is the first book to reveal just how dark the dark side of cryptography truly is. The book presents a series of advanced cryptographic payloads for computer viruses, worms, and Trojan horse programs that are specifically tailored for their hosts. It also covers numerous countermeasures that can help protect against such attacks.

UML 2 Toolkit

UML 2 Toolkit
Hans-Erik Eriksson, Magnus Penker, Brian Lyons, David Fado
Paul Duvall (Contributing Author)
John Wiley & Sons, 2003. ISBN: 0-471-46361-2

UML 2 represents a significant update to the UML specification, from providing more robust mechanisms for modeling workflow and actions to making the modeling language more executable. Now in its second edition, this best-selling book provides you with all the tools you'll need for effective modeling with UML 2. The authors get you up to speed by presenting an overview of UML and its main features. You'll then learn how to apply UML to produce effective diagrams as you progress through more advanced topics such as use-case diagrams, classes and their relationships, dynamic diagrams, system architecture, and extending UML. The authors take you through the process of modeling with UML so that you can successfully deliver a software product or information management system.

Mac OS X Security

Mac OS X Security
Bruce Potter, Preston Norvell, Brian Wotring
New Riders, 2003. ISBN: 0-735-71348-0

Mac OS X now operates on a UNIX engine. As such it is much more powerful than previous operating systems. It is now a multitasking, multithreaded, multi-user, and multiprocessor system with enhanced interoperability with other systems. Along with that increased power comes increased security vulnerability. In Mac OS X Security, authors Bruce Potter, Preston Norvell and Brian Wotring take readers from the basics of OS X security through the best practices for handling security incidents. Client and network security are addressed, as are auditing and forensics.

802.11 Security

802.11 Security
Bruce Potter and Bob Fleck
O'Reilly & Associates, 2002. ISBN: 0-596-00290-4

Wireless networks are fraught with new security challenges for users and network administrators alike. The lack of physical security, access to free auditing tools that double as attack tools, and the ability to monitor traffic without being noticed make wireless networks an easy target for malicious users. In 802.11 Security, authors Bruce Potter and Bob Fleck tackle the issues unique to wireless networking, covering the areas of risk and potential attack and the tools that can be used to successfully defend against them.

802.11 Security

Wireless Security and Privacy: Best Practices and Design Techniques
Tara Swaminatha and Charles Elden
Foreword by Gary McGraw
Addison-Wesley, 2002. ISBN: 0-596-00290-4

Written for wireless development professionals new to security and for security professionals moving into the wireless arena, this book details the foundation upon which to design and develop secure wireless systems. The authors introduce a method for developing a security analysis process—called I-ADD—that involves four steps: (1) Identify targets and players, (2) Analyze attacks and vulnerabilities, (3) Define a strategy, and (4) Design security in from the start. The book also includes overviews of the wireless application protocol, Bluetooth, the various types of wireless devices, cryptographic methods, virtual private networks and tunneling.

Building Secure Software

Building Secure Software
Gary McGraw and John Viega
Addison-Wesley Professional Computing Series, 2001. ISBN: 0-201-72152-X

Building Secure Software cuts to the heart of computer security to help you get security right the first time. If you are serious about computer security, you need to read this book, which includes essential lessons for both security professionals who have come to realize that software is the problem, and software developers who intend to make their code behave. Written for anyone involved in software development and use--from managers to coders--this book is your first step toward building more secure software.

Security and Privacy in E-Commerce

Security & Privacy for E-Business
Anup Ghosh
John Wiley and Sons, 2001. ISBN: 0-471-38421-6

Using powerful examples and case studies, Anup K. Ghosh provides a remarkably lucid and compelling discussion of how software flaws make your e-business vulnerable to attacks and what you can do to guard against them. Rather than focusing on firewalls and encryption tools, Ghosh presents a proactive engineering approach that tackles the problem at its source—software—and helps ensure the security and reliability of your e-commerce systems.

More Java Gems

More Java Gems
Dwight Deugo
Kamesh Pemmaraju (contributor)
Cambridge University Press, 2000. ISBN: 0-521-77477-2

Read eye-opening discussions on Java reliability, security and performance among the most important articles from the second year of Java Report.

Securing Java

Securing Java: Getting Down to Business with Mobile Code
Gary McGraw and Ed Felten
John Wiley and Sons, 1999. ISBN: 0-471-31952-X

Written by the world's leading experts on mobile code security, this groundbreaking guide to Java closely examines Java 2 security issues, including the signature-based Java 2 security model. The book also covers Java smart cards, attack applets, malicious applets and much more.

E-Commerce Security

E-Commerce Security: Weak Links, Best Defenses
Anup K. Ghosh
John Wiley and Sons, 1998. ISBN: 0-471-19223-6

Renowned e-commerce security expert Anup Ghosh highlights the weak links and provides the best defenses for enterprises connected to the Internet. This valuable guide addresses vulnerabilities in the four essential components of electronic commerce—the data transport protocol, Web servers, Web clients, and the network server operating system.

Software Fault Injection

Software Fault Injection: Inoculating Programs Against Errors
Jeffrey Voas and Gary McGraw
John Wiley and Sons, 1997. ISBN: 0-471-18381-4

This book is a complete, practical guide to a revolutionary new approach to software assurance. Fault injection is a tremendously valuable tool for developing high quality, reliable code. The book brings developers, programmers and managers up to speed on cutting-edge fault injection techniques. Includes real-world case studies and code samples to demonstrate the unique benefits and challenges associated with these techniques.

Java Security

Java Security: Hostile Applets, Holes, and Antidotes
Gary McGraw and Ed Felten
John Wiley and Sons, 1996. ISBN: 0-471-17842-X

McGraw and Felten's groundbreaking first book on Java security that Mokabyte called "a must-read for everyone who has more than a casual acquaintance with Java." Covers the early Java Security Model and its holes and malicious applets. The authors also take a look ahead to Java's future.

Fluid Concepts and Creative Analogies

Fluid Concepts and Creative Analogies: Computer Models of the Fundamental Mechanisms of Thought
D. Hofstadter
Gary McGraw (contributor)
Basic Books/HarperCollins, 1996. ISBN: 0-465-05154-5

Doug Hofstadter's new book looks back at a number of ideas relevant to artificial intelligence and cognitive science from the perspective of having implemented these ideas in actual computer models. The book details the experiences of Hofstadter and his graduate students as they designed programs that model creativity and analogy making.

Software Assessment

Software Assessment: Reliability, Safety, Testability
J.M. Voas and M. Friedman
John Wiley and Sons, 1995. ISBN: 0-471-01009-X

Written by two of the most prominent figures in the field of software quality testing, this book arms both software designers and developers with cutting-edge tools and techniques for measuring and enhancing the safety, reliability and testability of the programs they produce.



Resources
> Overview
> Your Account
> Podcast
> Blog
> Case Studies
> White Papers
> Publications
> Books
> Security Articles
> Presentations

Books
> Overview
> Mastering FreeBSD and OpenBSD Security
> Exploiting Software
> Malicious Cryptography
> Mac OS X Security
> 802.11 Security
> Wireless Security & Privacy
> Building Secure Software
> Security & Privacy for E-Business
> More Java Gems
> Securing Java
> E-Commerce Security
> Software Fault Injection
> Java Security
> Fluid Concepts and Creative Analogies
> Software Assessment
Your Account
Login to your account to download white papers and more, or

Create an account if you don't have one!