Vous voulez voir cette page en français ? Cliquez ici.

Sign in to turn on 1-Click ordering.
More Buying Choices
Have one to sell? Sell yours here
Tell the Publisher!
I'd like to read this book on Kindle

Don't have a Kindle? Get your Kindle here, or download a FREE Kindle Reading App.

Secure Coding: Principles and Practices [Paperback]

Mark G. Graff , Kenneth R. van Wyk
4.5 out of 5 stars  See all reviews (15 customer reviews)
List Price: CDN$ 46.95
Price: CDN$ 29.58 & FREE Shipping. Details
You Save: CDN$ 17.37 (37%)
o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o
Usually ships within 2 to 4 weeks.
Ships from and sold by Amazon.ca. Gift-wrap available.

Book Description

June 1 2003 0596002424 978-0596002428 1

Practically every day, we read about a new type of attack on computer systems and networks. Viruses, worms, denials of service, and password sniffers are attacking all types of systems -- from banks to major e-commerce sites to seemingly impregnable government and military computers --at an alarming rate.

Despite their myriad manifestations and different targets, nearly all attacks have one fundamental cause: the code used to run far too many systems today is not secure. Flaws in its design, implementation, testing, and operations allow attackers all-too-easy access.

Secure Coding, by Mark G. Graff and Ken vanWyk, looks at the problem of bad code in a new way. Packed with advice based on the authors' decades of experience in the computer security field, this concise and highly readable book explains why so much code today is filled with vulnerabilities, and tells readers what they must do to avoid writing code that can be exploited by attackers. Writing secure code isn't easy, and there are no quick fixes to bad code. To build code that repels attack, readers need to be vigilant through each stage of the entire code lifecycle:

  • Architecture: during this stage, applying security principles such as "least privilege" will help limit even the impact of successful attempts to subvert software.
  • Design: during this stage, designers must determine how programs will behave when confronted with fatally flawed input data. The book also offers advice about performing security retrofitting when you don't have the source code -- ways of protecting software from being exploited even if bugs can't be fixed.
  • Implementation: during this stage, programmers must sanitize all program input (the character streams representing a programs' entire interface with its environment -- not just the command lines and environment variables that are the focus of most security analysis).
  • Testing: during this stage, programs must be checked using both static code checkers and runtime testing methods -- for example, the fault injection systems now available to check for the presence of such flaws as buffer overflow.
  • Operations: during this stage, patch updates must be installed in a timely fashion. In early 2003, sites that had diligently applied Microsoft SQL Server updates were spared the impact of the Slammer worm that did serious damage to thousands of systems.

Beyond the technical, Secure Coding sheds new light on the economic, psychological, and sheer practical reasons why security vulnerabilities are so ubiquitous today. It presents a new way of thinking about these vulnerabilities and ways that developers can compensate for the factors that have produced such unsecured software in the past. It issues a challenge to all those concerned about computer security to finally make a commitment to building code the right way.

Customers Who Bought This Item Also Bought

Product Details

Product Description


"This is an extremely useful little book in best O'Reilly tradition and I recommend it not only to programmers but also to security architects who work with programmers. It gives you a lot of insights that you don't often come across." Information Security Bulletin, September

About the Author

Kenneth R. van Wyk is an internationally recognized information security expert and author of the O'Reilly Media books, Incident Response and Secure Coding. In addition to providing consulting and training services through his company, KRvW Associates, LLC, he currently holds numerous positions: as a monthly columnist for on-line security portal, eSecurityPlanet, and a Visiting Scientist at Carnegie Mellon University's Software Engineering Institute.

Ken has 20+ years experience as an IT Security practitioner in the academic, military, and commercial sectors. He has held senior and executive technologist positions at Tekmark, Para-Protect, Science Applications International Corporation (SAIC), in addition to the U.S. Department of Defense and Carnegie Mellon and Lehigh Universities.

Ken also served a two-year elected position as a member of the Steering Committee, and a one-year elected position as the Chairman of the Steering Committee, for the Forum of Incident Response and Security Teams (FIRST) organization. At the Software Engineering Institute of Carnegie Mellon University, Ken was one of the founders of the Computer Emergency Response Team (CERT(tm)). He holds an engineering degree from Lehigh University and is a frequent speaker at technical conferences, and has presented papers and speeches for CSI, ISF, USENIX, FIRST, AusCERT, and others. Ken is also a CERT(tm) Certified Computer Security Incident Handler.

Inside This Book (Learn More)
Browse Sample Pages
Front Cover | Copyright | Table of Contents | Excerpt | Index | Back Cover
Search inside this book:

Sell a Digital Version of This Book in the Kindle Store

If you are a publisher or author and hold the digital rights to a book, you can sell a digital version of it in our Kindle Store. Learn more

Customer Reviews

Most helpful customer reviews
5.0 out of 5 stars much-needed and indispensable Feb. 8 2004
This is an excellent book that should be read by all software developers, script writers, system administrators, application designers, and system maintainers. The book is short, to-the-point, and hits the important points as well as giving numerous real-world examples. It is easy to read, and not dependent on any specific software life cycle model or methodology--though it brings home the point that if you aren't following such a process, you'd do well to implement one. This is a must-read and must-refer-to book that no organization that uses customized software or develops software in-house should be
Was this review helpful to you?
5.0 out of 5 stars Just plain good Jan. 28 2004
My job is fixing security vulnerabilities in applications.
This book offers a great description of how to creat applications that don't need fixing. It should be required reading for anyone involved in the world of software creation - from management to coders.
The content is well explained, engaging and clearly written.
A good job well done!
Was this review helpful to you?
In the movie Seabiscuit, the titular racehorse doesn't appear on screen until almost an hour into the movie. Nevertheless, the wait is worth it, and the movie was a blockbuster. While no one would confuse this uplifting Depression-era tale with a book on computer code, Secure Coding shares a basic similarity with Seabiscuit: The former doesn't trot out its subject--an actual piece of software code--until page 76, and the result is outstanding nonetheless.
The similarity ends there. While moviegoers eagerly awaited Seabiscuit's appearance, security professionals might well dread the first appearance of code. Refreshingly, the book contains only seven pages of software code.
Similarly themed books spend most of their time in the nitty-gritty of actual code. This one is a horse of a different color, dealing with what needs to be done before the first line of software code is actually written. With the goal of helping developers create applications that are resilient against attacks, the authors develop the book around three categories of software development: architecture and design, implementation, and operations.
Above and beyond technical aspects of software development, the authors describe how serious security vulnerabilities leak into the software-development process. These include ignorance, psychological issues, and the short time spans allotted to the development process.
This book is a sure bet to help developers and project managers create secure software applications without bogging down in specific code.
Was this review helpful to you?
5.0 out of 5 stars Holistic Security Nov. 29 2003
In the 11th century, Moses Maimonides taught us that the highest form of charity is to teach a man to fish. If you give him a fish, he can eat today. If you teach him to fish he can eat forever.
In the same way, Mark G. Graff and Kenneth R. van Wyk have provided an excellent book that gives us a framework for thinking about security rather than trying to give specific rules that might have been invalid before the book came off the press. "Secure Coding" gives the reader the ability to envision, architect, design, code, and implement a security framework that truly meets the needs of its stakeholders.
The authors don't provide a cookbook. In their own words: "When you picked up this book, perhaps you thought that we could provide certain security? Sadly, no one can."
Instead, they deliver a robust mental model and a framework to understand security and to architect, design, develop, and operate secure systems. They present best practices in the field of security, the reasons for using them, and suggestions on deciding which practices are appropriate in your particular case.
Their approach is to realize that the objective is not to make a system totally secure, but to make it just secure enough. Deciding what is "just secure enough" is a business and not a technical decision. It is based on weighing risk versus cost.
There are substantial references throughout the book as well as an appendix of resources. The book is filled with examples of security failures and, more importantly, an excellent post mortem on each to show what could have been done to avoid the problem. The authors are extremely familiar with UNIX environments and this comes through in the examples. However, you don't need to be a UNIX guru to glean valuable lessons from the examples.
Read more ›
Was this review helpful to you?
5.0 out of 5 stars Some reviewers missing the point. Nov. 17 2003
Some of the reviewers here are missing the point of this book. It's not a "secure code cookbook" in that it doesn't give specific code examples. Such things are quickly obsolete anyway.
This book teaches you how to *think* about security, how to think about and *design* code that will be secure. It isn't a "add this snippit of code to your input buffer validation function" sort of book. There are many of these books, and they're useful in their place, but this book writes about the design of secure code, not the actual specifics.
To continue the cooking analogy, this is a book on how to write receipes, not a book *of* receipes.
Disclaimer, I helped review this book - and I think it's the sort of work that has been sorely missing in the field (I was also given a free copy for doing the review work).
Jeremy Allison,
Samba Team.
Was this review helpful to you?
Want to see more reviews on this item?
Most recent customer reviews
3.0 out of 5 stars A good step in the right direction
You may have a hi-tech lock on your door, 100% unpickable. If I can just slam my shoulder against the door and jerk it loose from the frame, the fancy lock is irrelevant. Read more
Published on Oct. 8 2003 by wiredweird
5.0 out of 5 stars Secure Coding: Logico Philosophicus
Secure Coding is not a "technical" book, at least not in the traditional sense of the term. Read more
Published on Aug. 21 2003
5.0 out of 5 stars What every coder should read before programming
Graff and van Wyk's book is great for both an IT manager to get up to speed quickly on security concepts as well as for a coder who needs checklists and case studies to learn from. Read more
Published on Aug. 15 2003 by "ryan8391"
5.0 out of 5 stars What every coder should read before programming
Graff and van Wyk's book is great for both an IT manager to get up to speed quickly on security concepts as well as for a coder who needs checklists and case studies to learn from. Read more
Published on Aug. 15 2003 by "ryan8391"
5.0 out of 5 stars What every coder should read before programming
Graff and van Wyk's book is great for both an IT manager to get up to speed quickly on security concepts as well as for a coder who needs checklists and case studies to learn from. Read more
Published on Aug. 15 2003 by "ryan8391"
5.0 out of 5 stars What every coder should read before programming
Graff and van Wyk's book is great for both an IT manager to get up to speed quickly on security concepts as well as for a coder who needs checklists and case studies to learn from. Read more
Published on Aug. 15 2003 by "ryan8391"
5.0 out of 5 stars Changes the way you write a program
Authors explained on how to write secure coding without concentrating on technology or one language, they explained the entire concepts in general which can be implemented in... Read more
Published on Aug. 14 2003 by Srinivas
5.0 out of 5 stars If you manage coders, read this book
In information security there are books about things and books on how to do things, this is a book *about* things. Read more
Published on Aug. 11 2003 by Stephen Northcutt
Search Customer Reviews
Only search this product's reviews

Look for similar items by category