Better Software - September 2008 - (Page 12) book reVIeW the art of software security assessment by: Mark Dowd, John McDonald, and Justin Schuh reviewed by: J.D. Kennedy This book is written by three experts in the field who have shared the depth of their security knowledge and experience in a readable and instructive format. The basic premise of the book is that while it is desirable to avoid security vulnerabilities, this isn’t always possible when you have software already in production. The experts start with the basics of software security assessment and make recommendations on how to “shortcut” the process when time or resources are limited. While the material is aimed at assessing the security of software, it also provides lessons in what to avoid when developing software. The writing style is easy to read considering that some might not find the topic riveting. This book is suitable for novices developing a knowledge-based foundation on these issues and for experienced developers who need a reference to remind them of things to look for. The book starts by covering the fundamentals of software vulnerabilities and then covers basic review methodologies. It goes into more depth by exploring specific vulnerabilities of both UNIX- and Windows-based systems. The final section deals with software vulnerability in practice. In the “How to Use This Book” section, the authors recommend that the book be read straight through “at least once” to get a feel for the material. Luckily they also recognize that this may not be feasible for readers who wish to put the principles into practice, so they organized the book so that specific topics and techniques are easy to find and use without having to read the entire book. I liked the simple yet powerful examples used and how the experts build on them to create more complex issues. The concept of userids and passwords is fundamental to most computer systems; the discussion of how either may be easily compromised by inappropriate communication responses should hit home with any developer. Regardless of how obvious this subject matter is to even moderately experienced programmers, basic errors are repeated time and again by novices. I will be taking this book off the shelf and handing it to developers on my team whenever they are working on a new application. Visit www.stickyMinds.com/bythebook10-7 to post your comments on this book. 12 BETTER SOFTWARE SEPTEMBER 2008 books Guide The stickyminds.com Books guidE is one of the most popular Every Monday we bring you fresh areas on our Web site. With ideas to jump-start your work week. more than 880 books—including This month we deliver thoughtmany that have been reviewed by thought leaders, talented provoking articles fromindustry experts, and Jeff Patton, Linda authors such asyour peers—make the StickyMinds.com Books Hayes, Bryan Sullivan, Naomi Karten, Guide your first stop for finding a and Payson Hall. good read. Not sure what you’re looking for? Browse books by topic, including: • Project & Team Management • Test & Evaluation • Requirements • Design & Architecture • Development & Deployment • Reviews • Process Improvement • Measurement & Reporting • Security • Defect Tracking • Configuration Management September Weekly ColumnS Every Monday we bring you fresh ideas to jump-start your work week. This month we deliver thought-provoking articles from talented authors such as Jeff Patton, Linda Hayes, Bryan Sullivan, Naomi Karten, and Payson Hall. www.StickyMinds.com http://StickyMinds.com http://StickyMinds.com http://www.StickyMinds.com/bythebook10-7 http://www.StickyMinds.com
For optimal viewing of this digital publication, please enable JavaScript and then refresh the page. If you would like to try to load the digital publication without using Flash Player detection, please click here.