Cover image for Core software security : security at the source
Title:
Core software security : security at the source
Personal Author:
Publication Information:
Boca Raton : Taylor & Francis, 2014
Physical Description:
xxvi, 388 pages : illustrations ; 24 cm.
ISBN:
9781466560956
Abstract:
"This book outlines a step-by-step process for software security that is relevant to today's technical, operational, business, and development environments. The authors focus on what humans can do to control and manage a secure software development process in the form of best practices and metrics. Although security issues will always exist, this book will teach you how to maximize an organizations ability to minimize vulnerabilities in your software products before they are released or deployed by building security into the development process. This book is targeted towards anyone who is interested in learning about software security in an enterprise environment to include product security and quality executives, software security architects, security consultants, software development engineers, enterprise SDLC program managers, chief information security officers, chief technology officers, and chief privacy officers whose companies develop software. If you want to learn about how software security should be implemented in developing enterprise software, this is a book you don't want to skip"--provided by publisher
Subject Term:

Available:*

Library
Item Barcode
Call Number
Material Type
Item Category 1
Status
Searching...
30000010344146 QA76.9.A25 R364 2014 Open Access Book Book
Searching...

On Order

Summary

Summary

"... an engaging book that will empower readers in both large and small software development and engineering organizations to build security into their products.nbsp;... Readers are armed with firm solutions for the fight against cyber threats."
--Dr. Dena Haritos Tsamitis. Carnegie Mellon University

"... a must read for security specialists, software developers and software engineers. ... should be part of every security professional's library ."
--Dr. Larry Ponemon,nbsp;Ponemon Institute

"... the definitive how-to guide for software security professionals. Dr. Ransome, Anmol Misra, and Brook Schoenfield deftly outline the procedures and policies needed to integrate real security into the software development process. ...A must-have for anyone on the front lines of the Cyber Warnbsp;..."
--Cedric Leighton, Colonel, USAF (Ret.), Cedric Leighton Associates

"Dr. Ransome, Anmol Misra, and Brook Schoenfield give you a magic formula in this book - the methodology and process to build security into the entire software development life cycle so that the software is secured at the source! "
--Eric S. Yuan, Zoom Video Communications

There is much publicity regarding network security, but the real cyber Achilles' heel is insecure software. Millions of software vulnerabilities create a cyber house of cards, in which we conduct our digital lives. In response, security people build ever more elaborate cyber fortresses to protect this vulnerable software. Despite their efforts, cyber fortifications consistently fail to protect our digital treasures. Why? The security industry has failed to engage fully with the creative, innovative people who write software.

Core Software Security expounds developer-centric software security, a holistic process to engage creativity for security. As long as software is developed by humans, it requires the human element to fix it. Developer-centric security is not only feasible but also cost effective and operationally relevant. The methodology builds security into software development, which lies at the heart of our cyber infrastructure. Whatever development method is employed, software must be secured at the source.

Book Highlights:

Supplies a practitioner's view of the SDL Considers Agile as a security enabler Covers the privacy elements in an SDL Outlines a holistic business-savvy SDL framework that includes people, process, and technology Highlights the key success factors, deliverables, and metrics for each phase of the SDL Examines cost efficiencies, optimized performance, and organizational structure of a developer-centric software security program and PSIRT Includes a chapter by noted security architect Brook Schoenfield who shares his insights and experiences in applying the book's SDL framework

View the authors' website at http://www.androidinsecurity.com/


Author Notes

Dr. James Ransome is the Senior Director of Product Security and responsible for all aspects of McAfee's Product Security Program, a corporate-wide initiative that supports McAfee's business units in delivering best-in-class, secure software products to customers. In this role, James sets program strategy, manages security engagements with McAfee business units, maintains key relationships with McAfee product engineers, and works with other leaders to help define and build product security capabilities. His career has been marked by leadership positions in private and public industries, including three chief information security officer (CISO) and four chief security officer (CSO) roles. Prior to entering the corporate world, James had 23 years of government service in various roles supporting the U.S. intelligence community, federal law enforcement, and the Department of Defense.

James holds a Ph.D. in Information Systems. He developed/tested a security model, architecture, and provided leading practices for converged wired/wireless network security for his doctoral dissertation as part of a NSA/DHS Center of Academic Excellence in Information Assurance Education program. He is the author of several books on information security, and Core Software Security: Security at the Source is his 10th. James is a member of Upsilon Pi Epsilon, the International Honor Society for the Computing and Information Disciplines, and he is a Certified Information Security Manager (CISM), a Certified Information Systems Security Professional (CISSP), and a Ponemon Institute Distinguished Fellow.

Anmol Misra is an author and a security professional with a wide range of experience in the field of information security. His expertise includes mobile and application security, vulnerability management, application and infrastructure security assessments, and security code reviews. He is a Program Manager in Cisco's Information Security group. In this role, he is responsible for developing and implementing security strategy and programs to drive security best practices into all aspects of Cisco's hosted products. Prior to joining Cisco, Anmol was a Senior Consultant with Ernst & Young LLP. In this role, he advised Fortune 500 clients on defining and improving information security programs and practices. He helped corporations to reduce IT security risk and achieve regulatory compliance by improving their security posture.

Anmol is co-author of Android Security: Attacks and Defenses , and is a contributing author of Defending the Cloud: Waging War in Cyberspace . He holds a master's degree in Information Networking from Carnegie Mellon University and a Bachelor of Engineering degree in Computer Engineering. He is based out of San Francisco, California.


Table of Contents

Hon. Howard A. Schmidt
Dedicationp. v
Forewordp. xiii
Prefacep. xix
Acknowledgmentsp. xxiii
About the Authorsp. xxv
Chapter 1 Introductionp. 1
1.1 The Importance and Relevance of Software Securityp. 3
1.2 Software Security and the Software Development Lifecyclep. 6
1.3 Quality Versus Secure Codep. 10
1.4 The Three Most Important SDL Security Goalsp. 11
1.5 Threat Modeling and Attack Surface Validationp. 13
1.6 Chapter Summary-What to Expect from This Bookp. 15
Referencesp. 16
Chapter 2 The Secure Development Lifecyclep. 19
2.1 Overcoming Challenges in Making Software Securep. 20
2.2 Software Security Maturity Modelsp. 21
2.3 ISO/IEC 27034-Information Technology-Security Techniques-Application Securityp. 23
2.4 Other Resources for SDL Best Practicesp. 25
2.4.1 SAFECodep. 25
2.4.2 U.S. Department of Homeland Security Software Assurance Programp. 26
2.4.3 National Institute of Standards and Technologyp. 27
2.4.4 MITRE Corporation Common Computer Vulnerabilities and Exposuresp. 28
2.4.5 SANS Institute Top Cyber Security Risksp. 30
2.4.6 U.S. Department of Defense Cyber Security and Information Systems Information Analysis Center (CSIAC)p. 30
2.4.7 CERT, Bugtraq, and SecurityFocusp. 31
2.5 Critical Tools and Talentp. 31
2.5.1 The Toolsp. 32
2.5.2 The Talentp. 34
2.6 Principles of Least Privilegep. 40
2.7 Privacyp. 41
2.8 The Importance of Metricsp. 42
2.9 Mapping the Security Development Lifecycle to the Software Development Lifecyclep. 45
2.10 Software Development Methodologiesp. 50
2.10.1 Waterfall Developmentp. 51
2.10.2 Agile Developmentp. 53
2.3 Chapter Summaryp. 56
Referencesp. 57
Chapter 3 Security Assessment (A1): SDL Activities and Best Practicesp. 61
3.1 Software Security Team Is Looped in Earlyp. 63
3.2 Software Security Hosts a Discovery Meetingp. 64
3.3 Software Security Team Creates an SDL Project Planp. 66
3.4 Privacy Impact Assessment (PIA) Plan Initiatedp. 66
3.5 Security Assessment (A1) Key Success Factors and Metricsp. 73
3.5.1 Key Success Factorsp. 73
3.5.2 Deliverablesp. 76
3.5.3 Metricsp. 78
3.6 Chapter Summaryp. 79
Referencesp. 79
Chapter 4 Architecture (A2): SDL Activities and Best Practicesp. 81
4.1 A2 Policy Compliance Analysisp. 83
4.2 SDL Policy Assessment and Scopingp. 84
4.3 Threat Modeling/Architecture Security Analysisp. 84
4.3.1 Threat Modelingp. 84
4.3.2 Data Flow Diagramsp. 88
4.3.3 Architectural Threat Analysis and Ranking of Threatsp. 95
4.3.4 Risk Mitigationp. 117
4.4 Open-Source Selectionp. 124
4.5 Privacy Information Gathering and Analysisp. 124
4.6 Key Success Factors and Metricsp. 125
4.6.1 Key Success Factorsp. 125
4.6.2 Deliverablesp. 126
4.6.3 Metricsp. 127
4.7 Chapter Summaryp. 128
Referencesp. 129
Chapter 5 Design and Development (A3): SDL Activities and Best Practicesp. 133
5.1 A3 Policy Compliance Analysisp. 135
5.2 Security Test Plan Compositionp. 135
5.3 Threat Model Updatingp. 146
5.4 Design Security Analysis and Reviewp. 146
5.5 Privacy Implementation Assessmentp. 150
5.6 Key Success Factors and Metricsp. 154
5.6.1 Key Success Factorsp. 154
5.6.2 Deliverablesp. 156
5.6.3 Metricsp. 157
5.7 Chapter Summaryp. 158
Referencesp. 158
Chapter 6 Design and Development (A4): SDL Activities and Best Practicesp. 161
6.1 A4 Policy Compliance Analysisp. 163
6.2 Security Test Case Executionp. 164
6.3 Code Review in the SDLC/SDL Processp. 168
6.4 Security Analysis Toolsp. 174
6.4.1 Static Analysisp. 177
6.4.2 Dynamic Analysisp. 182
6.4.3 Fuzz Testingp. 185
6.4.4 Manual Code Reviewp. 188
6.5 Key Success Factorsp. 192
6.6 Deliverablesp. 193
6.7 Metricsp. 194
6.8 Chapter Summaryp. 195
Referencesp. 195
Chapter 7 Ship (A5): SDL Activities and Best Practicesp. 199
7.1 A5 Policy Compliance Analysisp. 201
7.2 Vulnerability Scanp. 202
7.3 Penetration Testingp. 205
7.4 Open-Source Licensing Reviewp. 208
7.5 Final Security Reviewp. 212
7.6 Final Privacy Reviewp. 216
7.7 Key Success Factorsp. 217
7.8 Deliverablesp. 219
7.9 Metricsp. 221
7.10 Chapter Summaryp. 221
Referencesp. 223
Chapter 8 Post-Release Support (PRSA1-5)p. 225
8.1 Right-Sizing Your Software Security Groupp. 227
8.1.1 The Right Organizational Locationp. 227
8.1.2 The Right Peoplep. 229
8.1.3 The Right Processp. 229
8.2 PRSA1: External Vulnerability Disclosure Responsep. 232
8.2.1 Post-Release PSIRT Responsep. 233
8.2.2 Post-Release Privacy Responsep. 238
8.2.3 Optimizing Post-Release Third-Party Responsep. 239
8.3 PRSA2: Third-Party Reviewsp. 240
8.4 PRSA3: Post-Release Certificationsp. 242
8.5 PRSA4: Internal Review for New Product Combinations or Cloud Deploymentsp. 243
8.6 PRSA5: Security Architectural Reviews and Tool-Based Assessments of Current, Legacy, and M&A Products and Solutionsp. 243
8.6.1 Legacy Codep. 243
8.6.2 Mergers and Acquisitions (M&As)p. 247
8.7 Key Success Factorsp. 248
8.8 Deliverablesp. 251
8.9 Metricsp. 252
8.10 Chapter Summaryp. 252
Referencesp. 253
Chapter 9 Applying the SDL Framework to the Real Worldp. 255
9.0 Introductionp. 256
9.1 Build Software Securelyp. 261
9.1.1 Produce Secure Codep. 264
9.1.2 Manual Code Reviewp. 269
9.1.3 Static Analysisp. 271
9.2 Determining the Right Activities for Each Projectp. 275
9.2.1 The Seven Determining Questionsp. 275
9.3 Architecture and Designp. 292
9.4 Testingp. 302
9.4.1 Functional Testingp. 303
9.4.2 Dynamic Testingp. 304
9.4.3 Attack and Penetration Testingp. 309
9.4.4 Independent Testingp. 311
9.5 Agile: Sprintsp. 312
9.6 Key Success Factors and Metricsp. 317
9.6.1 Secure Coding Training Programp. 317
9.6.2 Secure Coding Frameworks (APIs)p. 318
9.6.3 Manual Code Reviewp. 318
9.6.4 Independent Code Review and Testing (by Experts or Third Parties)p. 318
9.6.5 Static Analysisp. 319
9.6.6 Risk Assessment Methodologyp. 319
9.6.7 Integration of SDL with SDLCp. 319
9.6.8 Development of Architecture Talentp. 319
9.7 Metricsp. 320
9.8 Chapter Summaryp. 321
Referencesp. 323
Chapter 10 Pulling It All Together: Using the SDL to Prevent Real-World Threatsp. 325
10.1 Strategic, Tactical, and User-Specific Software Attacksp. 326
10.1.1 Strategic Attacksp. 328
10.1.2 Tactical Attacksp. 338
10.1.3 User-Specific Attacksp. 339
10.2 Overcoming Organizational and Business Challenges with a Properly Designed, Managed, and Focused SDLp. 339
10.3 Software Security Organizational Realities and Leveragep. 340
10.4 Overcoming SDL Audit and Regulatory Challenges with Proper Governance Managementp. 342
10.5 Future Predications for Software Securityp. 343
10.5.1 The Bad Newsp. 343
10.5.2 The Good Newsp. 345
10.6 Conclusionp. 345
Referencesp. 347
Appendixp. 351
Indexp. 359