Secure Programming with Static Analysis (Addison Wesley Software Security Series

Creating secure code requires more than just good intentions.

Programmers need to know that their code will be safe in an almost

infinite number of scenarios and configurations.

Static source code analysis gives users the ability to review their work with a

fine-toothed comb and uncover the kinds of errors that lead directly to

security vulnerabilities. Now, there’s a complete guide to static

analysis: how it works, how to integrate it into the software

development processes, and how to make the most of it during security

code review. Static analysis experts Brian Chess and Jacob West look at

the most common types of security defects that occur today. They

illustrate main points using Java and C code examples taken from

real-world security incidents, showing how coding errors are exploited,

how they could have been prevented, and how static analysis can rapidly

uncover similar mistakes. This book is for everyone concerned with

building more secure software: developers, security engineers, analysts,

and testers.

Coverage includes:

- Why conventional bug-catching often misses security problems

- How static analysis can help programmers get security right

- The critical attributes and algorithms that make or break a static

analysis tool

- 36 techniques for making static analysis more effective on your code

- More than 70 types of serious security vulnerabilities, with specific

solutions

- Example vulnerabilities from Firefox, OpenSSH, MySpace, eTrade,

Apache httpd, and many more

- Techniques for handling untrusted input

- Eliminating buffer overflows: tactical and strategic approaches

- Avoiding errors specific to Web applications, Web services, and Ajax

- Security-aware logging, debugging, and error/exception handling

- Creating, maintaining, and sharing secrets and confidential

information

- Detailed tutorials that walk you through the static analysis process

(3.66 Mb):

Code:

or

V

or