Secure Coding: Principles & Practices"--O'reilly."Secure Coding. Principles and Practices" makes the case that developers must be vigilant throughout the entire code lifecycle including: * Architecture: during this stage, applying security principles such as 'least privilege" will help limit even the impact of successful attempts to subvert software. * Design: during this stage, designers must determine how programs will behave when confronted with fatally fa·tal·ly adv. 1. So as to cause death; mortally: fatally injured. 2. So as to result in disaster or ruin. 3. According to the decree of fate; inevitably. Adv. 1. flawed flaw 1 n. 1. An imperfection, often concealed, that impairs soundness: a flaw in the crystal that caused it to shatter. See Synonyms at blemish. 2. input data. The book also offers advice about performing security retrofitting when you don't have the source code-ways of protecting software from being exploited even if bugs can't be fixed. * Implementation: during this stage, programmers must sanitize To remove sensitive data from an information system, a database or an extract from a database. See sensitive. all program input (the character streams representing a programs' entire interface with its environment-not just the command lines and environment variables that are the focus of most security analysis). * Testing: during this stage, programs must he checked using both static code checkers checkers, game for two players, known in England as draughts. It is played on a square board, divided into 64 alternately colored—usually red and black or white and black—square spaces, identical with a chessboard. and runtime testing methods-for example, the fault injection systems now available to check for the presence of such flaws as buffer overflow A common cause of malfunctioning software. If the amount of data written into a buffer exceeds the size of the buffer, the additional data will be written into adjacent areas, which could be buffers, constants, flags or variables. . * Operations: during this stage, patch updates must be installed in a timely fashion. For more info on the book, including Table of Contents, author bios and index see wwww.oreilly.com/catalog/securecdng/ |
|
||||||||||||||
Printer friendly
Cite/link
Email
Feedback
Reader Opinion