The Art of Software Security Assessment

Identifying and Preventing Software Vulnerabilities
By: 
Dowd, McDonald and Schuh
Published: 
2006
Pages: 
1200
Share URL
 
Book Description

This is one of the most detailed, sophisticated, and useful guides to software security auditing ever written. The authors are leading security consultants and researchers who have personally uncovered vulnerabilities in applications ranging from sendmail to Microsoft Exchange, Check Point VPN to Internet Explorer. Drawing on their extraordinary experience, they introduce a start-to-finish methodology for “ripping apart” applications to reveal even the most subtle and well-hidden security flaws.

The Art of Software Security Assessment covers the full spectrum of software vulnerabilities in both UNIX/Linux and Windows environments. It demonstrates how to audit security in applications of all sizes and functions, including network and Web software. Moreover, it teaches using extensive examples of real code drawn from past flaws in many of the industry's highest-profile applications.

Member Reviews: 

Review By: J. D. Kennedy
03/07/2008This book is written by three experts in the field who have shared the depth of their security knowledge and experience in a readable and instructive format. The basic premise of the book is that while it is desirable to avoid security vulnerabilities this isn't always accomplishable when you have software already in production. The experts start with the basics of software security assessment and make recommendations on how to "shortcut" the process when time or resources are limited. While the material is aimed at assessing the security of software, it is also provides lessons in what to avoid when developing software.

The writing style is easy to read considering that some might not find the topic riveting. This book is suitable for novices developing a knowledge-based foundation on these issues and for experienced developers who need a reference to remind them of things to look for.

The book starts by covering the fundamentals of software vulnerabilities and then covers basic review methodologies. It goes into more depth by exploring specific vulnerabilities of both UNIX and Windows based systems. The final section deals with software vulnerability in practice. In the "How to Use This Book" section, the authors recommend that the book be read straight through “at least once” to get a feel for the material. Luckily they also recognize that this may not be feasible for readers who wish to put the principles into practice. So, they organized the book so that specific topics and techniques are easy to find and use without having to read the entire book.

I liked the simple yet powerful examples used and how the experts build on them to create more complex issues. The concept of userids and passwords is fundamental to most computer systems; the discussion of how either may be easily compromised by inappropriate communication responses should hit home with any developer. Regardless of how obvious this subject matter is to even moderately experienced programmers, basic errors are repeated time and again by novices. I will be taking this book off the shelf and handing it to developers on my team whenever they are working on a new application.

Review By: Dmitri Ilkaev
03/07/2008The Art of Software Security Assessment covers the wide spectrum of software vulnerabilities in both UNIX/Linux and Windows environments. It demonstrates how to audit security in applications of all sizes and functions, including network and Web software. The authors lay out several tracks for different types of security reviews—UNIX, Windows, Web, network application, and network analysis tracks.

The book covers:

  • Code auditing: theory, practice, proven methodologies, and secrets of the trade
  • Bridging the gap between secure software design and post-implementation review
  • Performing architectural assessment: design review, threat modeling, and operational review
  • Identifying vulnerabilities related to memory management, data types, and malformed data
  • UNIX/Linux assessment: privileges, files, and processes
  • Windows-specific issues, including objects and the file system
  • Auditing inter-process communication, synchronization, and state
  • Evaluating network software: IP stacks, firewalls, and common application protocols
  • Auditing Web applications and technologies

The book consists of eighteen chapters and is divided into three main parts: Introduction to Software Security Assessment, Software Vulnerabilities, and Software Vulnerabilities in Practice. This is not a small book either; it’s close to 1,200 pages.

The first part of the book covers the general process of reviewing for security, including design security, operational security, and application security. It also presents the general areas of potential weakness that you need to look for in each development stage, and it provides the reader with a practical methodology that can be used to consistently review all parts of the development process.

The second part of the book provides multiple examples where the authors build the case with a focus on a specific security area and use both code fragments and clear diagrams with very detailed explanations in order to present the case. Armed with the deep understanding of why certain techniques are lacking, it's easier to change fundamental coding habits proactively rather than just fix problems as they're discovered in testing or production. A majority of the examples are in C/C++. Although an experienced developer should be able to follow the concepts, additional mapping of these concepts against other popular programming languages is required in order to better appreciate the presented analysis.

The final section includes network protocols, firewalls, network application protocols, Web applications, and Web technologies analysis.

The book is a great resource for everyone who must develop secure software or assure the safety of existing software.

Upcoming Events

Oct 13 Agile + DevOps USA
The Conference for Agile and DevOps Professionals
Apr 27 STAREAST
Software Testing Conference in Orlando & Online