Hunting Security Bugs

Features

• Cover Type: Paperback with 592 pages
• Published by: Microsoft Press June 9, 2006
• Written in: English
• ISBN 10 Number: 073562187X
• ISBN 13 Number: 978-0735621879
• Book Dimensions: 8.8 x 7.3 x 1.5 inches
• Weighs: 2.3 pounds

Book Description
Your in-depth, hands-on, technical security-testing reference. Written for testers by testers, this guide highlights up-to-date tools, technologies, and techniques for helping find and eliminate security vulnerabilities in software.

Publisher Description
Key Book Benefits: - Delivers practical, hands-oguidance on security bugs, how to find them, and how to help prevent them Provides specific, actionable technical details about security testing - Covers these subjects, among others: - The thought process behind security testing - Research and experience on how to find security bugs - How to classify the bugs youve found - What to do when youve found a bug - How to tell if a bug is serious and whether it is a security bug - Use of source code to help in security testing - Ways to spot security design flaws

Reader Reviews
As with other reviewers of the book: in an attempt at full disclosure, I also work at Microsoft. I am a Test Lead in the Office organization. One of the challenges that faces any quality assurance engineer or Test engineer, or whatever our industry has chosen to call us this year is that we are constantly tasked with trying to "test in security" or "find the flaws in the product" after it has already been coded. While this is clearly a PART of our jobs, it is by no means the most important part. This book addresses what I consider to be a much higher priority for the Test Org generally, and Test Engineers specifically: helping reduce security vulnerabilities before they are coded into the product to begin with: as features are being spec'd and as code is being designed. This book is not a simple check-list testers can use to say "Yes, my feature is secure, Ship It". Rather, it helps place Test into the frame of mind of a hacker, it gives test a set of tools to help find security issues, it outlines an approach to software Test that will cause fewer security issues to be coded at all, let alone have to be fixed post code-complete (or in a Service Pack). Used in conjunction with other test books like _How to Break Software Security_ by James A. Whittaker, this book will help ship more secure products. Incidentally, I expect hackers will be reading this book in an effort to better understand the science of hunting security bugs, as well as the tools we use to do so - so if you're not using it, I'd expect your attackers will be thankful... Comment | | (Report this)