Building Secure Software review

Given the number of times we have to download and install YAP (yet another patch) for a security problem relating to n by way of just one example n buffer overflow issues, perhaps someone should buy a copy of Building Secure Software for the Microsoft Campus library at Redmond, Seattle.
Sticking with this example, it highlights how simple it is to let an easily preventable bug crawl out into even the biggest of software projects. If it can happen in the likes of XP and Internet Explorer with their astronomical development budgets and myriad of programming staff, then spare a thought as to how difficult bringing bug-free applications to the market can be for the smaller enterprise.
This is where this book comes in n part of the Addison-Wesley Professional Computing Series and authored by two acknowledged experts in the field. Their core advice is simple and seemingly forgotten by all too many developers today: get the design foundations right and you end up with a much better chance that the end product won't collapse around you at a later date. In other words, this book teaches you how to take a proactive approach to computer security from the bottom up.
The book follows a logical progression from introductory overview that takes the reader from dealing with widespread security failures through ongoing technical trends and understanding essential development goals of multilevel security. From here, we move on to software risk management before hitting the heavy stuff and discovering the right languages for the job in hand, including an excellent look at authentication technologies. The eternal conundrum of open vs closed source n or the security by obscurity debate, if you prefer n is quickly summed up along with a 'top 10' of guiding principles for software security.
One of the few areas of criticism that might be made is a distinct favouring of Unix as the platform of choice, but this bias is perhaps understandable, considering the book's purpose. Still, those of a technical bent won't be disappointed, as this tome is aimed squarely at them. You'll find coverage of those buffer overflows (in a dedicated 50-page chapter), race conditions, applied cryptography, client-side issues, firewall strategies and code obfuscation.

Author: Davey Winder