Share
Create bookmark
Writing Secure Code
Do you like this document?
Notes
Please login to add notes
- Copyright
- Contents at a Glance
- Table of Contents
- Introduction
-
+
Part I. Contemporary Security
-
+
Part II. Secure Coding Techniques
- + Chapter 5. Public Enemy #1: The Buffer Overrun
- + Chapter 6. Determining Appropriate Access Control
-
+
Chapter 7. Running with Least Privilege
- Least Privilege in the Real World
- Brief Overview of Access Control
- Brief Overview of Privileges
- Brief Overview of Tokens
- How Tokens, Privileges, SIDs, ACLs, and Processes Relate
- Three Reasons Applications Require Elevated Privileges
- Solving the Elevated Privileges Issue
- A Process for Determining Appropriate Privilege
- Low-Privilege Service Accounts in Windows XP and Windows.NET Server 2003
- The Impersonate Privilege and Windows .NET Server 2003
- Debugging Least-Privilege Issues
- Summary
-
+
Chapter 8. Cryptographic Foibles
- Using Poor Random Numbers
- Using Passwords to Derive Cryptographic Keys
- Key Management Issues
- Creating Your Own Cryptographic Functions
- Using the Same Stream-Cipher Encryption Key
- Bit-Flipping Attacks Against Stream Ciphers
- Reusing a Buffer for Plaintext and Ciphertext
- Using Crypto to Mitigate Threats
- Document Your Use of Cryptography
-
+
Chapter 9. Protecting Secret Data
- Attacking Secret Data
- Sometimes You Don’t Need to Store a Secret
- Getting the Secret from the User
- Protecting Secrets in Windows 2000 and Later
- Protecting Secrets in Windows NT 4
- Protecting Secrets in Windows 95, Windows 98, Windows Me,and Windows CE
- Not Opting for a Least Common Denominator Solution
- Managing Secrets in Memory
- Locking Memory to Prevent Paging Sensitive Data
- Protecting Secret Data in Managed Code
- Raising the Security Bar
- Trade-Offs When Protecting Secret Data
- Summary
- + Chapter 10. All Input Is Evil!
- + Chapter 11. Canonical Representation Issues
- + Chapter 12. Database Input Issues
- + Chapter 13. Web-Specific Input Issues
-
+
Chapter 14. Internationalization Issues
- The Golden I18N Security Rules
- Use Unicode in Your Application
- Prevent I18N Buffer Overruns
- Validate I18N
- Character Set Conversion Issues
- Use MultiByteToWideChar with MB_PRECOMPOSED andMB_ERR_INVALID_CHARS
- Use WideCharToMultiByte with WC_NO_BEST_FIT_CHARS
- Comparison and Sorting
- Unicode Character Properties
- Normalization
- Summary
-
+
Part III. Even More Secure Coding Techniques
- + Chapter 15. Socket Security
- + Chapter 16. Securing RPC, Active
- + Chapter 17. Protecting Against Denial of Service Attacks
-
+
Chapter 18. Writing Secure .NET Code
- Code Access Security: In Pictures
- FxCop: A “Must-Have” Tool
- Assemblies Should Be Strong-Named
- Specify Assembly Permission Requirements
- Overzealous Use of Assert
- Further Information Regarding Demand and Assert
- Keep the Assertion Window Small
- Demands and Link Demands
- Use SuppressUnmanagedCodeSecurityAttribute with Caution
- Remoting Demands
- Limit Who Uses Your Code
- No Sensitive Data in XML or Configuration Files
- Review Assemblies That Allow Partial Trust
- Check Managed Wrappers toUnmanaged Code for Correctness
- Issues with Delegates
- Issues with Serialization
- The Role of Isolated Storage
- Disable Tracing and DebuggingBefore Deploying ASP.NET Applications
- Do Not Issue Verbose Error Information Remotely
- Deserializing Data from Untrusted Sources
- Don’t Tell the Attacker Too Much When You Fail
- Summary
-
+
Part IV. Special Topics
-
+
Chapter 19. Security Testing
- The Role of the Security Tester
- Security Testing Is Different
- Building Security Test Plans from a Threat Model
- Testing Clients with Rogue Servers
- Should a User See or Modify That Data?
- Testing with Security Templates
- When You Find a Bug, You’re Not Done!
- Test Code Should Be of Great Quality
- Test the End-to-End Solution
- Determining Attack Surface
- Summary
- + Chapter 20. Performing a Security Code Review
- + Chapter 21. Secure Software Installation
- + Chapter 22. Building Privacy into Your Application
-
+
Chapter 23. General Good Practices
- Don’t Tell the Attacker Anything
- Service Best Practices
- Don’t Leak Information in Banner Strings
- Be Careful Changing Error Messages in Fixes
- Double-Check Your Error Paths
- Keep It Turned Off!
- Kernel-Mode Mistakes
- Add Security Comments to Code
- Leverage the Operating System
- Don’t Rely on Users Making Good Decisions
- Calling CreateProcess Securely
- Don’t Create Shared/Writable Segments
- Using Impersonation Functions Correctly
- Don’t Write User Files to \Program Files
- Don’t Write User Data to HKLM
- Don’t Open Objects for FULL_CONTROL or ALL_ACCESS
- Object Creation Mistakes
- Care and Feeding of CreateFile
- Creating Temporary Files Securely
- Implications of Setup Programs and EFS
- File System Reparse Point Issues
- Client-Side Security Is an Oxymoron
- Samples Are Templates
- Dogfood Your Stuff!
- You Owe It to Your Users If…
- Determining Access Based on an Administrator SID
- Allow Long Passwords
- Be Careful with _alloca
- Don’t Embed Corporate Names
- Move Strings to a Resource DLL
- Application Logging
- Migrate Dangerous C/C++ to Managed Code
- + Chapter 24. Writing Security Documentation and Error Messages
-
+
Chapter 19. Security Testing
- + Part V. Appendixes
- Annotated Bibliography
- Index
Keep black-hat hackers at bay with the tips and techniques in this entertaining, eye-opening book! Developers will learn how to padlock their applications throughout the entire development process--from designing secure applications to writing robust code that can withstand repeated attacks to testing applications for security flaws. Easily digested chapters reveal proven principles, strategies, and coding techniques. The authors--two battle- scarred veterans who have solved some of the industry's toughest security problems--provide sample code in several languages. This edition includes updated information about threat modeling, designing a security process, international issues, file-system issues, adding privacy to applications, and performing security code reviews. It also includes enhanced coverage of buffer overruns, Microsoft® .NET security, and Microsoft ActiveX® development, plus practical checklists for developers, testers, and program managers.
Your free to read time expires in minutes. After that you have to pause for an hour.
Test the closed alpha on paperc.com
Book Details
Authors
Michael Howard and David LeBlanc
Categories
Publishers
Publication year : 2009
License: All rights reserved ©
Times read: 822
