John Viega Knihy

Most organizations employ firewalls, antivirus software, and intrusion detection systems to fend off attackers, yet computer security issues are escalating. The core problem lies in bad software. Traditional solutions merely address symptoms reactively rather than tackling the underlying issues. This book advocates for a proactive approach to computer security, emphasizing the importance of getting security right from the outset. It is essential reading for security professionals who recognize software as a significant risk and for developers aiming to create secure code. Suitable for all involved in software development—from managers to programmers—this guide is your initial step toward enhancing software security. It offers expert insights and techniques to safeguard critical software by considering threats and vulnerabilities early in the development process. You will learn to assess acceptable risk levels, create security tests, and address vulnerabilities before software release. The book presents ten guiding principles for software security and detailed strategies to help you design robust systems. By building secure software, you can effectively defend against breaches, avoid the "penetrate and patch" cycle, and maintain customer trust while saving time, money, and credibility.

Most applications today are network aware, raising the need for protection against common security threats. Developers increasingly rely on OpenSSL, an open-source implementation of SSL/TLS, the leading protocol for secure network communications. OpenSSL is widely adopted for websites requiring cryptographic functions to safeguard sensitive information like credit card numbers and financial transactions. As the only free, full-featured SSL implementation for C and C++, it can be used programmatically or via the command line to secure TCP-based network protocols. This concise guide enables developers to utilize OpenSSL effectively, streamlining what traditionally took weeks into manageable steps. It helps avoid pitfalls while focusing on essential information for safe and effective use. The book outlines challenges in securing network communications and demonstrates how to leverage OpenSSL tools to address them. System and network administrators will appreciate the comprehensive treatment of the command-line interface, including step-by-step instructions for obtaining certificates and establishing a certification authority. Developers will find in-depth discussions and examples for integrating OpenSSL into their programs, with additional information on using it with Perl, Python, and PHP. If you need to protect sensitive data, this guide is the definitive resource on the subject.