Security Matters: Getting Software Security Right With Static Analysis

The current state of software security is poor. New vulnerabilities are discovered every day, and, in practice, the programming community tends to repeat the same security mistakes over and over again. With a focus on commercial software for both business and consumers, and an emphasis on business systems, this book discusses a wide variety of common coding errors that lead to security problems, explains the ramifications of each, and gives advice for charting a safe course. Chess and West start by introducing 100 key guidelines for developing secure software and review more than 80 types of known software vulnerabilities. They discuss techniques and provide code to combat each of these vulnerabilities that will help any developer to write more secure code. In addition, this book introduces static source code analysis tools. In Software Security, Gary McGraw names code review as one of more important touch points for software security. For complicated enterprise systems, code review means evaluating up to a million lines of code and reviewing how it might behave in a nearly infinite number of settings. Static source code analysis tools are like spell-checkers for software and spot problems in code, significantly assisting in the challenge of code review. In short, Security Matters provides the understanding AND the tools to build more secure software.