View Larger Image	Michael Howard, David LeBlanc Microsoft Press, Paperback, 2nd edition, Published December 2002, 768 pages, ISBN 0735617228
	List Price: $49.99 Our Price: $31.50 You Save: $18.49 (37% Off)
	Availability: Out-Of-Stock

Write a Review and tell the world about this title!

People who purchase this book frequently purchase:

• Code Complete, 2nd Edition; Steve McConnell, $31.50, 37% Off!
• Rapid Development: Taming Wild Software Schedules; Steve McConnell, $22.50, 36% Off!
• Software Requirements, 2nd Edition; Karl E. Wiegers, $25.50, 36% Off!
• Head First Design Patterns; Eric Freeman, et al, $28.50, 37% Off!

• Programming : Software Development

• Microsoft Press

• Focuses on the number one issue on developers' minds today-how to write code that can withstand malicious attack
• Includes enhanced coverage of topics from the first edition plus in-depth coverage of new topics to offer the best, most comprehensive security title for developers
• It's the security book recommended by Bill Gates (Microsoft Chief Software Architect) and Brian Valentine (Microsoft Senior Vice President for Microsoft Windows® Development)
• Now updated with lessons from the Microsoft Security pushes

Table of Contents

Introduction	xxiii
PART I  CONTEMPORARY SECURITY
1 The Need for Secure Systems	3
Applications on the Wild Wild Web	5
The Need for Trustworthy Computing	7
Getting Everyone’s Head in the Game	7
Using Tact to Sell Security to the Organization	8
Using Subversion	11
Some Ideas for Instilling a Security Culture	13
Get the Boss to Send an E-Mail	14
Nominate a Security Evangelist	15
The Attacker’s Advantage and the Defender’s Dilemma	19
Principle #1: The defender must defend all points; the attacker can choose the weakest point.	19
Principle #2: The defender can defend only against known attacks; the attacker can probe for unknown vulnerabilities.	20
Principle #3: The defender must be constantly vigilant; the attacker can strike at will.	20
Principle #4: The defender must play by the rules; the attacker can play dirty.	21
Summary	21
2 The Proactive Security Development Process	23
Process Improvements	25
The Role of Education	26
Resistance to Mandatory Training	29
Ongoing Training	29
Advancing the Science of Security	29
Education Proves the More Eyes Fallacy	31
Now the Evidence!	31
Design Phase	32
Security Questions During Interviews	33
Define the Product Security Goals	34
Security Is a Product Feature	37
Making Time for Security	40
Threat Modeling Leads to Secure Design	41
Build End-of-Life Plans for Insecure Features	41
Setting the Bug Bar	41
Security Team Review	43
Development Phase	43
Be Hardcore About Who Can Check In New Code (Check-Ins Checked)	43
Security Peer Review of New Code (Check-Ins Checked)	44
Define Secure Coding Guidelines	44
Review Old Defects	44
External Security Review	45
Security Push	45
Be Mindful of Your Bug Counts	46
Keep Track of Bug Metrics	46
No Surprises and No Easter Eggs!	47
Test Phase	47
Shipping and Maintenance Phases	47
How Do You Know When You’re Done?	47
Response Process	48
Accountability	49
Summary	49
3  Security Principles to Live By	51
SD3: Secure by Design, by Default, and in Deployment	51
Secure by Design	51
Secure by Default	53
Secure in Deployment	53
Security Principles	54
Learn from Mistakes	54
Minimize Your Attack Surface	57
Employ Secure Defaults	57
Use Defense in Depth	59
Use Least Privilege	60
Backward Compatibility Will Always Give You Grief	62
Assume External Systems Are Insecure	63
Plan on Failure	64
Fail to a Secure Mode	64
Remember That Security Features != Secure Features	66
Never Depend on Security Through Obscurity Alone	66
Don’t Mix Code and Data	67
Fix Security Issues Correctly	67
Summary	68
4  Threat Modeling	69
Secure Design Through Threat Modeling	70
Assemble the Threat-Modeling Team	72
Decompose the Application	73
Determine the Threats to the System	83
Rank the Threats by Decreasing Risk	93
Choose How to Respond to the Threats	106
Choose Techniques to Mitigate the Threats	107
Security Techniques	108
Authentication	109
Authorization	114
Tamper-Resistant and Privacy-Enhanced Technologies	115
Protect Secrets, or Better Yet, Don’t Store Secrets	116
Encryption, Hashes, MACs, and Digital Signatures	116
Auditing	117
Filtering, Throttling, and Quality of Service	118
Least Privilege	118
Mitigating the Sample Payroll Application Threats	118
A Cornucopia of Threats and Solutions	120
Summary	124
PART II SECURE CODING TECHNIQUES
5  Public Enemy #1: The Buffer Overrun	127
Stack Overruns	129
Heap Overruns	138
Array Indexing Errors	144
Format String Bugs	147
Unicode and ANSI Buffer Size Mismatches	153
A Real Unicode Bug Example	154
Preventing Buffer Overruns	155
Safe String Handling	156
A Word of Caution About String-Handling Functions	166
The Visual C++ .NET /GS Option	167
Summary	170
6  Determining Appropriate Access Control	171
Why ACLs Are Important	171
A Diversion: Fixing the Registry Code	173
What Makes Up an ACL?	175
A Method of Choosing Good ACLs	178
Effective Deny ACEs	180
Creating ACLs	181
Creating ACLs in Windows NT 4	181
Creating ACLs in Windows 2000	185
Creating ACLs with Active Template Library	189
Getting the ACE Order Right	191
Be Wary of the Terminal Server and Remote Desktop SIDs	193
NULL DACLs and Other Dangerous ACE Types	195
NULL DACLs and Auditing	197
Dangerous ACE Types	197
What If I Can’t Change the NULL DACL?	198
Other Access Control Mechanisms	199
.NET Framework Roles	199
COM+ Roles	201
IP Restrictions	202
SQL Server Triggers and Permissions	203
A Medical Example	203
An Important Note About Access Control Mechanisms	205
Summary	206
7  Running with Least Privilege	207
Least Privilege in the Real World	208
Viruses and Trojans	209
Web Server Defacements	210
Brief Overview of Access Control	211
Brief Overview of Privileges	211
SeBackupPrivilege Issues	212
SeRestorePrivilege Issues	215
SeDebugPrivilege Issues	215
SeTcbPrivilege Issues	216
SeAssignPrimaryTokenPrivilege and SeIncreaseQuotaPrivilege Issues	217
SeLoadDriverPrivilege Issues	217
SeRemoteShutdownPrivilege Issues	217
SeTakeOwnershipPrivilege Issues	217
Brief Overview of Tokens	218
How Tokens, Privileges, SIDs, ACLs, and Processes Relate	218
SIDs and Access Checks, Privileges and Privilege Checks	219
Three Reasons Applications Require Elevated Privileges	220
ACL Issues	220
Privilege Issue	221
Using LSA Secrets	221
Solving the Elevated Privileges Issue	222
Solving ACL Issues	222
Solving Privilege Issues	223
Solving LSA Issues	223
A Process for Determining Appropriate Privilege	223
Step 1: Find Resources Used by the Application	224
Step 2: Find Privileged APIs Used by the Application	224
Step 3: Which Account Is Required?	226
Step 4: Get the Token Contents	226
Step 5: Are All the SIDs and Privileges Required?	232
Step 6: Adjust the Token	233
Low-Privilege Service Accounts in Windows XP and Windows .NET Server 2003	248
The Impersonate Privilege and Windows .NET Server 2003	250
Debugging Least-Privilege Issues	251
Why Applications Fail as a Normal User	251
How to Determine Why Applications Fail	252
Summary	258
8  Cryptographic Foibles	259
Using Poor Random Numbers	259
The Problem: rand	260
Cryptographically Random Numbers in Win32	262
Cryptographically Random Numbers in Managed Code	268
Cryptographically Random Numbers in Web Pages	269
Using Passwords to Derive Cryptographic Keys	269
Measuring the Effective Bit Size of a Password	270
Key Management Issues	272
Long-Term and Short-Term Keys	274
Use Appropriate Key Lengths to Protect Data	274
Keep Keys Close to the Source	276
Key Exchange Issues	279
Creating Your Own Cryptographic Functions	281
Using the Same Stream-Cipher Encryption Key	283
Why People Use Stream Ciphers	284
The Pitfalls of Stream Ciphers	284
What If You Must Use the Same Key?	287
Bit-Flipping Attacks Against Stream Ciphers	289
Solving Bit-Flipping Attacks	290
When to Use a Hash, Keyed Hash, or Digital Signature	290
Reusing a Buffer for Plaintext and Ciphertext	296
Using Crypto to Mitigate Threats	297
Document Your Use of Cryptography	298
9  Protecting Secret Data	299
Attacking Secret Data	300
Sometimes You Don’t Need to Store a Secret	301
Creating a Salted Hash	302
Using PKCS #5 to Make the Attacker’s Job Harder	303
Getting the Secret from the User	305
Protecting Secrets in Windows 2000 and Later	305
A Special Case: Client Credentials in Windows XP	309
Protecting Secrets in Windows NT 4	311
Protecting Secrets in Windows 95, Windows 98, Windows Me, and Windows CE	315
Getting Device Details Using PnP	316
Not Opting for a Least Common Denominator Solution	320
Managing Secrets in Memory	321
A Compiler Optimization Caveat	322
Encrypting Secret Data in Memory	326
Locking Memory to Prevent Paging Sensitive Data	327
Protecting Secret Data in Managed Code	329
Managing Secrets in Memory in Managed Code	335
Raising the Security Bar	336
Storing the Data in a File on a FAT File System	337
Using an Embedded Key and XOR to Encode the Data	337
Using an Embedded Key and 3DES to Encrypt the Data	337
Using 3DES to Encrypt the Data and Storing a Password in the Registry	337
Using 3DES to Encrypt the Data and Storing a Strong Key in the Registry	337
Using 3DES to Encrypt the Data, Storing a Strong Key in the Registry, and ACLing the File and the Registry Key	338
Using 3DES to Encrypt the Data, Storing a Strong Key in the Registry, Requiring the User to Enter a Password, and ACLing the File and the Registry Key	338
Trade-Offs When Protecting Secret Data	338
Summary	339
10  All Input Is Evil!	341
The Issue	342
Misplaced Trust	343
A Strategy for Defending Against Input Attacks	345
How to Check Validity	347
Tainted Variables in Perl	349
Using Regular Expressions for Checking Input	350
Be Careful of What You Find—Did You Mean to Validate?	352
Regular Expressions and Unicode	353
A Regular Expression Rosetta Stone	358
Regular Expressions in Perl	358
Regular Expressions in Managed Code	359
Regular Expressions in Script	360
Regular Expressions in C++	360
A Best Practice That Does Not Use Regular Expressions	361
Summary	362
11  Canonical Representation Issues	363
What Does Canonical Mean, and Why Is It a Problem?	364
Canonical Filename Issues	364
Bypassing Napster Name Filtering	364
Vulnerability in Apple Mac OS X and Apache	365
DOS Device Names Vulnerability	365
Sun Microsystems StarOffice /tmp Directory Symbolic-Link Vulnerability	366
Common Windows Canonical Filename Mistakes	367
Canonical Web-Based Issues	373
Bypassing AOL Parental Controls	373
Bypassing eEye’s Security Checks	374
Zones and the Internet Explorer 4 "Dotless-IP Address" Bug	374
Internet Information Server 4.0 ::$DATA Vulnerability	375
When is a Line Really Two Lines?	377
Yet Another Web Issue—Escaping	378
Visual Equivalence Attacks and the Homograph Attack	382
Preventing Canonicalization Mistakes	383
Don’t Make Decisions Based on Names	383
Use a Regular Expression to Restrict What’s Allowed in a Name	383
Stopping 8.3 Filename Generation	385
Don’t Trust the PATH—Use Full Path Names	385
Attempt to Canonicalize the Name	386
Calling CreateFile Safely	390
Web-Based Canonicalization Remedies	391
Restrict What Is Valid Input	391
Be Careful When Dealing with UTF-8	391
ISAPIs—Between a Rock and a Hard Place	392
A Final Thought: Non-File-Based Canonicalization Issues	393
Server Names	393
Usernames	394
Summary	396
12  Database Input Issues	397
The Issue	398
Pseudoremedy #1: Quoting the Input	401
Pseudoremedy #2: Use Stored Procedures	402
Remedy #1: Never Ever Connect as sysadmin	403
Remedy #2: Building SQL Statements Securely	404
Building SQL Stored Procedures Securely	406
An In-Depth Defense in Depth Example	407
Summary	411
13  Web-Specific Input Issues	413
Cross-Site Scripting: When Output Turns Bad	413
Sometimes the Attacker Doesn’t Need a <SCRIPT> Block	417
The Attacker Doesn’t Need the User to Click a Link!	418
Other XSS-Related Attacks	418
XSS Attacks Against Local Files	418
XSS Attacks Against HTML Resources	420
XSS Remedies	421
Encoding Output	422
Adding Double Quotes Around All Tag Properties	422
Inserting Data in the innerText Property	423
Forcing the Codepage	423
The Internet Explorer 6.0 SP1 HttpOnly Cookie Option	424
Internet Explorer "Mark of the Web"	425
Internet Explorer <FRAME SECURITY> Attribute	426
ASP.NET 1.1 ValidateRequest configuration option	427
Don’t Look for Insecure Constructs	428
But I Want Users to Post HTML to My Web Site!	430
How to Review Code for XSS Bugs	431
Other Web-Based Security Topics	431
eval() Can Be Bad	431
HTTP Trust Issues	432
ISAPI Applications and Filters	433
Be Wary of "Predictable Cookies"	436
SSL/TLS Client Issues	437
Summary	438
14  Internationalization Issues	439
The Golden I18N Security Rules	440
Use Unicode in Your Application	440
Prevent I18N Buffer Overruns	441
Words and Bytes	442
Validate I18N	443
Visual Validation	443
Do Not Validate Strings with LCMapString	443
Use CreateFile to Validate Filenames	443
Character Set Conversion Issues	444
Use MultiByteToWideChar with MB_PRECOMPOSED and MB_ERR_INVALID_CHARS	444
Use WideCharToMultiByte with WC_NO_BEST_FIT_CHARS	445
Comparison and Sorting	448
Unicode Character Properties	448
Normalization	450
Summary	451
PART III EVEN MORE SECURE CODING TECHNIQUES
15  Socket Security	455
Avoiding Server Hijacking	456
TCP Window Attacks	463
Choosing Server Interfaces	464
Accepting Connections	464
Writing Firewall-Friendly Applications	470
Use One Connection to Do the Job	471
Don’t Require the Server to Connect Back to the Client	471
Use Connection-Based Protocols	472
Don’t Multiplex Your Application over Another Protocol	472
Don’t Embed Host IP Addresses in Application-Layer Data	473
Make Your Application Configurable	473
Spoofing and Host-Based and Port-Based Trust	473
IPv6 Is Coming!	474
Summary	476
16  Securing RPC, ActiveX Controls, and DCOM	477
An RPC Primer	478
What Is RPC?	478
Creating RPC Applications	479
How RPC Applications Communicate	481
Secure RPC Best Practices	482
Use the /robust MIDL Switch	483
Use the [range] Attribute	483
Require Authenticated Connections	484
Use Packet Privacy and Integrity	489
Use Strict Context Handles	491
Don’t Rely on Context Handles for Access Checks	492
Be Wary of NULL Context Handles	493
Don’t Trust Your Peer	494
Use Security Callbacks	495
Implications of Multiple RPC Servers in a Single Process	497
Use Mainstream Protocols	499
Secure DCOM Best Practices	499
DCOM Basics	500
Application-Level Security	502
DCOM User Contexts	502
Programmatic Security	505
Sources and Sinks	508
An ActiveX Primer	509
Secure ActiveX Best Practices	509
What ActiveX Components Are Safe for Initialization and Safe for Scripting?	510
Best Practices for Safe for Initialization and Scripting	511
Summary	515
17  Protecting Against Denial of Service Attacks	517
Application Failure Attacks	517
CPU Starvation Attacks	521
Memory Starvation Attacks	529
Resource Starvation Attacks	530
Network Bandwidth Attacks	532
Summary	533
18  Writing Secure .NET Code	535
Code Access Security: In Pictures	537
FxCop: A "Must-Have" Tool	539
Assemblies Should Be Strong-Named	540
Strong-Named Assemblies and ASP.NET	542
Specify Assembly Permission Requirements	542
Request Minimal Permission Set	543
Refuse Unneeded Permissions	544
Request Optional Permissions	544
Overzealous Use of Assert	545
Further Information Regarding Demand and Assert	547
Keep the Assertion Window Small	549
Demands and Link Demands	550
An Example LinkDemand Security Bug	551
Use SuppressUnmanagedCodeSecurityAttribute with Caution	552
Remoting Demands	553
Limit Who Uses Your Code	554
No Sensitive Data in XML or Configuration Files	555
Review Assemblies That Allow Partial Trust	556
Check Managed Wrappers to Unmanaged Code for Correctness	557
Issues with Delegates	558
Issues with Serialization	558
The Role of Isolated Storage	559
Disable Tracing and Debugging Before Deploying ASP.NET Applications	561
Do Not Issue Verbose Error Information Remotely	561
Deserializing Data from Untrusted Sources	562
Don’t Tell the Attacker Too Much When You Fail	562
Summary	564
PART IV  SPECIAL TOPICS
19  Security Testing	567
The Role of the Security Tester	567
Security Testing Is Different	568
Building Security Test Plans from a Threat Model	569
Decompose the Application	570
Identify the Component Interfaces	570
Rank the Interfaces by Potential Vulnerability	572
Ascertain the Data Structures Used by Each Interface	573
Attacking Applications with STRIDE	573
Attacking with Data Mutation	575
Before Testing	587
Building Tools to Find Flaws	588
Testing Clients with Rogue Servers	606
Should a User See or Modify That Data?	607
Testing with Security Templates	607
When You Find a Bug, You’re Not Done!	609
Test Code Should Be of Great Quality	610
Test the End-to-End Solution	611
Determining Attack Surface	611
Determine Root Attack Vectors	611
Determine Bias For Attack Vectors	612
Count the Biased Vectors in the Product	612
Summary	613
20  Performing a Security Code Review	615
Dealing with Large Applications	617
A Multiple-Pass Approach	618
Low-Hanging Fruit	619
Integer Overflows	620
A Related Issue: Integer Underflows	624
Checking Returns	624
Perform an Extra Review of Pointer Code	625
Never Trust the Data	625
Sumary	626
21  Secure Software Installation	627
Principle of Least Privilege	628
Clean Up After Yourself!	630
Using the Security Configuration Editor	630
Low-Level Security APIs	638
Using the Windows Installer	638
Summary	640
22  Building Privacy into Your Application	641
Malicious vs. Annoying Invasions of Privacy	642
Major Privacy Legislation	643
Personally Identifiable Information	643
The EU Directives on Data Protection	643
Safe Harbor Principles	644
Other Privacy Legislation	646
Privacy vs. Security	646
Building a Privacy Infrastructure	647
The Role of the Chief Privacy Officer	648
The Role of the Privacy Advocate	648
Designing Privacy-Aware Applications	649
Including Privacy in the Development Process	649
Exploring Privacy Features	652
Summary	662
23  General Good Practices	663
Don’t Tell the Attacker Anything	663
Service Best Practices	663
Security, Services, and the Interactive Desktop	664
Service Account Guidelines	665
Don’t Leak Information in Banner Strings	667
Be Careful Changing Error Messages in Fixes	668
Double-Check Your Error Paths	668
Keep It Turned Off!	668
Kernel-Mode Mistakes	668
High-Level Security Issues	669
Handles	670
Symbolic Links	670
Quota	670
Serialization Primitives	670
Buffer-Handling Issues	671
IRP Cancellation	673
Add Security Comments to Code	674
Leverage the Operating System	674
Don’t Rely on Users Making Good Decisions	675
Calling CreateProcess Securely	675
Do Not Pass NULL for lpApplicationName	677
Use Quotes Around the Path to Executable in lpCommandLine	677
Don’t Create Shared/Writable Segments	677
Using Impersonation Functions Correctly	678
Don’t Write User Files to \Program Files	678
Don’t Write User Data to HKLM	679
Don’t Open Objects for FULL_CONTROL or ALL_ACCESS	679
Object Creation Mistakes	679
Care and Feeding of CreateFile	681
Creating Temporary Files Securely	682
Implications of Setup Programs and EFS	686
File System Reparse Point Issues	686
Client-Side Security Is an Oxymoron	687
Samples Are Templates	688
Dogfood Your Stuff!	688
You Owe It to Your Users If…	689
Determining Access Based on an Administrator SID	689
Allow Long Passwords	690
Be Careful with _alloca	691
ATL Conversion Macros	691
Don’t Embed Corporate Names	692
Move Strings to a Resource DLL	693
Application Logging	693
Migrate Dangerous C/C++ to Managed Code	694
24  Writing Security Documentation and Error Messages	695
Security Issues in Documentation	695
The Basics	696
Threat Mitigation Through Documentation	697
Documenting Security Best Practices	698
Security Issues in Error Messages	700
A Typical Security Message	700
Information Disclosure Issues	701
Informed Consent	702
Progressive Disclosure	704
Be Specific	705
Consider Not Asking the Question	706
Usability Test Your Security Messages	707
A Note When Reviewing Product Specifications	708
Security Usability	708
Summary	709
PART V APPENDIXES
A  Dangerous APIs	713
B  Ridiculous Excuses We’ve Heard	723
C  A Designer’s Security Checklist	729
D  A Developer’s Security Checklist	731
E  A Tester’s Security Checklist	737
A Final Thought	739
ANNOTATED BIBLIOGRAPHY	741
INDEX	747

About the Authors

Michael Howard is a security program manager on the Microsoft Windows XP team, focusing on secure design, programming, and testing techniques. He works with hundreds of people both inside and outside the company each year to help them secure their applications. He is the author of Designing Secure Web-Based Applications for Microsoft Windows 2000 from Microsoft Press. Prior to working on Windows XP, Michael worked on next-generation Web server technologies and IIS. He has worked on Microsoft Windows NT® security since 1992.

David LeBlanc is a senior security technologist in Microsoft's Information Technology Group. His primary role is defending the Microsoft network from attack. He has worked in the security field throughout his professional life, including working at Internet Security Systems where he was the primary engineer on ISS's award-winning security products. David serves on a number of external security-related advisory boards.

Apr 12, 2007     
It's About Time!
This book was immensely helpful. Michael Howard and Dave LeBlanc does an excellent job with breaking content down into easily manageable pieces. As a developer, I'm excited that people are actually taking notice of software security. I'm going to take what I learned from this book and build on it at the Secure Development World Conference!

Forgot your password? FAQs Shipping Options Returns Your Orders Your Account