SwA in Education, Training & Certification - US-Cert
SwA in Education, Training & Certification - US-Cert
SwA in Education, Training & Certification - US-Cert
You also want an ePaper? Increase the reach of your titles
YUMPU automatically turns print PDFs into web optimized ePapers that Google loves.
Books<br />
Table 5 – A List of <strong>SwA</strong> focused Books for Use <strong>in</strong> <strong>Education</strong> and Tra<strong>in</strong><strong>in</strong>g<br />
Topic Title and Publisher Summary and Possible Use<br />
Attack Patterns<br />
Reverse Eng<strong>in</strong>eer<strong>in</strong>g<br />
Implementation level<br />
issues<br />
Design Pr<strong>in</strong>ciples and<br />
Techniques<br />
Software Assurance Pocket Guide Series:<br />
Life Cycle Support, Volume I – Version 2.2, Mar 16, 2011<br />
Exploit<strong>in</strong>g Software: How to Break Code by<br />
Greg Hoglund and Gary McGraw, Addison<br />
Wesley, 2004<br />
High-Assurance Design: Architect<strong>in</strong>g Secure<br />
and Reliable Enterprise Applications, Clifford<br />
J. Berg, Addison-Wesley Professional 2005.<br />
Information Security Build<strong>in</strong>g a Secure Computer System, Morrie<br />
Gasser, 1988<br />
Pr<strong>in</strong>ciples and<br />
guidel<strong>in</strong>es<br />
Implementation level<br />
issues<br />
Software Assurance <strong>in</strong><br />
SDLC<br />
24 Deadly S<strong>in</strong>s of Software Security:<br />
Programm<strong>in</strong>g Flaws and How to Fix Them<br />
Michael Howard, David LeBlanc, John Viega,<br />
McGraw-Hill Osborne Media, 2009<br />
Secure Cod<strong>in</strong>g <strong>in</strong> C and C++, Robert Seacord,<br />
Addison-Wesley Professional, 2005<br />
Secure Programm<strong>in</strong>g for L<strong>in</strong>ux and Unix<br />
HOWTO, David Wheeler, 2003<br />
Build<strong>in</strong>g Secure Software: How to Avoid<br />
Security Problems the Right Way, John Viega<br />
and Gary McGraw, Addison Wesley, 2002<br />
Secure and Resilient Software Development,<br />
Mark S. Merkow, Lakshmikanth Raghavan,<br />
Auerbach Publications, 2010<br />
Software Security Eng<strong>in</strong>eer<strong>in</strong>g: A Guide for<br />
Project Managers, Julia Allen, Sean Barnum,<br />
Robert J. Ellison, Gary McGraw, Nancy R. Mead,<br />
Addison-Wesley, 2008 (ISBN 032150917X).<br />
The Security Development Lifecycle: SDL: A<br />
Process for Develop<strong>in</strong>g Demonstrably More<br />
Secure Software, Michael Howard, Steve<br />
Lipner, Microsoft Press, 2006<br />
Software Security: Build<strong>in</strong>g Security In, Gary<br />
McGraw, Addison-Wesley Professional, 2006.<br />
Secure Cod<strong>in</strong>g: Pr<strong>in</strong>ciples and Practices,<br />
Mark G. Graff and Kenneth R. van Wyk, O‟Reilly,<br />
2003<br />
Understand<strong>in</strong>g attack strategies to build better<br />
defenses. Case studies for class discussion.<br />
http://www.exploit<strong>in</strong>gsoftware.com/<br />
Basic pr<strong>in</strong>ciples and techniques that can be<br />
applied to the development of bus<strong>in</strong>ess<br />
applications.<br />
Good read<strong>in</strong>g for Information Security basics.<br />
Identifies the most common design and cod<strong>in</strong>g<br />
errors, their fixes and avoidance strategies.<br />
Examples of secure code, <strong>in</strong>secure code, and<br />
exploits, implemented for W<strong>in</strong>dows and L<strong>in</strong>ux.<br />
http://www.cert.org/books/secure-cod<strong>in</strong>g/<br />
Unix systems-specific guidel<strong>in</strong>es for C, C++, Java,<br />
Perl, PHP, Python, Tcl, and Ada95.<br />
http://www.dwheeler.com/secure-programs/<br />
Software Assurance pr<strong>in</strong>ciples and guidel<strong>in</strong>es and<br />
Implementation level issues Possible use as a<br />
textbook or additional reference material.<br />
A practitioner‟s perspective on enterprise<br />
assurance programs.<br />
Software Security Eng<strong>in</strong>eer<strong>in</strong>g draws extensively<br />
on the systematic approach developed for the<br />
Build Security In (BSI) Web site.<br />
http://www.softwaresecurityeng<strong>in</strong>eer<strong>in</strong>g.com<br />
Adaptation of Microsoft‟s Security Development<br />
Lifecycle (SDL) with case-studies on several<br />
Microsoft products.<br />
Introduction to Software Security Touchpo<strong>in</strong>ts<br />
dur<strong>in</strong>g software development. Possible use as a<br />
textbook or additional reference material.<br />
A practical approach to <strong>in</strong>tegrat<strong>in</strong>g <strong>SwA</strong> topics <strong>in</strong>to<br />
the SDLC. Great for assignment of additional<br />
read<strong>in</strong>gs that complement classroom materials.<br />
http://www.securecod<strong>in</strong>g.org/<br />
Software Assurance <strong>in</strong> <strong>Education</strong>, Tra<strong>in</strong><strong>in</strong>g & <strong><strong>Cert</strong>ification</strong><br />
12