Take the 2-minute tour ×
Programmers Stack Exchange is a question and answer site for professional programmers interested in conceptual questions about software development. It's 100% free, no registration required.

What are some good introductory books about writing secure software? Specifically, one that covers basic strategies and design patterns for writing a secure software and surveys common security vulnerabilities, how they're exploited, and how you can protect against them.

Personally, I've picked up bits of security know-how here and there over my career, but now I'd like a more systematic overview.

share|improve this question
add comment

4 Answers

"Writing Secure Code" 2nd edition by Howard and LeBlanc is a good primer. It's very code-oriented, though, but maybe that's what you're after.

On the more non-functional, architectural side of things, I can suggest "Threat Modeling" by Swiderski and Snyder.

Finally, if you are into really serious stuff, I recommend Donald Firesmith's work on security and safety for software-intensive systems. He has published a few things on the subject, such as this one. This is not introductory stuff though.

Good luck.

share|improve this answer
add comment

My Computer Security textbook from college was actually quite good for the conceptual side - it's called Computer Security: Art and Science. Systematic would be a good word to describe it.

Come in prepared with a strong mathematical background, though - this is a fairly weighty tome.

share|improve this answer
add comment

Are you also looking to learn a lot about security practices, or just the coding side of it? Introduction to Computer Security is really good at teaching the concepts you'll need in order to make secure software. It ranges from the various encryption schemas (AES, RSA, Hashing, etc) to securing data locally. It's not a coding tutorial, though.

share|improve this answer
add comment

It's not so much about writing software securely as it is about the problems of security in the first place, but Ross Anderson's Security Engineering is a good introduction to security issues.

Also, there's Ferguson & Schneier's Practical Cryptography, which is much more about how to use crypto properly than about crypto itself. (Although Schneier also pretty much wrote the book on that too).

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.