Enterprise Software Security: A Confluence of Disciplines (Paperback)

Kenneth R. van Wyk, Mark G. Graff, Dan S. Peters, Diana L. Burley Ph.D.

  • 出版商: Addison Wesley
  • 出版日期: 2014-12-17
  • 售價: $1,570
  • 貴賓價: 9.5$1,492
  • 語言: 英文
  • 頁數: 320
  • 裝訂: Paperback
  • ISBN: 0321604113
  • ISBN-13: 9780321604118
  • 相關分類: 資訊安全
  • 立即出貨 (庫存 < 3)

商品描述

STRENGTHEN SOFTWARE SECURITY BY HELPING DEVELOPERS AND SECURITY EXPERTS WORK TOGETHER

 

Traditional approaches to securing software are inadequate. The solution: Bring software engineering and network security teams together in a new, holistic approach to protecting the entire enterprise. Now, four highly respected security experts explain why this “confluence” is so crucial, and show how to implement it in your organization.

 

Writing for all software and security practitioners and leaders, they show how software can play a vital, active role in protecting your organization. You’ll learn how to construct software that actively safeguards sensitive data and business processes and contributes to intrusion detection/response in sophisticated new ways. The authors cover the entire development lifecycle, including project inception, design, implementation, testing, deployment, operation, and maintenance. They also provide a full chapter of advice specifically for Chief Information Security Officers and other enterprise security executives.


Whatever your software security responsibilities, Enterprise Software Security delivers indispensable big-picture guidance–and specific, high-value recommendations you can apply right now.

 

COVERAGE INCLUDES:


• Overcoming common obstacles to collaboration between developers and IT security professionals
• Helping programmers design, write, deploy, and operate more secure software
• Helping network security engineers use application output more effectively
• Organizing a software security team before you’ve even created requirements
• Avoiding the unmanageable complexity and inherent flaws of layered security
• Implementing positive software design practices and identifying security defects in existing designs
• Teaming to improve code reviews, clarify attack scenarios associated with vulnerable code, and validate positive compliance
• Moving beyond pentesting toward more comprehensive security testing
• Integrating your new application with your existing security infrastructure
• “Ruggedizing” DevOps by adding infosec to the relationship between development and operations
• Protecting application security during maintenance

商品描述(中文翻譯)

加強軟體安全性:協助開發人員和安全專家共同合作

傳統的軟體安全保護方法已經不足夠。解決方案是將軟體工程和網路安全團隊結合起來,以全新的整體方法來保護整個企業。現在,四位備受尊敬的安全專家解釋了為什麼這種「融合」非常重要,並展示了如何在您的組織中實施它。

他們為所有軟體和安全從業人員和領導者撰寫,並展示了軟體如何在保護組織方面扮演重要且積極的角色。您將學習如何構建能夠主動保護敏感數據和業務流程,並以全新的方式對入侵檢測/響應做出貢獻的軟體。作者們涵蓋了整個開發生命週期,包括項目起始、設計、實施、測試、部署、運營和維護。他們還提供了一整章的建議,專門針對首席資訊安全官和其他企業安全主管。

無論您的軟體安全責任是什麼,《企業軟體安全》都提供了不可或缺的整體指導,以及您可以立即應用的具體、高價值的建議。

內容包括:
• 克服開發人員和IT安全專業人員之間合作的常見障礙
• 幫助程式設計師設計、撰寫、部署和操作更安全的軟體
• 幫助網路安全工程師更有效地使用應用程式輸出
• 在創建需求之前組織軟體安全團隊
• 避免分層安全的難以管理的複雜性和固有缺陷
• 實施積極的軟體設計實踐,並識別現有設計中的安全缺陷
• 團隊合作改進程式碼審查,明確與易受攻擊程式碼相關的攻擊場景,並驗證積極的合規性
• 從測試漏洞擴展到更全面的安全測試
• 將新應用程式與現有的安全基礎設施整合
• 通過在開發和運營之間添加信息安全來增強DevOps
• 在維護期間保護應用程式安全